[Filebeat] module for palo_alto (pan-os) logs #11999

adriansr · 2019-04-30T16:42:11Z

This is a module for Palo Alto Networks PAN-OS logs received via Syslog.

Compatibility
ECS Mappings for TRAFFIC
ECS Mappings for THREAT
Categorization of events
Pending tasks

Compatibility

It has been tested with logs for PAN-OS version 7.1 to 9.0. However, it is expected to work with earlier versions as the log format is compatible.

ECS Mappings for TRAFFIC

These are the PAN-OS to ECS field mappings as well as those fields still not in ECS that are added under the palo_alto prefix:

PAN-OS Field	ECS Field	Non-standard field
Receive Time	event.created
Serial Number	observer.serial_number
Type	event.category
Subtype	event.action
Generated Time	`@timestamp`
Source IP	client.ip source.ip
Destination IP	server.ip destination.ip
NAT Source IP		palo_alto.source.nat.ip
NAT Destination IP		palo_alto.destination.nat.ip
Rule Name		palo_alto.ruleset
Source User	client.user.name source.user.name
Destination User	server.user.name destination.user.name
Application	network.application
Source Zone		palo_alto.source.zone
Destination Zone		palo_alto.destination.zone
Ingress Interface		palo_alto.source.interface
Egress Interface		palo_alto.destination.interface
Session ID		palo_alto.flow_id
Source Port	client.port source.port
Destination Port	destination.port server.port
NAT Source Port		palo_alto.source.nat.port
NAT Destination Port		palo_alto.destination.nat.port
Flags	abels
Protocol	network.transport
Action	event.outcome
Bytes	network.bytes
Bytes Sent	client.bytes destination.bytes
Bytes Received	server.bytes source.bytes
Packets	network.packets
Start Time	event.start
Elapsed Time	event.duration
Category		palo_alto.url.category
Sequence Number		palo_alto.sequence_number
Packets Sent	server.packets destination.packets
Packets Received	client.packets source.packets
Device Name	observer.hostname

ECS Mappings for THREAT

PAN-OS Field	ECS Field	Non-standard field
Receive Time	event.created
Serial Number	observer.serial_number
Type	event.category
Subtype	event.action
Generated Time	`@timestamp`
Source IP	client.ip source.ip
Destination IP	server.ip destination.ip
NAT Source IP		palo_alto.source.nat.ip
NAT Destination IP		palo_alto.destination.nat.ip
Rule Name		palo_alto.ruleset
Source User	client.user.name source.user.name
Destination User	server.user.name destination.user.name
Application	network.application
Source Zone		palo_alto.source.zone
Destination Zone		palo_alto.destination.zone
Ingress Interface		palo_alto.source.interface
Egress Interface		palo_alto.destination.interface
Session ID		palo_alto.flow_id
Source Port	client.port source.port
Destination Port	destination.port server.port
NAT Source Port		palo_alto.source.nat.port
NAT Destination Port		palo_alto.destination.nat.port
Flags	labels
Protocol	network.transport
Action	event.outcome
Miscellaneous	url.original	palo_alto.threat_file_or_url
Threat ID		palo_alto.threat_id
Category		palo_alto.url.category
Severity	log.level
Direction	network.direction
Source Location	source.geo.country_iso_code
Destination Location	destination.geo.country_iso_code
PCAP_id		palo_alto.network.pcap_id
Filedigest		palo_alto.file.hash
User Agent	user_agent.original
File Type	file.type
X-Forwarded-For	network.forwarded_ip
Referer	http.request.referer
Sender	source.user.email
Subject		palo_alto.subject
Recipient	destination.user.email
Device Name	observer.hostname

Categorization of events

This module uses the following ECS fields for categorization of events:

event.category

Log type	event.category
TRAFFIC	network_traffic
THREAT	security_threat

event.action

event.category	event.action
network_traffic	flow_started
	flow_terminated
	flow_dropped
	flow_denied
security_threat	data_match
	file_match
	flood_detected
	packet_attack
	scan_detected
	spyware_detected
	url_filtering
	virus_detected
	exploit_detected
	wildfire_veredict
	wildfire_virus_detected

event.outcome

event.category	event.outcome	description
network_traffic	allow	session was allowed by policy

	deny	session was denied by policy
	drop	session was dropped silently
	drop ICMP	session was silently dropped with an ICMP unreachable message to the host or application
	reset both	session was terminated and a TCP reset is sent to both the sides of the connection
	reset client	session was terminated and a TCP reset is sent to the client
	reset server	session was terminated and a TCP reset is sent to the server
security_threat	alert	threat or URL detected but not blocked
	allow	flood detection alert (?)
	deny	flood detection mechanism activated and deny traffic based on configuration
	drop	threat detected and associated session was dropped
	reset-client	threat detected and a TCP RST is sent to the client
	reset-server	threat detected and a TCP RST is sent to the server
	reset-both	threat detected and a TCP RST is sent to both the client and the server
	block-url	URL request was blocked because it matched a URL category that was set to be blocked
	block-ip	threat detected and client IP is blocked
	random-drop	flood detected and packet was randomly dropped
	sinkhole	DNS sinkhole activated
	syncookie-sent	syncookie alert
	block-continue	(URL subtype only) a HTTP request is blocked and redirected to a Continue page with a button for confirmation to proceed
	continue	(URL subtype only) response to a block-continue URL continue page indicating a block-continue request was allowed to proceed
	block-override	(URL subtype only) a HTTP request is blocked and redirected to an Admin override page that requires a pass code from the firewall administrator to continue
	override-lockout	(URL subtype only) too many failed admin override pass code attempts from the source IP. IP is now blocked from the block-override redirect page
	override	(URL subtype only) response to a block-override page where a correct pass code is provided and the request is allowed
	block	(Wildfire only) file was blocked by the firewall and uploaded to Wildfire

Pending tasks

rebase after New processor extract_array #11761#11761 is merged
dashboards

Closes #9199

libbeat/processors/extract_array/extract_array.go

libbeat/processors/extract_array/extract_array_test.go

libbeat/processors/extract_array/extract_array.go

libbeat/processors/extract_array/extract_array_test.go

jsoriano

Great work here, and good thing we can define pipelines in YAML now 😉 Added some minor comments, feel free to ignore them.

jsoriano · 2019-05-07T15:49:01Z

libbeat/docs/processors-using.asciidoc

+[[extract-array]]
+=== Extract array
+
+experimental[]


I think this should be beta.

CHANGELOG.next.asciidoc

jsoriano · 2019-05-07T16:09:54Z

libbeat/processors/extract_array/extract_array_test.go

+	"github.com/elastic/beats/libbeat/common"
+)
+
+func TestExtractArrayProcessor_String(t *testing.T) {


Suggested change

func TestExtractArrayProcessor_String(t *testing.T) {

func TestExtractArrayProcessorString(t *testing.T) {

jsoriano · 2019-05-07T16:10:20Z

libbeat/processors/extract_array/extract_array_test.go

+	assert.Equal(t, "extract_array={field=csv, mappings=[{0 source.ip} {2 network.transport} {99 destination.ip}]}", p.String())
+}
+
+func TestExtractArrayProcessor_Run(t *testing.T) {


Suggested change

func TestExtractArrayProcessor_Run(t *testing.T) {

func TestExtractArrayProcessorRun(t *testing.T) {

libbeat/processors/extract_array/extract_array_test.go

jsoriano · 2019-05-07T16:18:54Z

x-pack/filebeat/module/palo_alto/_meta/docs.asciidoc

+
+(TODO)
+[role="screenshot"]
+image::./images/kibana-cisco-asa.png[]


Remove till a dashboard is available?

jsoriano · 2019-05-07T16:46:50Z

x-pack/filebeat/module/palo_alto/log/config/input.yml

+        source_ip: palo_alto.source.nat.ip
+        source_port: palo_alto.source.nat.port
+        destination_ip: palo_alto.destination.nat.ip
+        destination_port: palo_alto.destination.nat.port


We should probably add a copy_fields processor 🙂

andrewkroh

This is looking good to me in terms of the ECS fields that it's populating. Left a few minor suggestions.

andrewkroh · 2019-05-08T03:42:45Z

x-pack/filebeat/filebeat.reference.yml

@@ -403,6 +403,18 @@ filebeat.modules:
    # of the document. The default is true.
    #var.use_namespace: true

+#------------------------------ Palo_alto Module ------------------------------
+- module: palo_alto
+  log:


Maybe we should call this pan-os instead of the generic log. I think Palo Alto might have other log producing products than PAN-OS.

Yes, makes sense.

However, I chose pan_os instead of pan-os, for a few reasons:

It makes sense to keep the custom fields in a subgroup, from palo_alto.* to palo_alto.pan-os.*. In this case, the pan-os component in a field name causes a lot of trouble with painless, it complicates if conditions because you can't do ctx?.palo_alto?.pan-os as it is interpreted as a subtraction.

It looks kind of ugly to mix underscore and hyphen as in palo_alto.pan-os

Other filesets / submodules use underscore

ECS suggests to use underscore.

On the other side, pan-os is the well-known name. WDYT?

SGTM. The benefits of pan_os outweigh the benefits of pan-os.

x-pack/filebeat/module/palo_alto/log/config/input.yml

filebeat/docs/fields.asciidoc

x-pack/filebeat/module/palo_alto/log/config/input.yml

andrewkroh

The updates here LGTM.

This is a module for Palo Alto Networks PAN-OS logs received via Syslog. It has been tested with logs for PAN-OS version 7.1 to 9.0. However, it is expected to work with earlier versions as the log format is compatible.

* Use time.Duration directly in GetStartTimeEndTime function (#12033) * Remove convertPeriodToDuration and use duration directly in GetStartTimeEndTime * Pass period in time.Duration type * Fix memory leak in Filebeat pipeline acker (#12063) * Fix memory leak in Filebeat pipeline acker Before this change acker goroutine was kept forever as processed events count was not correctly updated. Filebeat sends an empty event to update file states, this event is not published, but treated as dropped, without updating counters. This change makes sures that `a.events` count gets updated for dropped events also, so the acker gets closed after all ACKs happen. * Add convert processor (#11686) The `convert` processor converts a field in the event to a different type, such as converting a string to an integer. For a full description of the processor's capabilities see the included documentation. Closes #8124 * Update docs.asciidoc (#11852) (#12045) * Update docs.asciidoc Added in a short note on a few of the other configurable variables. * Make update * Remove systemd v233 requirement because it's no longer true (#12076) * Don't generate autodiscover config when no port matches host hints (#12086) On metricbeat, when the host autodiscover hint is used, and it includes the port, one of the exposed ports has to match with the one in the hint. If not, no configuration should be generated. If it is generated, it will have empty hosts, what would lead to unexpected errors as the seen in #8264. * Fix transptest testing (#12091) Rewrite test for more clarity ensuring that the server and listeners are stopped before the test function returns (cause for the case condition). Each test has it's very own socks5 server now. Tests not requiring a proxy don't spin up one. * Refactor and add tests for template and ilm handling. (#12065) Refactor and add more tests related to setting up template and ilm policy. Ensure template and ilm-policy is exported despite enabled=false setting. * [Auditbeat] Login: Fix re-read of utmp files (#12028) The `login` dataset is not using the previous file offset when reading new entries in a utmp file. As a result, whenever a new login event occurs, all records are re-read. Also expands the documentation, moves test files to testdata/, and adds a test case that adds a utmp record to the test file and re-reads it to make sure this bug does not happen again. * [Metricbeat][postgresql] Update lib/pq to fix #11393 (#12094) This updates github.com/lib/pq to the latest version to fix a socket leak when SSL is not enabled on the PostgreSQL server. Fixes #11393 * Make breaking changes separate files (#12002) * Change image references to use block syntax not inline (#11911) * Change image references to use block syntax not inline * Fix format for inline links * Revert "Make breaking changes separate files (#12002)" (#12116) This reverts commit c17586a. * fix queue.spool.write.flush.events config type (#12080) * Revert printing template and policy name on export. (#12067) Ensures behavior on running the `export` cmd does not change compared to last released version. * [Filebeat] Add -expected files by default (#12041) So far expected files in Filebeat tests were only generated and compared when a file exists. This changes to create a generated for all example logs. This will add a few more files to the repository but I think there the benefits outweight the costs as it means the modules are tested in more detail. Also minor changes will be detected easier. * Update vendored gosigar to 0.10.2 (#12101) #11924 duplicated some code from go-sysinfo that is affected by a memory leak (fixed in #12100) In this case, only master is affected as the PR that introduced the leaky gosigar wasn't backported. * Fix various memory leaks under Windows (#12100) A function in go-sysinfo used under Windows to split a command-line into arguments was leaking memory. This code was used in various places: add_process_metadata processor. (enabled by default in all Beats) Packetbeat's process monitor. (disabled by default). Auditbeat's system/process metricset. This PR updates vendored go-sysinfo to the most recent version, which fixes the leak. * New processor extract_array (#11761) This adds a new processor, extract_array, that allows accessing values inside arrays and copying them to target fields. * [Heartbeat] Remove not needed flags from setup command (#11856) The setup command until now contained all the possible options from the other Beats. As Heartbeat does not ship anymore with dashboards, the --dashboards command is not needed anymore and is only confusing. I also removed all the other commands except `--ilm-policy` and `--template`. I'm not aware that `--pipelines` or `--machine-learning` would be used. Here the comparison between `./heartbeat setup -h` from before and after. Before: ``` This command does initial setup of the environment: * Index mapping template in Elasticsearch to ensure fields are mapped. * Kibana dashboards (where available). * ML jobs (where available). * Ingest pipelines (where available). * ILM policy (for Elasticsearch 6.5 and newer). Usage: heartbeat setup [flags] Flags: --dashboards Setup dashboards -h, --help help for setup --ilm-policy Setup ILM policy --machine-learning Setup machine learning job configurations --pipelines Setup Ingest pipelines --template Setup index template ``` After: ``` This command does initial setup of the environment: * Index mapping template in Elasticsearch to ensure fields are mapped. * ILM Policy Usage: heartbeat setup [flags] Flags: -h, --help help for setup --ilm-policy Setup ILM policy --template Setup index template ``` In this PR I did not include a check for the config option `setup.dashboards` to make sure they are not there like apm-server does (https://github.com/elastic/apm-server/blob/2baefab778fdfe70c47bc2fb488677b2e43e4635/beater/beater.go#L60) as I don't think it's necessary. * Skip Windows testing if magefile.go does not exist (#12099) Changes the jenkins_ci.ps1 script to skip testing when magefile.go does not exist. This will allow us to add projects like x-pack/winlogbeat to the test matrix because not all branches have an x-pack/winlogbeat/magefile.go file. * Fix goroutine leak on initialization failures of log input (#12125) Outlets are created during log input initialization, and if it fails they were never freed. Handle this case. * Document and improve permission checks when running socket metricset from Docker (#12039) Update instructions for system/socket metricset on Docker. And base permission checks on capabilities rather than on the effective uid. Running a process as root doesn't mean that it has all privileges, specially when run as container. * [metricbeat] added CPU usage check to docker memory stats (#12062) * Change type from scaled_float to long and add format (#11982) * Change type from scaled_float to long and add format * [libbeat] Add unit tests for libbeat's client proxy settings (#12044) These tests set up server listeners and create libbeat clients with varying proxy settings, and verify that the clients ping the correct target URL. This is a preparation for #11713, since most of the logic (and work) is in testing the proxy settings; the much simpler PR adding the proxy-disable flag will be a followup to this one, to keep the functional changes isolated in case of rollbacks etc. * [Metricbeat](Etcd-Leader)Followers wont report leader metrics (#12004) * manage leader metricset so that followers don't report errors nor events * add debug message when skipping leader events from non leader members * Add package libbeat/common/cleanup (#12134) * Add package libbeat/common/cleanup The cleanup package adds helpers for deferred optional cleanup on errors. For example: ``` ok := False defer cleanup.IfNot(&ok, func() { ... }) // continue initialization ok = True return // some value ``` * Add changelog entry * [docs] add make fmt to contributing guide (#12118) * Move one changelog entry from breaking change to bug fix (#12146) * Sysmon and Security "modules" for Winlogbeat (#11651) Add pipelines for the Security and Sysmon event logs The Security processor handles just three events to start with - 4624, 4625, and 4648. These are event.category=authentication events. The Sysmon processor handles all event IDs found in the sysmon manifest (sysmon -s). It moves the event_data fields that are in ECS and does some type conversions. * [Auditbeat] Process: Add hash of executable (#11722) Adds the hash(es) of the process executable to `process.hash.*`. The default is to add SHA-1 only as `process.hash.sha1`. * [Docs] Comment out section that contains bad link (#12152) * [Filebeat] Introduce UTC as default timezone for modules tests (#12120) Currently all our modules have convert_timezone disable by default. The reason in 6.x for this was probably that 6.0 did not support convert_timezone and we did not want to introduce a breaking changes. New modules should have convert_timezone enabled by default. If a module has convert_timezone enabled by default the tests will fail as it takes the timezone of the local computer. To circumvent this, this PR sets the timezone of the tests to UTC so the same time zone is always used. No generated files were changed in this PR as all modules have convert_timezone off by default. But it will affect #12079 and #12032 * Add number of goroutines to reported metrics (#12135) * Add minimal ES template functionality. (#12103) When loading a template without fields, create a minimal template only applying given configuration, without any default values for mappings and settings. This allows to create additional templates only defining specific values. * Refactor logging in pgsql module (#12151) Guard debug logging statements with "isDebug" checks. And switch the module over to using named loggers. Fixes #12150 * Ignore doc type in ES search API for ES 8 (#12171) * [Docs] Make breaking changes separate files for each version (#12173) * [Filebeat] module for palo_alto (pan-os) logs (#11999) This is a module for Palo Alto Networks PAN-OS logs received via Syslog. It has been tested with logs for PAN-OS version 7.1 to 9.0. However, it is expected to work with earlier versions as the log format is compatible. * [cmd setup] Add and deprecate setup cmds for index handling (#12132) Deprecate `setup --template` and `setup --ilm` in favour of newly introduced `setup --index-management` command. Fix bug in template and write alias creation order to ensure creating properly managed indices. implements #12095 Co-authored-by: [email protected] * Zdd zfs beat (#12136) Querying ZFS Storage and Pool Status * [metricbeat] Expand metricbeat dev guide for testing (#12105) * update dev guide to add examples and expand testing * Bugfix set template.order to 1 by default. (#12160) To ensure default order is not changed to 0, set it to 1 in default config. * [Auditbeat] Fix issues with multiple calls to rpmReadConfigFiles (#12168) This patch fixes two issues in Auditbeat's system/package on RPM distros: - Multiple calls to rpmReadConfigFiles lead to a crash (segmentation fault). It is necessary to call rpmFreeRpmrc after each call to rpmReadConfigFiles. See [1] for a similar issue. - In addition, it is also necessary to call rpmFreeMacros (when available) to avoid leaking memory after each rpmReadConfigFiles call. 1: https://lists.fedorahosted.org/pipermail/anaconda-patches/2015-February/015826.html Fixes #12147 * [Filebeat] Palo_alto module improvements (#12182) This PR adds some missing features to the recently merged palo_alto module: Dashboards (One for traffic logs, one for threats). Sets network.type to either ipv4 or ipv6. Renames palo_alto.pan_os.threat_file_or_url to palo_alto.pan_os.threat.resource. Splits palo_alto.pan_os.threat_id into palo_alto.pan_os.threat.id and palo_alto.pan_os.threat.name. * Add mesosbeat to the community beats (#12185) * Missing module.yml.disabled file for palo_alto (#12191) * [Filebeat] Add RabbitMQ module (#12032) * Parses single and multiline messages from [RabbitMQ's unified log file](https://www.rabbitmq.com/logging.html#log-file-location) * `var.paths` uses the `RABBITMQ_LOGS` env variable if present * `var.convert_timezone` (enabled by default since the [timestamps are localtime by default](https://github.com/erlang-lager/lager#universal-time)) * No dashboard * Tested with ``` ~/go/src/github.com/elastic/beats/x-pack/filebeat [master @ 092a3f5] ✓ ‣ MODULES_PATH=./module GENERATE=1 INTEGRATION_TESTS=1 TESTING_FILEBEAT_MODULES=rabbitmq nosetests tests/system/test_xpack_modules.py -v test_fileset_file_0_rabbitmq (test_xpack_modules.XPackTest) ... ok ---------------------------------------------------------------------- Ran 1 test in 3.320s OK ``` * [metricbeat] Add linux sockstat data to socket_summary metricset (#12050) * add sockstat data to socket_summary * Fix goroutine leak on non-explicit finalization of log inputs (#12164) If log inputs were finished because their context, or one of their ouleters have been finished, then it wasn't stopping its harvesters, leaking resources. * [Metricbeat] CoreDNS module: Add Kibana Dashboard (#11619) * [Metricbeat] CoreDNS module: Add Kibana Dashboard Fixes #10432. * [Libbeat][Metricbeat]Add IgnoreAllErrors to schema.Conv object (#12089) * schema conv option for ignore all errors Co-Authored-By: Jaime Soriano Pastor <[email protected]> * Add `container` input, deprecate `docker` in favor of it (#12162) Add `container` input, deprecate `docker` in favor of it This change adds a new container input for better support of CRI based scenarios. `docker` input was acting as a catch all input for all container related cases, but its config options were very opinionated towards Docker, with some issues: * `containers.ids` setting was good to abstract logs path, but we have seen many cases were logs are not under default location, or follow a different path pattern (ie CRI logs). * `containers.*` settings have shown counter intuitive for many users, in many cases we have seen people writing `container.*` instead, ending up in a config error. * Some existing settings (`combine_partials`, `cri.parse_flags`) were introduced as a way to offer a backwards compatible upgrades, but it doesn't really make sense to disable them, as they handle actual format behaviors. This new `container` input offers the same wrapper to read log files from containers with the following changes: * It exposes `paths` as the `log` input, instead of `containers.ids` and `containers.path`. * `parse_flags` and `combine_partials` are hardcoded, as there is no good reason to disable them. * `stream` selector is still available, under root settings. * It allows to select the log format (also atodetect it), giving room for future format changes. `format` can be `auto` (default), `docker` and `CRI`. Example configurations: Get Docker logs: ``` filebeat.inputs: - type: container paths: - /var/lib/docker/containers/*/*.log ``` Get Kubernetes logs: ``` filebeat.inputs: - type: container paths: - /var/log/pods/*/*/*.log # this could also be used: #- /var/log/containers/*.log ``` Previous `docker` input is deprecated in favor of this, to be removed in 8.0 * [Auditbeat] Fix formatting of config files on macOS and Windows (#12148) Fixes formatting of auditbeat.yml and auditbeat.reference.yml across platforms. * [libbeat] Escape BOM on JsonReader before trying to decode line (#11661) * fix json bom + testing * Set beat ID in registries after loading meta file (#12180) * Reset beat ID in registries in case loaded from meta file * Set, not reset * Adding CHANGELOG entry * [Filebeat] Move dashboards from 8 to 7 directory (#12217) The CoreDNS and Envoyproxy dashboard were in the 8 instead of 7 directory. This PR fixes this. * adjust doc

houndci-bot reviewed Apr 30, 2019

View reviewed changes

libbeat/processors/extract_array/extract_array.go Outdated Show resolved Hide resolved

houndci-bot reviewed Apr 30, 2019

View reviewed changes

libbeat/processors/extract_array/extract_array_test.go Outdated Show resolved Hide resolved

libbeat/processors/extract_array/extract_array.go Outdated Show resolved Hide resolved

houndci-bot reviewed Apr 30, 2019

View reviewed changes

libbeat/processors/extract_array/extract_array_test.go Outdated Show resolved Hide resolved

adriansr added discuss Issue needs further discussion. Filebeat Filebeat needs_docs docs and removed needs_docs labels Apr 30, 2019

adriansr force-pushed the feature_palo_alto_module branch from e953941 to 15c26d4 Compare May 6, 2019 09:00

adriansr marked this pull request as ready for review May 7, 2019 08:44

adriansr requested review from a team as code owners May 7, 2019 08:44

adriansr added review and removed discuss Issue needs further discussion. labels May 7, 2019

jsoriano reviewed May 7, 2019

View reviewed changes

adriansr force-pushed the feature_palo_alto_module branch from 47ecb68 to 5179ac3 Compare May 7, 2019 18:53

andrewkroh reviewed May 8, 2019

View reviewed changes

adriansr force-pushed the feature_palo_alto_module branch from c05fb47 to b387c83 Compare May 9, 2019 09:24

andrewkroh approved these changes May 9, 2019

View reviewed changes

adriansr added 9 commits May 10, 2019 23:07

PAN-OS module

79dd275

Rename fileset from log to pan_os

2505559

Add pan_os prefix to fields

e8c38d4

Make network.community_id into an array

51517c7

Set source and destination address fields

4da1d50

Nit: Hide template actions behind comments

0ac29a5

Make event.end use same TZ offset as event.start

ef2170d

Missing make update

89ea376

Comment out dashboards TODO in docs

21741bc

adriansr force-pushed the feature_palo_alto_module branch from 8583bf3 to 21741bc Compare May 10, 2019 21:08

Missing docs file

d68f6e9

adriansr force-pushed the feature_palo_alto_module branch from a7217c7 to d68f6e9 Compare May 11, 2019 00:28

adriansr merged commit f69dadb into elastic:master May 11, 2019

andrewkroh mentioned this pull request Dec 20, 2019

[Filebeat] Module for Palo Alto Logs #9199

Closed

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

[Filebeat] module for palo_alto (pan-os) logs #11999

[Filebeat] module for palo_alto (pan-os) logs #11999

adriansr commented Apr 30, 2019 •

edited

Loading

jsoriano left a comment

jsoriano May 7, 2019

jsoriano May 7, 2019

jsoriano May 7, 2019

jsoriano May 7, 2019

jsoriano May 7, 2019

andrewkroh left a comment

andrewkroh May 8, 2019

adriansr May 8, 2019

andrewkroh May 8, 2019

andrewkroh left a comment

	func TestExtractArrayProcessor_String(t *testing.T) {
	func TestExtractArrayProcessorString(t *testing.T) {

	func TestExtractArrayProcessor_Run(t *testing.T) {
	func TestExtractArrayProcessorRun(t *testing.T) {

[Filebeat] module for palo_alto (pan-os) logs #11999

[Filebeat] module for palo_alto (pan-os) logs #11999

Conversation

adriansr commented Apr 30, 2019 • edited Loading

Compatibility

ECS Mappings for TRAFFIC

ECS Mappings for THREAT

Categorization of events

event.category

event.action

event.outcome

Pending tasks

jsoriano left a comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

andrewkroh left a comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

andrewkroh left a comment

Choose a reason for hiding this comment

adriansr commented Apr 30, 2019 •

edited

Loading