Palo Alto Ingest Pipeline

Elastic Stack Elasticsearch
1

I'm hoping to get some clarification on how the Palo Alto ingest pipelines work. There don't seem to be any processors shipped by default that actually parse information (i.e. grok). Even when I throw the sample data from the Beats Github repo at the auto-generated panos pipeline, I don't get anything that remotely matches the expected Elasticsearch output.

GET _ingest/pipeline/filebeat-7.4.2-panw-panos-pipeline/_simulate
{
  "docs": [
    {
      "_source": {
        "message": """Nov 30 16:44:36 PA-220 1,2018/11/30 16:44:36,012801096514,THREAT,url,2049,2018/11/30 16:44:36,192.168.15.224,152.195.55.192,192.168.1.63,152.195.55.192,new_outbound_from_trust,,,ssl,vsys1,trust,untrust,ethernet1/2,ethernet1/1,send_to_mac,2018/11/30 16:44:36,28191,1,52984,443,37679,443,0x403000,tcp,block-url,"consent.cmp.oath.com/",(9999),business-and-economy,informational,client-to-server,7726,0x2000000000000000,192.168.0.0-192.168.255.255,United States,0,,0,,,0,,,,,,,,0,0,0,0,0,,PA-220,,,,,0,,0,,N/A,unknown,AppThreat-0-0,0x0,0,4294967295,"""
      }
    }
  ]
}

{
  "docs" : [
    {
      "doc" : {
        "_index" : "_index",
        "_type" : "_doc",
        "_id" : "_id",
        "_source" : {
          "error" : {
            "message" : ""
          },
          "log" : {
            "original" : """Nov 30 16:44:36 PA-220 1,2018/11/30 16:44:36,012801096514,THREAT,url,2049,2018/11/30 16:44:36,192.168.15.224,152.195.55.192,192.168.1.63,152.195.55.192,new_outbound_from_trust,,,ssl,vsys1,trust,untrust,ethernet1/2,ethernet1/1,send_to_mac,2018/11/30 16:44:36,28191,1,52984,443,37679,443,0x403000,tcp,block-url,"consent.cmp.oath.com/",(9999),business-and-economy,informational,client-to-server,7726,0x2000000000000000,192.168.0.0-192.168.255.255,United States,0,,0,,,0,,,,,,,,0,0,0,0,0,,PA-220,,,,,0,,0,,N/A,unknown,AppThreat-0-0,0x0,0,4294967295,"""
          }
        },
        "_ingest" : {
          "timestamp" : "2019-12-27T21:29:13.094132Z"
        }
      }
    }
  ]
}

Am I missing something? How is this supposed to work?

Here's a link to the pipeline for reference.

Thanks.

2

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.