Skip to content
This repository has been archived by the owner on Dec 14, 2024. It is now read-only.

[Addon] pan:firewall sourcetype doesn't parse GP and decryption logs #168

Closed
btorresgil opened this issue Mar 10, 2021 · 3 comments · Fixed by #169
Closed

[Addon] pan:firewall sourcetype doesn't parse GP and decryption logs #168

btorresgil opened this issue Mar 10, 2021 · 3 comments · Fixed by #169
Labels
add-on Related to the Splunk Add-On bug released on @6.x released

Comments

@btorresgil
Copy link
Member

Describe the bug

pan:firewall sourcetype doesn't parse GP and decryption logs

Workaroud is to use pan:log sourcetype
@btorresgil btorresgil added bug add-on Related to the Splunk Add-On labels Mar 10, 2021
btorresgil added a commit that referenced this issue Mar 10, 2021
@btorresgil
fix: Parse GP and Decryption logs w/ pan:firewall
ae8a9c2 
`pan:log` sourcetype was parsing GP and Decryption logs, but
`pan:firewall` sourcetype was not.

Fixes #168
@btorresgil btorresgil mentioned this issue Mar 10, 2021
Merged
btorresgil added a commit that referenced this issue Mar 10, 2021
@btorresgil
fix(addon): Parse GP and Decryption logs w/ pan:firewall
161bb79 
`pan:log` sourcetype was parsing GP and Decryption logs, but
`pan:firewall` sourcetype was not.

Fixes #168
btorresgil added a commit that referenced this issue Mar 10, 2021
@btorresgil
fix(addon): Parse GP and Decryption logs w/ pan:firewall
9f67e1f 
`pan:log` sourcetype was parsing GP and Decryption logs, but
`pan:firewall` sourcetype was not.

Fixes #168
btorresgil added a commit that referenced this issue Mar 11, 2021
@btorresgil
fix(addon): Parse GP and Decryption logs w/ pan:firewall
01569da 
`pan:log` sourcetype was parsing GP and Decryption logs, but
`pan:firewall` sourcetype was not.

Fixes #168

Backport to v6.5 from 9f67e1f
github-actions bot pushed a commit that referenced this issue Mar 12, 2021
@semantic-release-bot
chore(release): 6.5.1
e62442c 
### [6.5.1](v6.5.0...v6.5.1) (2021-03-12)

### Bug Fixes

* **addon:** Add fields for GlobalProtect logs
* **addon:** Parse GP and Decryption logs w/ pan:firewall - #168
* **app:** Incident counters flash in Splunk 8.1 - #163
github-actions bot pushed a commit that referenced this issue Mar 14, 2021
@semantic-release-bot
chore(release): 6.5.1
4f4c13b 
### [6.5.1](v6.5.0...v6.5.1) (2021-03-14)

### Bug Fixes

* **addon:** Add fields for GlobalProtect logs
* **addon:** Parse GP and Decryption logs w/ pan:firewall - #168
* **app:** Incident counters flash in Splunk 8.1 - #163
github-actions bot pushed a commit that referenced this issue Mar 14, 2021
@semantic-release-bot
chore(release): 6.5.1
f50591d 
### [6.5.1](v6.5.0...v6.5.1) (2021-03-14)

### Bug Fixes

* **addon:** Add fields for GlobalProtect logs
* **addon:** Parse GP and Decryption logs w/ pan:firewall - #168
* **app:** Incident counters flash in Splunk 8.1 - #163
@github-actions
Copy link

🎉 This issue has been resolved in version 6.5.1 🎉

This release is available on SplunkBase: App - Add-on

Posted by semantic-release bot

github-actions bot pushed a commit that referenced this issue Apr 1, 2021
@semantic-release-bot
chore(release): 6.6.0
fa90bac 
## [6.6.0](v6.5.2...v6.6.0) (2021-04-01)

### Features

* **addon:** Cortex Data Lake HEC log support - #162 #176
* **app/addon:** Add IoT Security - #158

### Bug Fixes

* **addon:** Add fields for GlobalProtect logs
* **addon:** Add modinputs as tasks in app.manifest - #153
* **addon:** Fix GlobalProtect logs dvc_name field
* **addon:** Fix nav bar background color
* **addon:** Parse GP and Decryption logs w/ pan:firewall - #168
* **app:** Incident counters flash in Splunk 8.1 - #163
* **app/addon:** correct user-id tag_user / untag_user
@github-actions
Copy link

github-actions bot commented Apr 1, 2021

🎉 This issue has been resolved in version 6.6.0 🎉

This release is available on SplunkBase: App - Add-on

Posted by semantic-release bot

1 similar comment
@github-actions
Copy link

github-actions bot commented May 8, 2021

🎉 This issue has been resolved in version 6.6.0 🎉

This release is available on SplunkBase: App - Add-on

Posted by semantic-release bot

github-actions bot pushed a commit to btorresgil/SplunkforPaloAltoNetworks that referenced this issue Mar 7, 2022
@semantic-release-bot
chore(release): 5.0.0-beta.1
238b9d8 
## [5.0.0-beta.1](v4.2.2...v5.0.0-beta.1) (2022-03-07)

### Features

* **addon:** Add Decryption Log Support for PANOS 10  - PaloAltoNetworks#126
* **addon:** Cortex Data Lake HEC log support - PaloAltoNetworks#162 PaloAltoNetworks#176
* **addon:** PAN Quality Validation and Improvement
* **addon:** Significantly improve and modernize CIM compliance
* **app/addon:** Add Cortex XDR incident support to App and Add-on including new XDR Incidents dashboard - PaloAltoNetworks#166
* **app/addon:** Add IoT Security - PaloAltoNetworks#158
* **app/addon:** Feature/dynamic user groups - PaloAltoNetworks#150
* **app/addon:** Python 3 Support - PaloAltoNetworks#124
* **app/addon:** Support GlobalProtect log type in PANOS 9.1 - PaloAltoNetworks#118
* **app/addon:** Update pandevice to 0.14.0 - PaloAltoNetworks#145

### Bug Fixes

* **addon:** Add fields for GlobalProtect logs
* **addon:** Add fields for GlobalProtect logs
* **addon:** Add GlobalProtect SourceUserName - PaloAltoNetworks#209 PaloAltoNetworks#202
* **addon:** Add modinputs as tasks in app.manifest - PaloAltoNetworks#153
* **addon:** Add virus eventtype to malware CIM - PaloAltoNetworks#114 PaloAltoNetworks#138
* **addon:** Fix appserver/static files
* **addon:** Fix CDL logs contained string 'null' in 'user' field - PaloAltoNetworks#187
* **addon:** Fix error from Minemeld automatic lookup
* **addon:** Fix GlobalProtect logs dvc_name field
* **addon:** Fix GlobalProtect logs dvc_name field
* **addon:** Fix nav bar background color
* **addon:** Fix src_user field contained destination user - PaloAltoNetworks#186
* **addon:** Fix typo in transform.conf ([PaloAltoNetworks#227](https://github.com/btorresgil/SplunkforPaloAltoNetworks/issues/227))
* **addon:** Fix user showing as unknown from GlobalProtect logs.  - PaloAltoNetworks#217
* **addon:** Parse GP and Decryption logs w/ pan:firewall - PaloAltoNetworks#168
* **addon:** Parse GP and Decryption logs w/ pan:firewall - PaloAltoNetworks#168
* **addon:** Remove endpoint tags and eventtypes - PaloAltoNetworks#196
* **addon:** Remove port from `dest_name` field - PaloAltoNetworks#129 PaloAltoNetworks#128
* **addon:** Remove white space from GlobalProtect sourcetype - PaloAltoNetworks#131
* **addon:** Restore "unknown" string for empty 'user' field
* **app:** Fix error after upgrade to 7.0.0: "Unknown search command 'panwildfirereport'" - PaloAltoNetworks#189
* **app:** Fix IoT Security dashboard filter - PaloAltoNetworks#181
* **app:** Fix panContentPack error. Fixes bug [PaloAltoNetworks#222](https://github.com/btorresgil/SplunkforPaloAltoNetworks/issues/222) - PaloAltoNetworks#225
* **app:** Incident counters flash in Splunk 8.1 - PaloAltoNetworks#163
* **app:** Incident counters flash in Splunk 8.1 - PaloAltoNetworks#163
* **app:** Remove endpoint from Data Model Audit dashboard - PaloAltoNetworks#218
* **app/addon:** correct user-id tag_user / untag_user
* **app/addon:** Fix background color of logo - PaloAltoNetworks#141

### Performance Improvements

* **app:** Change simple XML to use JQuery 3.5 - PaloAltoNetworks#207
* **app:** Remove high cardinality fields from datamodel

### ⚠ MAJOR RELEASE CHANGES

This is a major release

Splunk dashboards and searches you have created might be
affected by these changes. Please be prepared to test and
adjust any dashboards not included with the App after upgrade.

* **addon:** pan_traffic_start logs no longer included in CIM
* **addon:** pan_traffic_end logs moved from Network Session to Network Traffic datamodel
* **addon:** pan_threat event type now includes wildfire and data logs
* **addon:** pan_file logs moved from Web to IDS datamodel
* **addon:** pan_virus logs moved from Malware to IDS datamodel
* **addon:** pan_wildfire logs moved from Malware to IDS datamodel
* **addon:** pan_email removed from Email datamodel
* **app:** Removes datamodel for GlobalProtect logs before PAN-OS 9.1
* **app/addon:** Removes Traps 4 support
* **app/addon:** Deprecates Traps 5 and Traps 6 support
* **app:** Removes support for legacy WildFire Report API
* **app/addon:** Requires Splunk 8.0 or higher
* **app/addon:** Replaces Adversary Scoreboard and Incident Feed dashboards with new XDR Incidents dashboard
Sign up for free to subscribe to this conversation on GitHub. Already have an account? Sign in.
Assignees
No one assigned
Labels
add-on Related to the Splunk Add-On bug released on @6.x released
Projects
None yet
Milestone
No milestone
Development

Successfully merging a pull request may close this issue.

fix(addon): Parse GP and Decryption logs w/ pan:firewall PaloAltoNetworks/Splunk-Apps
1 participant
@btorresgil