Good Morning,
I’m looking for the specification of the S2S protocol.
We have some trouble with getting splunk uf data through a Palo Alto Firewall.
the firewall has a Application Profile Engine.
So it not just looks at layer 4 for IP/Port and Protocol but also certain Aspekts of the packet like headers….
There is no predefined profile for splunk S2S so we need to create it, but I can‘t find the docs for Protocol definition.
We are aware of the fact that it is possible to bypass this App engine and do a layer 4 filtering.
But it would be the only application in the company to do that and the fact that it would be for a Internet facing service and a security service seams off. 🫣
We where adviced to use S2S over HEC for Stability reasons if it does not work out we have to switch but for now we want to try make it work.
