Skip to content

Vendor - PaloAlto

Product - NGFW

Ref Link
Splunk Add-on https://splunkbase.splunk.com/app/2757/
Product Manual https://docs.paloaltonetworks.com/pan-os/9-0/pan-os-admin/monitoring/use-syslog-for-monitoring/configure-syslog-monitoring.html

Sourcetypes

sourcetype notes
pan:log None
pan:pan_globalprotect none
pan:traffic None
pan:threat None
pan:system None
pan:config None
pan:hipmatch None
pan:correlation None

Sourcetype and Index Configuration

key sourcetype index notes
pan_log pan:log netops none
pan_globalprotect pan:pan_globalprotect netfw none
pan_traffic pan:traffic netfw none
pan_threat pan:threat netproxy none
pan_system pan:system netops none
pan_config pan:config netops none
hipmatch pan:hipmatch netops none
pan_correlation pan:correlation netops none

Filter type

MSG Parse: This filter parses message content

Setup and Configuration

  • Install the Splunk Add-on on the search head(s) for the user communities interested in this data source. If SC4S is exclusively used the addon is not required on the indexer.
  • Review and update the splunk_metadata.csv file and set the index and sourcetype as required for the data source.
  • Refer to the admin manual for specific details of configuration
    • Select TCP or SSL transport option
    • Select IETF Format
    • Ensure the format of the event is not customized

Options

Variable default description
SC4S_LISTEN_PULSE_PALOALTO_PANOS_RFC6587_PORT empty string Enable a TCP using IETF Framing (RFC6587) port for this specific vendor product using a comma-separated list of port numbers
SC4S_LISTEN_PALOALTO_PANOS_TCP_PORT empty string Enable a TCP port for this specific vendor product using a comma-separated list of port numbers
SC4S_ARCHIVE_PALOALTO_PANOS no Enable archive to disk for this specific source
SC4S_DEST_PALOALTO_PANOS_HEC no When Splunk HEC is disabled globally set to yes to enable this specific source

Verification

An active firewall will generate frequent events. Use the following search to validate events are present per source device

index=<asconfigured> sourcetype=pan:*| stats count by host

Product - TRAPS

Ref Link
Splunk Add-on https://splunkbase.splunk.com/app/2757/

Sourcetypes

sourcetype notes
pan:traps4 none

Index Configuration

key index notes
Palo Alto Networks_Traps Agent epintel none

Filter type

MSG Parse: This filter parses message content

Options

Variable default description
SC4S_LISTEN_CEF_TCP_PORT empty string Enable a TCP port for this specific vendor product using a comma-separated list of port numbers
SC4S_LISTEN_CEF_UDP_PORT empty string Enable a UDP port for this specific vendor product using a comma-separated list of port numbers
SC4S_ARCHIVE_CEF no Enable archive to disk for this specific source
SC4S_DEST_CEF_HEC no When Splunk HEC is disabled globally set to yes to enable this specific source
  • NOTE: Set only one set of CEF variables for the entire SC4S deployment, regardless of how many ports are in use by this CEF source (or any others). See the “Common Event Format” source documentation for more information.

Verification

An active site will generate frequent events use the following search to check for new events

Verify timestamp, and host values match as expected

index=<asconfigured> (sourcetype=pan:traps4)