Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
- About btorresgil
btorresgil
Builder
Member since:
06-08-2013
02-04-2021
Community Statistics
| Posts | 140 |
| Solutions | 26 |
| Karma Given | 5 |
| Karma Received | 64 |
| Member Since | 06-08-2013 |
Activity Feed
- Got Karma for Re: Palo Alto App cannot see data but logs are seen as PAN:*. 06-05-2020 12:50 AM
- Got Karma for Re: Threatlist Error after clean install of Palo Alto App and Add-on 6.0. 06-05-2020 12:49 AM
- Got Karma for Re: Threatlist Error after clean install of Palo Alto App and Add-on 6.0. 06-05-2020 12:49 AM
- Got Karma for Re: User Behavior search error in Tsidxstats 6.0. 06-05-2020 12:49 AM
- Karma Re: How do I get the Palo Alto Networks App for Splunk to parse URLs with commas? for MonkeyK. 06-05-2020 12:48 AM
- Got Karma for Re: Why does the Palo Alto Networks App for Splunk make calls out to Palo Alto?. 06-05-2020 12:48 AM
- Got Karma for Re: Palo Alto Networks App for Splunk: Is it possible to restrict certain Palo Alto traffic logs?. 06-05-2020 12:48 AM
- Got Karma for Re: Support for the 'Authentication' and 'Network Session' data models on the Splunk_TA_paloalto. 06-05-2020 12:48 AM
- Got Karma for Re: Support for the 'Authentication' and 'Network Session' data models on the Splunk_TA_paloalto. 06-05-2020 12:48 AM
- Got Karma for Re: Why do I only see version 5.3 of the Palo Alto Networks App for Splunk on Internet Explorer?. 06-05-2020 12:48 AM
- Got Karma for Re: How to capture URL information. 06-05-2020 12:48 AM
- Got Karma for Re: Palo Alto Networks App for Splunk: Why is Traps data not properly populating in the Endpoint tab?. 06-05-2020 12:48 AM
- Karma Re: Do we need to install the Palo Alto Networks App for Splunk on all of our indexers? for lguinn2. 06-05-2020 12:47 AM
- Karma Re: How do I divide multiple values in a field into new separate fields at search-time? for sundareshr. 06-05-2020 12:47 AM
- Got Karma for Re: Get an error clicking on any of the pie-charts on the Threats Dashboard. 06-05-2020 12:47 AM
- Got Karma for Re: Dashboards not populating other than main Palo Alto Network Overview Dash. 06-05-2020 12:47 AM
- Got Karma for Re: Why are other apps showing errors about missing PAN lookup files after upgrading Splunk for Palo Alto Networks to 4.1.2?. 06-05-2020 12:47 AM
- Got Karma for Re: Why are other apps showing errors about missing PAN lookup files after upgrading Splunk for Palo Alto Networks to 4.1.2?. 06-05-2020 12:47 AM
- Got Karma for Re: Why are other apps showing errors about missing PAN lookup files after upgrading Splunk for Palo Alto Networks to 4.1.2?. 06-05-2020 12:47 AM
- Got Karma for Re: Why are other apps showing errors about missing PAN lookup files after upgrading Splunk for Palo Alto Networks to 4.1.2?. 06-05-2020 12:47 AM
Topics I've Started
| Subject | Karma | Author | Latest Post |
|---|---|---|---|
| 7 | |||
| 2 | |||
| 1 | |||
| 3 |
09-03-2019
08:48 AM
1 Karma
Hello,
Usually this is caused by one of these problems:
Time or timezone issue. The dashboards show the last 60 minutes, so if the time of the logs is prior to that, nothing will show up in the dashboards.
Datamodels Acceleration is disabled. Please check that all the Palo Alto Networks datamodels have acceleration enabled. Splunk makes us disable them by default. We recommend 7 days as a starting timeframe for datamodel acceleration.
Here's our troubleshooting guide for dashboards. It should guide you through checking these issues and correcting them:
https://splunk.paloaltonetworks.com/troubleshoot.html#dashboards-not-working
... View more
05-09-2019
09:21 AM
From the Palo Alto Networks perspective, it will send the log to any syslog server that presents a trusted server certificate. From the Splunk perspective, the Universal Forwarder will index any logs collected by rsyslog. So it sounds like this question is rsyslog focused. Perhaps one of the "Configure TLS on rsyslog" guides around the internet might help? http://kb.kristianreese.com/index.php?View=entry&EntryID=148 https://www.loggly.com/docs/rsyslog-tls-configuration/
... View more
11-21-2018
03:20 PM
Rather than trying to sum an eval, my suggestion is to create a lookup. The lookup could have two columns: http_category , http_category_verdict
For each http category, set a verdict of good , bad , or gray area . Then, whenever you have results with an http_category field, just pipe to the lookup table:
<rest of search> | lookup your-lookup-table http_category
That will reference the lookup table and add a field called http_category_verdict to each log based on the http category of each log.
Hope that helps!
... View more
11-21-2018
09:31 AM
There's nothing about 7.2.1 vs 7.2.0 that would cause any difference. But perhaps this upgrade caused the datamodels to rebuild? When you went through the troubleshooting steps, what was the datamodel build status?
... View more
11-15-2018
10:16 AM
What version of the App/Add-on are you using?
Do you have a file in your Splunk_TA_paloalto/lookups directory called pan_vendor_info.csv ?
... View more
10-31-2018
09:14 AM
ok, great to hear, glad it's working.
... View more
10-31-2018
08:56 AM
You shouldn't need to add the index to the search. Are you sure you are searching the pan_logs index by default in your user/role settings?
... View more
10-30-2018
08:44 AM
Hi matman, App developers here. We'll check this out and let you know. Thanks!
... View more
10-30-2018
08:36 AM
Replication is on by default in the latest Add-on. Try re-installing the Add-on, it sounds like something is broken after the upgrade.
... View more
10-25-2018
09:14 AM
Hi saurabh_tek11, thanks for bumping this. We support network sessions, see eventtype=pan_traffic_start and pan_traffic_end. We could support Authentication to some extent with USERID type logs from the firewall, but the Authentication CIM is not a great fit because it's geared more toward the logs from the actual point of authentication, which the firewall typically is not in enterprise environments. This would be your RADIUS, LDAP, or AD server usually.
I opened a feature request so you can share your use cases for supporting the Authentication CIM. I'm very interested in any feedback, thanks!
https://github.com/PaloAltoNetworks/Splunk_TA_paloalto/issues/33
... View more
10-23-2018
08:42 AM
Great! Glad to hear it!
... View more
10-22-2018
01:53 PM
Hello! IP address tags use the same system in the firewall as User-ID mappings, so, ever since PAN-OS 8.0 you can redistribute the IP tags between firewalls the same way as users. Basically, you tell all the firewalls to share user/tag mappings, then tag the IP addresses on the main User-ID Agent firewall (or Panorama). The tag will automatically be redistributed to all other firewalls you've configured to receive it. This way, Splunk only needs to connect to one Firewall or Panorama to effectively create a new tag on all firewalls.
More information:
https://splunk.paloaltonetworks.com/userid.html#more-information-distribute-user-id
https://www.paloaltonetworks.com/documentation/81/pan-os/pan-os/user-id/deploy-user-id-in-a-large-scale-network/redistribute-user-mappings-and-authentication-timestamps#idc04d8804-9dd7-4bd3-929d-0e8de0f9fe97
... View more
09-06-2018
01:35 PM
Returning a 'url' field is not the same as being a 'url' log. A url log MUST have the word 'url' in the log_subtype field. Since you're getting 'vulnerability' and 'spyware', these are vulnerability and spyware logs, not url logs.
My guess is you're not sending URL logs to Splunk from the firewall. You need to set this up on the firewall side using the URL Filtering feature.
... View more
09-05-2018
07:07 PM
eventtype="pan_threat" should not contain 'url' logs in the results. Palo Alto Networks uses 'THREAT' type logs for urls (even if they aren't really threats), but the App/Add-on makes a distinction, so eventtype="pan_threat" should be only actual threats (not URL's) and eventtype="pan_url" should be only URL logs. URL logs are logs with ,THREAT,url, near the beginning of the log. If you are certain you're getting url logs in the pan_threat search then it sounds like they aren't getting parsed correctly. This is a search time distinction made on the log_subtype field. Can you tell us what you're getting in the log_subtype field for the url logs?
... View more
09-05-2018
09:32 AM
Hello, what version of Splunk are you using for your Splunk Cloud instance? The datamodels are created by Splunk using their GUI and deployed by many customers without issue, so my guess is there's something on your specific Splunk instance causing the problem. Can you try re-installing the App and see if that fixes it? If not, please have someone with access to the Splunk command line retrieve the datamodel JSON files and compare them to the released files here:
https://github.com/PaloAltoNetworks/SplunkforPaloAltoNetworks/tree/develop/default/data/models
The files should be identical.
... View more
09-05-2018
09:31 AM
Hello, the credential detected field will be parsed in the next version of the Palo Alto Networks Add-on (version 6.1.0). In the meantime, you can use the workaround in this feature request to add the feature to your current version of the Add-on:
https://github.com/PaloAltoNetworks/Splunk_TA_paloalto/issues/28
... View more
06-18-2018
01:04 PM
The CVE is not part of the log. It is pulled from the firewall/Panorama API into a lookup table in Splunk. Use this saved search in the documentation to pull the CVE's from the Firewall/Panorama API:
https://splunk.paloaltonetworks.com/lookups.html#contentpack
... View more
06-01-2018
10:21 AM
The macros are defined in the Palo Alto Network Add-on. Make sure you have the latest Add-on to match the App. If it still isn't working, you probably have something in a /local directory that is breaking it. Try clearing out your /local directories in the App and Add-on, or delete and re-install them both to clear out custom settings.
... View more
06-01-2018
10:19 AM
The firewalls generate a lot of data, so the App uses datamodel acceleration to speed up the dashboards. By default the acceleration timeframe is 7 days, so if you want more than 7 days of data to show up in dashboards, simply increase the acceleration timeframe on the datamodel. Note that increasing the acceleration timeframe will increase the disk usage for the accelerated data.
... View more
05-14-2018
03:43 PM
Hello, this issue will be fixed in Palo Alto Networks Add-on 6.0.3. In the meantime, you can apply the workaround here:
https://github.com/PaloAltoNetworks/Splunk_TA_paloalto/issues/27
Apologies for the inconvenience and thank you for reporting the problem.
-Brian
... View more
05-08-2018
02:47 PM
Thanks for reporting this. I filed an issue here:
https://github.com/PaloAltoNetworks/SplunkforPaloAltoNetworks/issues/74
This fix will be included in Palo Alto Networks App 6.0.2. In the meantime you can workaround this issue by making the following change:
https://github.com/PaloAltoNetworks/SplunkforPaloAltoNetworks/commit/0c595b16e14b190419448213b45c5d50e8830a64
... View more
03-13-2018
09:09 AM
Try upgrading to add-on 6.0.2 which fixes some lookup issues.
Then try the dashboard troubleshooting guide here:
https://splunk.paloaltonetworks.com/troubleshoot.html#dashboards-not-working
... View more
02-07-2018
10:53 AM
Basically what's happening is the parser is not seeing these logs as Palo Alto Networks logs or the parser is never run against the logs. The parser only looks at the first 4 fields of the log to make this determination. Are you sure you're using the default syslog format on the firewall/panorama? Can you offer a screenshot of the logs you see coming in as sourcetype pan:log?
... View more
02-06-2018
12:12 PM
If you're using a universal forwarder with syslog-ng, the default configuration can cause this problem. Make sure you configure syslog-ng not to add headers to the syslogs. More information and configuration examples here:
https://splunk.paloaltonetworks.com/universal-forwarder.html
... View more
01-16-2018
12:50 PM
@weicai88: Have you installed the App and Add-on 6.0.1 or higher on all Searchheads, Indexers, and Heavy Forwarders?
... View more
Contact Me
| Online Status |
Offline
|
| Date Last Visited |
02-04-2021
07:34 PM
|
Karma from
