Getting Data In

Null filtering not working with props and transforms

jwalzerpitt
Motivator

I have the following conf file configs to drop any event that contains the verbiage, "Allow all zones to query DNS anycast address", in Palo logs:

props.conf
[pan:traffic]
TRANSFORMS-paloanycast = paloruledrop
 
transforms.conf
[paloruledrop]
REGEX = Allow all zones to query DNS anycast address
DEST_KEY = queue
FORMAT = nullQueue

Snippet of event

 

 

Nov 20 07:11:00 firewall,2021/11/20 07:10:59,010701010006,TRAFFIC,end,2305,2021/11/20 07:10:59,x.x.x.x,y.y.y.y,0.0.0.0,0.0.0.0,Allow all zones to query DNS anycast address,,,dns,vsys7,vrf,xxx-xx-x,xxx.xxx,xxx.xxx,data-data-data,2021/11/20...

 

 

Applied the  changes to my cluster master and pushed to the indexers (verified the indexers got the config), but these "Allow all zones to query DNS anycast address" events are not being dropped.

I verified the regex on regex101.com

Any help would be appreciated

Thx

Labels (1)
Tags (4)
0 Karma

acharlieh
Influencer

Typically, PaloAlto logs aren’t ingested as pan:traffic directly, but rather as pan:log (or older as pan_log)

this gets changed into pan:traffic (and pan:other-log-types) during the transforms step assuming you have the Pan-TA: https://github.com/PaloAltoNetworks/Splunk-Apps/blob/develop/Splunk_TA_paloalto/default/props.conf

So you likely need [pan:log] or [pan_log] in your props instead of [pan:traffic] depending on what your inputs look like on your forwarders

Secondly you mention this is on your indexers. Are your PAN logs being ingested by Universal Forwarders or Heavy Forwarders? If they are Heavy Forwarders, or you are sending through  intermediate Heavy Forwarders, then parsing is already complete by the time you reach your indexers, and your props and transforms need to be on a different system (the first HF in the path from your syslog servers to your indexers)

Hope this helps

jwalzerpitt
Motivator

Thx for the reply

I am using the Palo TA and ingesting the logs via HF with the sourcetype set to pan:traffic

0 Karma
Get Updates on the Splunk Community!

Maximize the Value from Microsoft Defender with Splunk

<P style=" text-align: center; "><span class="lia-inline-image-display-wrapper lia-image-align-center" ...

This Week's Community Digest - Splunk Community Happenings [6.27.22]

<FONT size="5"><FONT size="5" color="#FF00FF">Get the latest news and updates from the Splunk Community ...