Authors: Brian Torres-Gil and Paul Nguyen - Palo Alto Networks
Installation and Getting Started: http://pansplunk.readthedocs.io/en/latest/getting_started.html
Release Notes: http://pansplunk.readthedocs.io/en/latest/release_notes.html
- Changes made to meet new certification requirements
- Integration with new Splunk Adaptive Response
- Tag to dynamic address group using modular actions and Adaptive Response
- Submit URL’s from any log in Splunk to WildFire
- Logs with malware hashes have a new event action that links directly to that hash in Autofocus
- Improved tagging for Splunk Enterprise Security, based on customer feedback
- New parser for GlobalProtect logs
Important Add-on Upgrade Notes
- Eventtype pan_threat no longer includes these log_subtypes: url, data, file, and wildfire. You might need to update custom searches or panels you created that leverage the pan_threat eventtype. There are new eventtypes for each of the removed log_subtypes: pan_url, pan_data, pan_file, and pan_wildfire.
Nov. 7, 2016, 8:07 p.m.
6.6, 6.5, 6.4, 6.3, 6.2
* Add-on Certified by Splunk
July 7, 2016, 11:01 p.m.
6.5, 6.4, 6.3, 6.2, 6.1
* Support new Traps 3.3.2 log format
WARNING: Traps versions before 3.3.2 are no longer supported beginning with this Add-on version
April 22, 2016, 6:20 a.m.
6.4, 6.3, 6.2, 6.1
* Fix issue where endpoint logs would show up in CIM apps, but not Palo Alto Networks app
Feb. 3, 2016, 11:18 p.m.
6.3, 6.2, 6.1
* Add support for PAN-OS 7.0 new fields
* Add hip-match log type from Firewall and Panorama
* Add sourcetype category
* Add Sanctioned SaaS lookup table
* Update app_list.csv and threat_list.csv lookup tables with new format and data
* Fix incorrect value in report_id field for Wildfire logs in PAN-OS 6.1 or higher
* Fix src_category field should be dest_category
Nov. 13, 2015, 4:36 p.m.
6.3, 6.2, 6.1
Splunk Add-on for Palo Alto Networks 3.5.0. Copyright (C) 2014-2015 Splunk Inc. All rights reserved.
This new Add-on (TA) for Palo Alto Networks supports logs from Palo Alto Networks Next-generation Firewall, Panorama, and Traps Endpoint Security Manager. It is CIM 4.x compliant and designed to work with Splunk Enterprise Security 4 and the Palo Alto Networks App for Splunk v5.0.
May 28, 2015, 2 a.m.
6.3, 6.2, 6.1
Splunk's App Certification program uses a specific set of criteria to evaluate the level of quality, usability and security your app offers to its users. In addition, we evaluate the documentation and support you offer to your app's users.
As a Splunkbase app developer, you will have access to all Splunk development resources and receive a 50GB license to build an app that will help solve use cases for customers all over the world. Splunkbase has 1000+ apps and add-ons from Splunk, our partners and our community. Find an app or add-on for most any data source and user need, or simply create your own with help from our developer portal.