Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

[Filebeat] Palo_alto module improvements #12182

Merged
merged 5 commits into from
May 15, 2019
Merged

[Filebeat] Palo_alto module improvements #12182

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
5 commits
Select commit Hold shift + click to select a range
d8c0c94
Set network.type (ipv4 or ipv6)
adriansr May 13, 2019
b6ce9f3
Refactor threat fields
adriansr May 13, 2019
6bdd529
Network and threat dashboards
adriansr May 13, 2019
125f30e
Add dashboard pictures
adriansr May 13, 2019
d351b7b
Make update
adriansr May 14, 2019
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
14 changes: 12 additions & 2 deletions filebeat/docs/fields.asciidoc
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -12046,7 +12046,7 @@ Log entry identifier that is incremented sequentially. Unique for each log type.

--

*`palo_alto.pan_os.threat_file_or_url`*::
*`palo_alto.pan_os.threat.resource`*::
+
--
type: keyword
Expand All @@ -12056,14 +12056,24 @@ URL or file name for a threat.

--

*`palo_alto.pan_os.threat_id`*::
*`palo_alto.pan_os.threat.id`*::
+
--
type: keyword

Palo Alto Networks identifier for the threat.


--

*`palo_alto.pan_os.threat.name`*::
+
--
type: keyword

Palo Alto Networks name for the threat.
Copy link
Member

@andrewkroh andrewkroh May 15, 2019 •
edited
Loading

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

s/Networks/Network’s/g? (Best to not copy my apostrophe.)

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I guess if changed it should be Palo Alto Networks' name, or Palo Alto Networks's name?

In their own docs they write it like Palo Alto Networks identifier for the threat. so I'd rather leave it as is

Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

If that’s how they like to write it then leave it as is.



--

[[exported-fields-postgresql]]
Expand Down
Binary file added filebeat/docs/images/filebeat-palo-alto-threat.png
View file
Open in desktop
Loading
Sorry, something went wrong. Reload?
Sorry, we cannot display this file.
Sorry, this file is invalid so it cannot be displayed.
Binary file added filebeat/docs/images/filebeat-palo-alto-traffic.png
View file
Open in desktop
Loading
Sorry, something went wrong. Reload?
Sorry, we cannot display this file.
Sorry, this file is invalid so it cannot be displayed.
18 changes: 10 additions & 8 deletions filebeat/docs/modules/palo_alto.asciidoc
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -121,14 +121,16 @@ in ECS that are added under the `palo_alto` prefix:
| Device Name | observer.hostname |
|==============

// [float]
// === Example dashboard
//
// This module comes with a sample dashboard:
//
// (TODO)
// [role="screenshot"]
// image::./images/kibana-cisco-asa.png[]
[float]
=== Example dashboard

This module comes with two sample dashboards:

[role="screenshot"]
image::./images/filebeat-palo-alto-traffic.png[]

[role="screenshot"]
image::./images/filebeat-palo-alto-threat.png[]

include::../include/configuring-intro.asciidoc[]

Expand Down
18 changes: 10 additions & 8 deletions x-pack/filebeat/module/palo_alto/_meta/docs.asciidoc
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -116,14 +116,16 @@ in ECS that are added under the `palo_alto` prefix:
| Device Name | observer.hostname |
|==============

// [float]
// === Example dashboard
//
// This module comes with a sample dashboard:
//
// (TODO)
// [role="screenshot"]
// image::./images/kibana-cisco-asa.png[]
[float]
=== Example dashboard

This module comes with two sample dashboards:

[role="screenshot"]
image::./images/filebeat-palo-alto-traffic.png[]

[role="screenshot"]
image::./images/filebeat-palo-alto-threat.png[]

include::../include/configuring-intro.asciidoc[]

Expand Down
Loading