I have the following conf file configs to drop any event that contains the verbiage, "Allow all zones to query DNS anycast address", in Palo logs:
props.conf [pan:traffic] TRANSFORMS-paloanycast = paloruledrop transforms.conf [paloruledrop] REGEX = Allow all zones to query DNS anycast address DEST_KEY = queue FORMAT = nullQueue
Snippet of event
Nov 20 07:11:00 firewall,2021/11/20 07:10:59,010701010006,TRAFFIC,end,2305,2021/11/20 07:10:59,x.x.x.x,y.y.y.y,0.0.0.0,0.0.0.0,Allow all zones to query DNS anycast address,,,dns,vsys7,vrf,xxx-xx-x,xxx.xxx,xxx.xxx,data-data-data,2021/11/20...
Applied the changes to my cluster master and pushed to the indexers (verified the indexers got the config), but these "Allow all zones to query DNS anycast address" events are not being dropped.
I verified the regex on regex101.com
Any help would be appreciated
Typically, PaloAlto logs aren’t ingested as pan:traffic directly, but rather as pan:log (or older as pan_log)
this gets changed into pan:traffic (and pan:other-log-types) during the transforms step assuming you have the Pan-TA: https://github.com/PaloAltoNetworks/Splunk-Apps/blob/develop/Splunk_TA_paloalto/default/props.conf
So you likely need [pan:log] or [pan_log] in your props instead of [pan:traffic] depending on what your inputs look like on your forwarders
Secondly you mention this is on your indexers. Are your PAN logs being ingested by Universal Forwarders or Heavy Forwarders? If they are Heavy Forwarders, or you are sending through intermediate Heavy Forwarders, then parsing is already complete by the time you reach your indexers, and your props and transforms need to be on a different system (the first HF in the path from your syslog servers to your indexers)
Hope this helps