Palo Alto Networks Add-on for Splunk
Overview
Details
The Palo Alto Networks Add-on for Splunk has been deprecated and will soon be archived. You should use the Splunk supported, Splunk Add-on for Palo Alto Networks.
Please follow the documentation for a migration path to use the Splunk supported Splunk Add-on for Palo Alto Networks.
Support
Release Notes
Authors
Palo Alto Networks
- Brian Torres-Gil
- Paul Nguyen
- Garfield Freeman
Release Notes
Version 8.1.3
Version 8.1.1
Version 8.1.0
Version 8.0.2
Version 7.1.0
Version 7.0.4
Version 7.0.3
Version 7.0.2
Version 7.0.1
Version 6.6.2
Version 7.0.0
Version 6.6.1
Version 6.6.0
Version 6.5.2
Version 6.5.1
Version 6.5.0
Features
- app/addon: Tag to Dynamic User Group
- app/addon: Update pandevice to 0.14.0
Bug Fixes
- addon: Remove the 'state_change_requires_restart' flag
Version 6.4.0
Features
- addon: Decryption Log Support
Bug Fixes
- addon: Fix Remove port from
dest_namefield
Version 6.3.1
Bug Fixes
- addon: Fix parser for GlobalProtect 9.1 log sourcetype
Version 6.3.0
Features
- app/addon: Python 3 Support
- app/addon: Support GlobalProtect log type in PANOS 9.1
Bug Fixes
- addon: Fix appserver/static files
Version 6.2.0
Version 6.2.0
- New: Palo Alto Networks Logo
- Fix: Improved Transform of Traps Analytics Logs
- Fix: Removed of deprecated "NewApp" API call to Applipedia
Version 6.1.1
- Fix: Improved API call to Aperture
- Fix: Aperture region field no longer ignored
- Fix: Traps event types updated
- Fix: Improved clustered environment support
Version 6.1.0
- New: Support for Traps 5.0 (Traps Management Service)
- New: Support for Firewall User-ID logs
- New: Credential Detected flag for PAN-OS 8.1
- New: MineMeld indicator retention timer
- New: Batch collection of Aperture logs
- New: Support all Aperture regions
- New: Easier to disable certificate validation for self-hosted MineMeld
- New: Malicious WildFire events tagged for Malware CIM datamodel
- Fix: category field for URL logs is now more consistent
- Fix: url_length field fixed
- Fix: Corrected the double parse of Aperture logs
Potentially breaking changes:
- Traps datamodel has been renamed from pan_endpoint to pan_traps
Version 6.1.1
Version 6.1.1
- Fix: Improved API call to Aperture
- Fix: Aperture region field no longer ignored
- Fix: Traps event types updated
- Fix: Improved clustered environment support
Version 6.1.0
- New: Support for Traps 5.0 (Traps Management Service)
- New: Support for Firewall User-ID logs
- New: Credential Detected flag for PAN-OS 8.1
- New: MineMeld indicator retention timer
- New: Batch collection of Aperture logs
- New: Support all Aperture regions
- New: Easier to disable certificate validation for self-hosted MineMeld
- New: Malicious WildFire events tagged for Malware CIM datamodel
- Fix: category field for URL logs is now more consistent
- Fix: url_length field fixed
- Fix: Corrected the double parse of Aperture logs
Potentially breaking changes:
- Traps datamodel has been renamed from pan_endpoint to pan_traps
Version 6.1.0
- New: Support for Traps 5.0 (Traps Management Service)
- New: Support for Firewall User-ID logs
- New: Credential Detected flag for PAN-OS 8.1
- New: MineMeld indicator retention timer
- New: Batch collection of Aperture logs
- New: Support all Aperture regions
- New: Easier to disable certificate validation for self-hosted MineMeld
- New: Malicious WildFire events tagged for Malware CIM datamodel
- Fix: category field for URL logs is now more consistent
- Fix: url_length field fixed
- Fix: Corrected the double parse of Aperture logs
Potentially breaking changes:
- Traps datamodel has been renamed from pan_endpoint to pan_traps
Version 6.0.2
v.6.0.2
* threat_list.csv and app_list.csv updated.
v.6.0.1
* Fixed threat list warning message
v6.0.0
MineMeld Support
AutoFocus Tags Support
Aperture Support
PAN-OS 8.0 new fields
Threat Intelligence from MineMeld can be shared with Splunk Enterprise Security
Improved CIM adoption
* Datamodel optimizations for size on disk and performance
Version 6.0.1
v.6.0.1
* Fixed threat list warning message
v6.0.0
MineMeld Support
AutoFocus Tags Support
Aperture Support
PAN-OS 8.0 new fields
Threat Intelligence from MineMeld can be shared with Splunk Enterprise Security
Improved CIM adoption
* Datamodel optimizations for size on disk and performance
Version 6.0.0
v6.0.0
* MineMeld Support
* AutoFocus Tags Support
* Aperture Support
* PAN-OS 8.0 new fields
* Threat Intelligence from MineMeld can be shared with Splunk Enterprise Security
* Improved CIM adoption
* Datamodel optimizations for size on disk and performance
Version 3.8.2
v3.8.2
* Improved CIM support for correlation log.
v3.8.1
* Configuration screen bug fix
v3.8.1
* Configuration screen bug fix
v3.8.0
* AutoFocus Export List modular input
* Improved configuration screen allows credentials to be changed
Version 3.8.1
v3.8.1
* Configuration screen bug fix
v3.8.0
* AutoFocus Export List modular input
* Improved configuration screen allows credentials to be changed
Version 3.8.0
v3.8.0
* AutoFocus Export List modular input
* Improved configuration screen allows credentials to be changed
Version 3.7.1
v3.7.1
- Changes made to meet new certification requirements
v3.7.0
- Integration with new Splunk Adaptive Response
- Tag to dynamic address group using modular actions and Adaptive Response
- Submit URL’s from any log in Splunk to WildFire
- Logs with malware hashes have a new event action that links directly to that hash in Autofocus
- Improved tagging for Splunk Enterprise Security, based on customer feedback
- New parser for GlobalProtect logs
Important Add-on Upgrade Notes
- Eventtype pan_threat no longer includes these log_subtypes: url, data, file, and wildfire. You might need to update custom searches or panels you created that leverage the pan_threat eventtype. There are new eventtypes for each of the removed log_subtypes: pan_url, pan_data, pan_file, and pan_wildfire.
Version 3.6.1
- Add-on Certified by Splunk
Version 3.6.0
- Support new Traps 3.3.2 log format
WARNING: Traps versions before 3.3.2 are no longer supported beginning with this Add-on version
Version 3.5.2
- Fix issue where endpoint logs would show up in CIM apps, but not Palo Alto Networks app
Version 3.5.1
- Add support for PAN-OS 7.0 new fields
- Add hip-match log type from Firewall and Panorama
- Add sourcetype category
- Add Sanctioned SaaS lookup table
- Update app_list.csv and threat_list.csv lookup tables with new format and data
- Fix incorrect value in report_id field for Wildfire logs in PAN-OS 6.1 or higher
- Fix src_category field should be dest_category
Version 3.5.0
Splunk Add-on for Palo Alto Networks 3.5.0. Copyright (C) 2014-2015 Splunk Inc. All rights reserved.
This new Add-on (TA) for Palo Alto Networks supports logs from Palo Alto Networks Next-generation Firewall, Panorama, and Traps Endpoint Security Manager. It is CIM 4.x compliant and designed to work with Splunk Enterprise Security 4 and the Palo Alto Networks App for Splunk v5.0.