Add Grok pattern for PANW Audit Logs #16566
Add Grok pattern for PANW Audit Logs #16566jameswiggins wants to merge 2 commits intoelastic:mainfrom
Conversation
|
💚 CLA has been signed |
|
I have signed the CLA |
|
Pinging @elastic/integration-experience (Team:Integration-Experience) |
|
Hi! We just realized that we haven't looked into this PR in a while. We're sorry! We're labeling this issue as |
|
Hi! This PR has been stale for a while and we're going to close it as part of our cleanup procedure. We appreciate your contribution and would like to apologize if we have not been able to review it, due to the current heavy load of the team. Feel free to re-open this PR if you think it should stay open and is worth rebasing. Thank you for your contribution! |
taylor-swanson
left a comment
There was a problem hiding this comment.
Hey @jameswiggins, sorry we didn't get to this before.
Do you have a sanitized log sample we can use as pipeline test? We'll also need the version bumped in the manifest file (a patch version change should suffice since this seems like a bugfix) and an entry in the changelog.
I added an additional Grok pattern to the list available in the default ingest pipeline. I did this because the PANW audit logs were failing to parse. I have tested these changes in production and verified their efficacy in parsing the panw audit logs.
To test, the reviewer could install the PANW integration, try to ingest some PANW audit logs and verify this pattern is required to parse audit logs and that adding this pattern does in fact parse them correctly
Related issues
#14912