Palo Alto Networks App for Splunk leverages the data visibility provided by Palo Alto Networks next-generation firewalls and endpoint security with Splunk's extensive investigation and visualization capabilities to deliver an advanced security reporting and analysis tool.
Ingest AUTH events to Splunk and run searches on the data. When the Splunk PANOS TA is installed, no search-time extractions exist for this log subtype
Screenshots
N/A
Context
Lack of PANOS authentication log field extraction causes lack of visibility.
Your Environment
Splunk distributed environment
Version used: Splunk Add-on for Palo Alto Networks 8.1.1
Environment name and version: Splunk 9.1.2
Operating System and version (desktop or mobile): Desktop Amazon Linux 2
Describe the bug
Missing Search-time extractions for PANOS Authentication logs
https://docs.paloaltonetworks.com/pan-os/11-1/pan-os-admin/monitoring/use-syslog-for-monitoring/syslog-field-descriptions/authentication-log-fields
Expected behavior
Splunk searches on PANOS Authentication logs provide meaningful field extractions
Current behavior
No Search-time parsing Splunk knowledge objects available
Possible solution
Props.conf
Transforms.conf
https://github.com/splunk/splunk-connect-for-syslog/issues/2304 Submitted for Splunk Connect for Syslog (SC4S) users for proper index-time parsing / sourcetype identification.
Steps to reproduce
Ingest AUTH events to Splunk and run searches on the data. When the Splunk PANOS TA is installed, no search-time extractions exist for this log subtype
Screenshots
N/A
Context
Lack of PANOS authentication log field extraction causes lack of visibility.
Your Environment
Splunk distributed environment