Create Queries for Palo alto firewall

[saravanan4611]

I want to create queries for Palo alto firewall.

what are the queries we can create for Palo alto firewall .Any one know about this means please help me to create some queries for Palo alto firewall.

we are getting a logs from this firewall but still we didn't create any queries.

please help me in this.... thanks in advance...!

[mattymo]

Hi saravanan4611

Do you work with firewalls or are you familiar with them at all? Do you work with the team that manages them???

Your best bet is to work with network domain experts, usually core networking teams and/or security teams, who have questions they wish to ask of their Palo Alto firewall data and learn what are key insights that can be gleaned from the data you are receiving.

Palo Alto built this app https://splunkbase.splunk.com/app/491/#/details available on Splunkbase, which would be full of queries related to the health and operation of their products.

Even if you know nothing about networking and firewalls, Splunk makes it very easy for non domain experts to explore datasets and pull insights. What have you tried thus far? what data are you receiving specifically? I would recommend exploring the data and the fields within it and reviewing with someone who you work with that has a vested interest in the data you have.