Palo Alto Networks pan:threat logs: Field extractions module¶

Use case¶

Use this SPL2 module when you want to preserve the Splunk Add-on for Palo Alto Networks field-extraction behavior for pan:threat data in an SPL2 workflow. Modules are reusable building blocks that can be referenced from SPL2 pipelines instead of rewriting sourcetype-specific extraction logic by hand.

Note

This module must not be used with Splunk indexes. It is intended only for exporting to data lakes.

Version 0.1.0¶

Version 0.1.0 of the Palo Alto Networks pan:threat logs: Field extractions module was released with the Splunk Add-on for Palo Alto Networks SPL2 content update.

Module details¶

Compatibility¶

This module is compatible with Splunk Add-on for Palo Alto Networks v3.2.0.

Module description¶

This module is generated from the add-on’s props.conf and transforms.conf knowledge objects. Its purpose is to preserve the same field-extraction, normalization, calculated-field, and lookup behavior that the add-on defines for the pan:threat sourcetype, but in reusable SPL2 form.

The module applies CSV extraction, field aliases, calculated fields, lookup enrichments, and whitespace trimming for selected threat fields such as threat_name, signature, and url_category_list.

Supported sourcetype¶

This module applies to events with the pan:threat sourcetype.

Module outline¶

The module consists of helper functions followed by one exported function.

Function name	Description	Configuration options
`apply_kv_mode`	Applies `KV_MODE`-based extraction behavior for the sourcetype when applicable.	No configuration options.
`apply_extractions`	Applies extraction behavior derived from `REPORT`, `EXTRACT`, and `TRANSFORMS` knowledge objects.	No configuration options.
`apply_normalizations`	Applies field alias behavior derived from `FIELDALIAS` knowledge objects.	No configuration options.
`apply_calculations_on_fields`	Applies calculated-field behavior derived from `EVAL` knowledge objects.	No configuration options.
`apply_lookups`	Applies lookup enrichments derived from `LOOKUP` knowledge objects when present.	No configuration options.
`trim_whitespace`	Trims leading and trailing whitespace from selected threat fields.	No configuration options.
`pan_threat_field_extractions_function`	Exported module function for `pan:threat` events.	No configuration options.

Example usage¶

You can reference the exported function from a pipeline that targets pan:threat events, for example:

import pan_threat_field_extractions_function from pan_threat_field_extractions_module

$pipeline = | from $source
            | pan_threat_field_extractions_function
            | into $data_lake_destination