Getting Data In

How to "filter out" to discard specific events Palo Alto firewall?

jfeitosa
Path Finder

Hello guys!

I need help to create "filter out" in Palo Alto firewall events.
I want to discard the DNS condulta events, whose field is dest = 8.8.8.8.

I created entries in props.conf and transform.conf

  • props.conf

    #### ########## FILTER OUT

    [source :: udp: 5514]
    TRANSFORMS-null = setnull4

  • transform.conf

    FILTER OUT FIREWALL

    [setnull4]
    REGEX = ^ (?: [^ \ N] *) {8} (P [^,] +?)
    DEST_KEY = queue
    FORMAT = nullQueue

I also tried REGEX = (. *) 8.8.8.8, but it did not work.

Can anyone help me how to create a "filter out" to discard these events?

Thank you.

0 Karma

jfeitosa
Path Finder

I solve that.

props.conf
[source::udp:514]
TRANSFORMS-nullQ=nullFilter

transform.conf

FILTER OUT FIREWALL

[nullFilter]
REGEX = (%ASA-\d+-.(Built|Teardown))
DEST_KEY = queue
FORMAT = nullQueue

Tks,

0 Karma

woodcock
Esteemed Legend

If you are trying to throw away any events that have a field dest with a value of 8.8.8.8 then try this:

props.conf

[source::udp:5514]
TRANSFORMS-null = setnull4

transforms.conf

[setnull4]
SOURCE_KEY = dest
REGEX = 8\.8\.8\.8
DEST_KEY = queue
FORMAT = nullQueue

NOTE: Be sure that there are no spaces in the stanza headers (around your colons).

0 Karma

jfeitosa
Path Finder

Hi woodcock,

It does not work this REGEX. The term SOURCE KEY = dest was not accepted appears error inconsistency. I tried without the term SOURCE_KEY = dest, still did not work.

Thanks in advance.

0 Karma

woodcock
Esteemed Legend

If it really will not take SOURCE_KEY = dest then remove just than line and try this REGEX instead (to match anywhere in _raw)

REGEX = (^|\D)8\.8\.8\.8(\D|$)
0 Karma
Get Updates on the Splunk Community!

Splunk Observability Cloud | Unified Identity - Now Available for Existing Splunk ...

Raise your hand if you’ve already forgotten your username or password when logging into an account. (We can’t ...

Index This | How many sides does a circle have?

February 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

Registration for Splunk University is Now Open!

Are you ready for an adventure in learning?   Brace yourselves because Splunk University is back, and it's ...