Is there an easier way of viewing evidence from correlation events in the Palo Alto Networks App for Splunk?

[csd126]

The 'Network Security' dashboard includes the Top Correlation Events. Is there an easy way within the Palo Alto Networks App to view the corresponding "evidence", similar to what Panorama shows?

[panguy]

Your welcome to create a custom panel. We have a macro set up to get all correlated logs.

`pan_correlation`

[splandrew]

I know this is an old thread but any chance you could post the logic of your macro?