Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

GlobalProtect user field is unknown #202

Closed
paulmnguyen opened this issue Aug 13, 2021 · 2 comments
Closed

GlobalProtect user field is unknown #202

paulmnguyen opened this issue Aug 13, 2021 · 2 comments
Assignees
@paulmnguyen
Labels
bug released

Comments

@paulmnguyen
Copy link
Contributor

Describe the bug

GlobalProtect logs forwarded via HEC from Cortex show user field as unknown. The log field from CDL is SourceUser which is not parsed into user field.

Expected behavior

User field should have username from SourceUser

Current behavior

User field is uknown

Possible solution

Create field alias for SourceUser to User

Steps to reproduce
@paulmnguyen paulmnguyen self-assigned this Aug 13, 2021
paulmnguyen added a commit that referenced this issue Aug 23, 2021
@paulmnguyen
fix(addon): Change SourceUser to SourceUserName
20cef50 
CDL uses SourceUserName instead of SourceUser

#202
@paulmnguyen paulmnguyen mentioned this issue Aug 23, 2021
Merged
paulmnguyen added a commit that referenced this issue Sep 10, 2021
@paulmnguyen
fix(addon): Add GlobalProtect SourceUserName
b6a678e 
Closes PR #209 

* Add SourceUserName

CDL uses SourceUserName instead of SourceUser

Closes #202
github-actions bot pushed a commit that referenced this issue Sep 10, 2021
@semantic-release-bot
chore(release): 7.0.2
0e1e0d3 
### [7.0.2](v7.0.1...v7.0.2) (2021-09-10)

### Bug Fixes

* **addon:** Add GlobalProtect SourceUserName - #209 #202
* **addon:** Remove endpoint tags and eventtypes - #196

### Performance Improvements

* **app:** Change simple XML to use JQuery 3.5 - #207
github-actions bot pushed a commit that referenced this issue Sep 11, 2021
@semantic-release-bot
chore(release): 7.0.2
3c37d18 
### [7.0.2](v7.0.1...v7.0.2) (2021-09-11)

### Bug Fixes

* **addon:** Add GlobalProtect SourceUserName - #209 #202
* **addon:** Remove endpoint tags and eventtypes - #196

### Performance Improvements

* **app:** Change simple XML to use JQuery 3.5 - #207
github-actions bot pushed a commit that referenced this issue Sep 11, 2021
@semantic-release-bot
chore(release): 7.0.2
bf7b328 
### [7.0.2](v7.0.1...v7.0.2) (2021-09-11)

### Bug Fixes

* **addon:** Add GlobalProtect SourceUserName - #209 #202
* **addon:** Remove endpoint tags and eventtypes - #196

### Performance Improvements

* **app:** Change simple XML to use JQuery 3.5 - #207
@github-actions
Copy link

🎉 This issue has been resolved in version 7.0.2 🎉

This release is available on SplunkBase: App - Add-on

Posted by semantic-release bot

paulmnguyen pushed a commit that referenced this issue Sep 22, 2021
@semantic-release-bot @paulmnguyen
chore(release): 7.0.2
1d34531 
* **addon:** Add GlobalProtect SourceUserName - #209 #202
* **addon:** Remove endpoint tags and eventtypes - #196

* **app:** Change simple XML to use JQuery 3.5 - #207
paulmnguyen pushed a commit that referenced this issue Sep 23, 2021
@semantic-release-bot @paulmnguyen
chore(release): 7.0.2
dea32a9 
* **addon:** Add GlobalProtect SourceUserName - #209 #202
* **addon:** Remove endpoint tags and eventtypes - #196

* **app:** Change simple XML to use JQuery 3.5 - #207

chore(release): 7.0.2

* **addon:** Add GlobalProtect SourceUserName - #209 #202
* **addon:** Remove endpoint tags and eventtypes - #196

* **app:** Change simple XML to use JQuery 3.5 - #207
@paulmnguyen paulmnguyen reopened this Sep 23, 2021
@paulmnguyen
Copy link
Contributor Author

Need to update the calculated field for user to include the globalprotect fields

github-actions bot pushed a commit that referenced this issue Sep 23, 2021
@semantic-release-bot
chore(release): 7.0.2
a429930 
### [7.0.2](v7.0.1...v7.0.2) (2021-09-23)

### Bug Fixes

* **addon:** Add GlobalProtect SourceUserName - #209 #202
* **addon:** Remove endpoint tags and eventtypes - #196

### Performance Improvements

* **app:** Change simple XML to use JQuery 3.5 - #207
@paulmnguyen paulmnguyen mentioned this issue Sep 24, 2021
Merged
4 tasks
github-actions bot pushed a commit that referenced this issue Sep 24, 2021
@semantic-release-bot
chore(release): 7.0.2
b69dcde 
### [7.0.2](v7.0.1...v7.0.2) (2021-09-24)

### Bug Fixes

* **addon:** Add GlobalProtect SourceUserName - #209 #202
* **addon:** Fix user showing as unknown from GlobalProtect logs.  - #217
* **addon:** Remove endpoint tags and eventtypes - #196
* **app:** Remove endpoint from Data Model Audit dashboard - #218

### Performance Improvements

* **app:** Change simple XML to use JQuery 3.5 - #207
github-actions bot pushed a commit that referenced this issue Sep 28, 2021
@semantic-release-bot
chore(release): 7.0.2
805a90c 
### [7.0.2](v7.0.1...v7.0.2) (2021-09-28)

### Bug Fixes

* **addon:** Add GlobalProtect SourceUserName - #209 #202
* **addon:** Fix user showing as unknown from GlobalProtect logs.  - #217
* **addon:** Remove endpoint tags and eventtypes - #196
* **app:** Remove endpoint from Data Model Audit dashboard - #218

### Performance Improvements

* **app:** Change simple XML to use JQuery 3.5 - #207
github-actions bot pushed a commit to btorresgil/SplunkforPaloAltoNetworks that referenced this issue Mar 7, 2022
@semantic-release-bot
chore(release): 5.0.0-beta.1
238b9d8 
## [5.0.0-beta.1](v4.2.2...v5.0.0-beta.1) (2022-03-07)

### Features

* **addon:** Add Decryption Log Support for PANOS 10  - PaloAltoNetworks#126
* **addon:** Cortex Data Lake HEC log support - PaloAltoNetworks#162 PaloAltoNetworks#176
* **addon:** PAN Quality Validation and Improvement
* **addon:** Significantly improve and modernize CIM compliance
* **app/addon:** Add Cortex XDR incident support to App and Add-on including new XDR Incidents dashboard - PaloAltoNetworks#166
* **app/addon:** Add IoT Security - PaloAltoNetworks#158
* **app/addon:** Feature/dynamic user groups - PaloAltoNetworks#150
* **app/addon:** Python 3 Support - PaloAltoNetworks#124
* **app/addon:** Support GlobalProtect log type in PANOS 9.1 - PaloAltoNetworks#118
* **app/addon:** Update pandevice to 0.14.0 - PaloAltoNetworks#145

### Bug Fixes

* **addon:** Add fields for GlobalProtect logs
* **addon:** Add fields for GlobalProtect logs
* **addon:** Add GlobalProtect SourceUserName - PaloAltoNetworks#209 PaloAltoNetworks#202
* **addon:** Add modinputs as tasks in app.manifest - PaloAltoNetworks#153
* **addon:** Add virus eventtype to malware CIM - PaloAltoNetworks#114 PaloAltoNetworks#138
* **addon:** Fix appserver/static files
* **addon:** Fix CDL logs contained string 'null' in 'user' field - PaloAltoNetworks#187
* **addon:** Fix error from Minemeld automatic lookup
* **addon:** Fix GlobalProtect logs dvc_name field
* **addon:** Fix GlobalProtect logs dvc_name field
* **addon:** Fix nav bar background color
* **addon:** Fix src_user field contained destination user - PaloAltoNetworks#186
* **addon:** Fix typo in transform.conf ([PaloAltoNetworks#227](https://github.com/btorresgil/SplunkforPaloAltoNetworks/issues/227))
* **addon:** Fix user showing as unknown from GlobalProtect logs.  - PaloAltoNetworks#217
* **addon:** Parse GP and Decryption logs w/ pan:firewall - PaloAltoNetworks#168
* **addon:** Parse GP and Decryption logs w/ pan:firewall - PaloAltoNetworks#168
* **addon:** Remove endpoint tags and eventtypes - PaloAltoNetworks#196
* **addon:** Remove port from `dest_name` field - PaloAltoNetworks#129 PaloAltoNetworks#128
* **addon:** Remove white space from GlobalProtect sourcetype - PaloAltoNetworks#131
* **addon:** Restore "unknown" string for empty 'user' field
* **app:** Fix error after upgrade to 7.0.0: "Unknown search command 'panwildfirereport'" - PaloAltoNetworks#189
* **app:** Fix IoT Security dashboard filter - PaloAltoNetworks#181
* **app:** Fix panContentPack error. Fixes bug [PaloAltoNetworks#222](https://github.com/btorresgil/SplunkforPaloAltoNetworks/issues/222) - PaloAltoNetworks#225
* **app:** Incident counters flash in Splunk 8.1 - PaloAltoNetworks#163
* **app:** Incident counters flash in Splunk 8.1 - PaloAltoNetworks#163
* **app:** Remove endpoint from Data Model Audit dashboard - PaloAltoNetworks#218
* **app/addon:** correct user-id tag_user / untag_user
* **app/addon:** Fix background color of logo - PaloAltoNetworks#141

### Performance Improvements

* **app:** Change simple XML to use JQuery 3.5 - PaloAltoNetworks#207
* **app:** Remove high cardinality fields from datamodel

### ⚠ MAJOR RELEASE CHANGES

This is a major release

Splunk dashboards and searches you have created might be
affected by these changes. Please be prepared to test and
adjust any dashboards not included with the App after upgrade.

* **addon:** pan_traffic_start logs no longer included in CIM
* **addon:** pan_traffic_end logs moved from Network Session to Network Traffic datamodel
* **addon:** pan_threat event type now includes wildfire and data logs
* **addon:** pan_file logs moved from Web to IDS datamodel
* **addon:** pan_virus logs moved from Malware to IDS datamodel
* **addon:** pan_wildfire logs moved from Malware to IDS datamodel
* **addon:** pan_email removed from Email datamodel
* **app:** Removes datamodel for GlobalProtect logs before PAN-OS 9.1
* **app/addon:** Removes Traps 4 support
* **app/addon:** Deprecates Traps 5 and Traps 6 support
* **app:** Removes support for legacy WildFire Report API
* **app/addon:** Requires Splunk 8.0 or higher
* **app/addon:** Replaces Adversary Scoreboard and Incident Feed dashboards with new XDR Incidents dashboard
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Assignees

@paulmnguyen paulmnguyen

Labels
bug released
Projects
None yet
Milestone
No milestone
Development

No branches or pull requests
1 participant
@paulmnguyen