SPL2 templates and modules for Palo Alto Networks¶
SPL2 content for Palo Alto Networks currently includes two artifact types:
- Templates, which are end-to-end SPL2 pipelines for reducing log volume, generating metrics, or extracting fields and classification from Palo Alto Networks logs.
- Field-extraction modules, which are reusable SPL2 functions generated from add-on knowledge objects such as
props.confandtransforms.conf.
Templates and modules are available for the Edge Processor and Ingest Processor. See the following documentation for more information:
Templates¶
The following table lists all SPL2 templates available for Edge Processor and Ingest Processor for Palo Alto Networks:
| Template name | Version | Use case | Availability |
|---|---|---|---|
| Palo Alto Network logs: Reduce log size | 0.2.1 | Reduce the size of Palo Alto Network logs by removing unnecessary fields. Then, extract recommended event fields. | Edge Processor and Ingest Processor |
| Palo Alto Network traffic logs: Generate metrics from logs | - | Generate metrics with dimensions from Palo Alto Network traffic logs, and then route the metrics and the original logs to two different destinations. | Ingest Processor |
| Palo Alto Networks PAN-OS syslog data: Extract fields and classification of Palo Alto logs | - | Take Palo Alto Networks syslog message data and set the sourcetypes and indexes based on the message text. This pipeline also automatically removes the header information from messages, which reduces the message size by 10%. | Edge Processor and Ingest Processor |
Release notes for the templates are available in the documentation.
Modules¶
For information about available SPL2 modules, see the SPL2 modules overview.