Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

[SIEM][Filebeat] Palo Alto Networks module: Remove zero NAT addresses #13331

Closed
adriansr opened this issue Aug 23, 2019 · 3 comments
Closed

[SIEM][Filebeat] Palo Alto Networks module: Remove zero NAT addresses #13331

adriansr opened this issue Aug 23, 2019 · 3 comments
Labels
Filebeat Filebeat x-pack Issues and pull requests for X-Pack features.

Comments

@adriansr
Copy link
Contributor

adriansr commented Aug 23, 2019 •
edited by zube bot
Loading

Palo Alto Networks logs seem to always include a value for {source,destination}.nat.{ip,port} fields, even when no NAT is performed. In that case the fields are zero values: 0.0.0.0 and 0 port.

Those must be removed.

        "destination.nat.ip": "0.0.0.0",
        "destination.nat.port": 0,

as seen on #13330
@adriansr adriansr added Filebeat Filebeat Team:SIEM x-pack Issues and pull requests for X-Pack features. labels Aug 23, 2019
@elasticmachine
Copy link
Collaborator

Pinging @elastic/siem

@legoguy1000
Copy link
Contributor

This looks to have been resolved by #18525 and can be closed @adriansr

@adriansr
Copy link
Contributor Author

Right, @legoguy1000

Closing.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Assignees
No one assigned
Labels
Filebeat Filebeat x-pack Issues and pull requests for X-Pack features.
Projects
None yet
Milestone
No milestone
Development

No branches or pull requests
3 participants
@legoguy1000 @adriansr @elasticmachine