Palo Alto Networks XML API Add-on for Splunk
Overview
Details
This addon is useful for monitoring system, network, and inventory health information from all your PAN Firewalls.
Data Inputs included for monitoring:
System/Version Info
Time (NTP) Info
Pending Uncommitted Changes
PAN XML Config (compare device configurations, search for any configuration, or just use a few tags in a custom search, or restore a PAN device I guess…)
High Availability Status
Panorama Status
Data Plane Usage (CPU Load %/Resource Utilization %)
Management Plane Usage (CPU, Memory, Swap, Storage, Processes)
Session Info (Packets/sec, Kb/sec, C/sec, Active Sessions/sec, Installed Sessions, Predict Sessions/sec, TCP Sessions/sec, UDP Sessions/sec, ICMP Sessions/sec, Session Settings)
Interface Info (In and Out Kb/sec, In and Out Packets/sec, Interface Drops, Interface Errors, Interface Hardware, Interface Info)
Chassis Info (Status, Power, and Inventory details/summary)
Installation Instructions
Create an index to use on Indexer(s) (for storage) and the Forwarder (for index selection).
Install the add-on to a Splunk Enterprise Standalone instance or a Splunk Enterprise Forwarder.
Go to the add-on.
Go to the configuration page.
Create a new account.
Enter a unique name for your new account and then for the password enter a Palo Alto Networks API token for the user you have created to read data from the PAN device(s) and save.
Go to the Inputs page.
Create a new input for each host you wish to pull data from. I recommend two per host. 1 for the configuration file, and 1 for anything else you want data wise this way I can poll for most data every 60 seconds, and 3600 seconds for the config xml.
host should be what you want to your devices to show up as in charts and reports, index should be the index you created in the beginning, the api account should be the account you want to use to connect to the device, and the api url should be https://pandevice.domain.tld/api or https://panipaddress/api.
If the data doesn't parse correctly or line break, put the props file or the add-on on your Indexer(s).
Install the PAN XML API app to get some nice visualizations of your PAN data (https://splunkbase.splunk.com/app/3733/).
Planning to update with additional data input options. Please let me know if you have any suggestions. I know a few of the sourcetypes I pull, the data could be cleaner, so I will work towards different api quieres to get at the data. This was just an attempt to get some data out of PAN, so you could monitor it without logging into multiple devices or having access to a Panorama device.
Will also try and make it CIM compliant.