Filebeat panw module field additions to mirror the corresponding integration, specifically add panw.panos.application.{sub_category,category,technology} #36159
Describe the enhancement:
Filebeat 7.x and 8.x is lacking the main fields in https://applipedia.paloaltonetworks.com/ that could be useful for writing Watcher, detections, dashboards, etc.
Describe a specific use case for the enhancement or feature:
These fields are not available in the csv parsing that is defined in /usr/share/filebeat/module/panw/panos/config/input.yml
Describe the enhancement: Filebeat 7.x and 8.x is lacking the main fields in https://applipedia.paloaltonetworks.com/ that could be useful for writing Watcher, detections, dashboards, etc.
Describe a specific use case for the enhancement or feature:
These fields are not available in the csv parsing that is defined in /usr/share/filebeat/module/panw/panos/config/input.yml
You can add the following under TRAFFIC:
The following under THREAT:
Then any corresponding mappings required.
Include any additional fields/mappings from threat, traffic, etc. so Filebeat can be compatible with the Elastic Agent panw integration.
Thank you!