Palo Alto Networks App for Splunk
Overview
Details
Palo Alto Networks App for Splunk leverages the data visibility provided by the Palo Alto Networks security platform with Splunk's extensive investigation and visualization capabilities to deliver advanced security reporting and analysis. This app enables security analysts, administrators, and architects to correlate application and user activities across all network and security infrastructures from a real-time and historical perspective. Complicated incident analysis that previously consumed days of manual and error-prone data mining can now be automated, saving not only manpower but also enabling key enterprise security resources to focus on critical, time-sensitive investigations.
Overview
- Partnership Overview (video)
- App Tour (video)
Requirements
Installation
- Follow the Installation Guide to install and configure the App and Add-on.
Support
Products Supported
- Firewall and Panorama
- Traps Endpoint Protection
- Aperture SaaS Application Security
- AutoFocus Threat Intelligence
- MineMeld Threat Intelligence Orchestrator
- WildFire Malware Analysis
Authors
Palo Alto Networks
- Brian Torres-Gil
- Paul Nguyen
- Garfield Freeman
Release Notes
Version 6.0.1
v6.0.1
* Improved filtering on dashboards
* Improved debugging logs
v6.0.0
* All new dashboards
- Adversary Scoreboard
- All Incident Feed
- Real-time Event Feed
- Datamodel Audit
- User Behavior
- And many more new dashboards...
* Tool tips and Tour to help guide you through the new dashboards
* Events from Firewall, Panorama, Traps, Aperture, AutoFocus, and Minemeld correlate and combine to offer unparalleled security insights
* Support for content pack sync with PAN-OS 8.0
Version 6.0.0
v6.0.0
* All new dashboards
- Adversary Scoreboard
- All Incident Feed
- Real-time Event Feed
- Datamodel Audit
- User Behavior
- And many more new dashboards...
* Tool tips and Tour to help guide you through the new dashboards
* Events from Firewall, Panorama, Traps, Aperture, AutoFocus, and Minemeld correlate and combine to offer unparalleled security insights
* Support for content pack sync with PAN-OS 8.0
Version 5.4.2
v5.4.2
* Improved saved search cron schedule
* Improved add-on compatibility check
v5.4.1
* Endpoint Dashboard bug fix
v5.4.0
* Endpoint Operations Dashboard
* Endpoint Security Dashboard
* Endpoint Dashboard support new Traps 3.4 fields
* Support for AutoFocus Remote Search via External Search Handler
* Support for Firewall Log Link via External Search Handler
* Improved AutoFocus cross launch
Version 5.4.1
v5.4.1
* Endpoint Dashboard bug fix
v5.4.0
* Endpoint Operations Dashboard
* Endpoint Security Dashboard
* Endpoint Dashboard support new Traps 3.4 fields
* Support for AutoFocus Remote Search via External Search Handler
* Support for Firewall Log Link via External Search Handler
* Improved AutoFocus cross launch
Version 5.4.0
v5.4.0
* Endpoint Operations Dashboard
* Endpoint Security Dashboard
* Endpoint Dashboard support new Traps 3.4 fields
* Support for AutoFocus Remote Search via External Search Handler
* Support for Firewall Log Link via External Search Handler
* Improved AutoFocus cross launch
Version 5.3.1
v5.3.1
- Changes made to meet new certification requirements
v5.3.0
- GlobalProtect Dashboard
- Other updates are in the Add-on (https://splunkbase.splunk.com/app/2757)
Important App Upgrade Notes
- App 5.3.x requires Add-on 3.7.x
- The App setup screen has moved to the Add-on. If you has previous set firewall credentials or a WildFire API key in the App setup screen, you’ll need to set them in the Add-on setup screen. See Step 2: Initial Setup in the Getting Started Guide.
- Datamodel acceleration might rebuild itself after installation due to updated constraints
- Eventtype pan_threat no longer includes these log_subtypes: url, data, file, and wildfire. You might need to update custom searches or panels you created that leverage the pan_threat eventtype. There are new eventtypes for each of the removed log_subtypes: pan_url, pan_data, pan_file, and pan_wildfire.
Version 5.2.0
* App Certified by Splunk
Note: As a certification requirement, this version drops support for Splunk 6.1 and earlier, and removes deprecated commands (**panblock** and **panupdate**). If you are using Splunk 6.1, please upgrade Splunk to 6.2 or higher before upgrading this App. If you are using panblock or panupdate, please use pantag and panuserupdate instead before upgrading this App.