[Filebeat] Palo Alto integration with User-ID

[rdrgporto]

Hi, everyone

I have been working with Palo Alto and Filebeat over several days. I have looked on Elastic documentation that it currently supports messages of Traffic and Threat types.

Is it considered to parsing User-ID type ? I would like to get it because it provides information about login and logouts of usernames.

Thanks in advance,

Rodrigo

[elasticmachine]

Pinging @elastic/security-external-integrations (Team:Security-External Integrations)

[jamiehynds]

Hey @rdrgporto! Increased our Palo Alto event coverage is certainly something we'd like to do, including the User-ID logs. We currently have very limited sample data in order to add support to our module. Would you be able to share some sample User-ID events so we can review the format? Sanitised events are fine.

[rdrgporto]

Hi, @jamiehynds

Here you are:

Mar 24 11:00:49 <ip/hostname> 1,2021/03/24 11:00:49,<serial-number>,USERID,login,2305,2021/03/24 11:00:49,vsys1,<source-ip>,<user-domain>,,0,1,10800,0,0,<data-source-collected>,<data-source-type>,1252774,0x0,0,0,0,0,,<device-name>,1,,2021/03/24 11:00:49,1,0x80000000,<user-name>

Mar 24 10:59:45 <ip/hostname> 1,2021/03/24 10:59:45,<serial-number>,USERID,logout,2305,2021/03/24 10:59:45,vsys1,<source-ip>,<user-domain>,,0,1,0,0,0,<data-source-collected>,<data-source-type>,1252765,0x0,0,0,0,0,,<device-name>,1,,2021/03/24 10:59:45,1,0x80000000,<user-name>

I configured Palo Alto (Version 9.1) in order to send logs via Syslog. I have a virtual machine which writes its information into a file (I had to configure Rsyslog). Logstash reads it and parse it.

I used Palo Alto documentation in order to know fields name.

Thanks 😃 ,

Rodrigo

[willemdh]

Created #24724 and added some info to https://discuss.elastic.co/t/palo-alto-integration-with-userid-siem-feature/268173/5

[legoguy1000]

I can try to update the PanOS fileset to parse these logs.

[legoguy1000]

I've started a draft for this

[legoguy1000]

@rdrgporto Do you have more User ID logs examples. I looked here,https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA10g000000ClkACAS and the amount of fields don't seem to line up

[rdrgporto]

Hi, @legoguy1000

Here you are more User ID examples and my test Logstash pipeline configuration example:

• user-id.log
• paloalto.txt

I have looked on Palo Alto documentation in order to figure out fields names: Palo Alto 9.1.3.

Thanks in advance 😃

[legoguy1000]

updated the PR with these logs and took some of your changes from the logstash pipeline you provided.

[legoguy1000]

Took PR out of draft