Splunk Enterprise Security

Splunk Palo Alto Add-on 6.0.2 and Enterprise Security issue

Splunk Employee
Splunk Employee

I recently upgraded the Splunk Palo Alto Add-on from 3.8.0 to 6.0.2 on our ES search head. Since that change, the category is no longer being extracted properly and it is affecting the web data model which shows all traffic in the HTTP Category Analysis as "unknown".

Splunk Employee
Splunk Employee

This is an issue in the Add-on 6.0.2. According to the folks at PAN, it will be fixed in 6.0.3. The current workaround solution is by modifying the following file:


In that file, find the line that reads:

EVAL-category = threat_category

I believe it is line 76. Change the line to this:

EVAL-category = if(log_subtype=="url" OR log_subtype=="file", raw_category, threat_category)

Then restart Splunk to put the change into effect.

0 Karma
Get Updates on the Splunk Community!

Splunk Lantern | Spotlight on Security: Adoption Motions, War Stories, and More

Splunk Lantern is a customer success center that provides advice from Splunk experts on valuable data ...

Splunk Cloud | Empowering Splunk Administrators with Admin Config Service (ACS)

Greetings, Splunk Cloud Admins and Splunk enthusiasts! The Admin Configuration Service (ACS) team is excited ...

Tech Talk | One Log to Rule Them All

One log to rule them all: how you can centralize your troubleshooting with Splunk logs We know how important ...