From a7c45bb7c2a478cc3aa1722affc65da674cd21ba Mon Sep 17 00:00:00 2001 From: Ricardo Valdes Date: Tue, 22 Sep 2026 13:35:23 -0400 Subject: [PATCH 1/9] fix(paloalto): repair SDK filter configuration and cast targets --- filters/paloalto/pa_firewall.yml | 58 +++++++++++++------------- plugins/alerts/paloalto_config_test.go | 56 +++++++++++++++++++++++++ 2 files changed, 85 insertions(+), 29 deletions(-) create mode 100644 plugins/alerts/paloalto_config_test.go diff --git a/filters/paloalto/pa_firewall.yml b/filters/paloalto/pa_firewall.yml index 8503e8cde..8d63404b8 100644 --- a/filters/paloalto/pa_firewall.yml +++ b/filters/paloalto/pa_firewall.yml @@ -1,4 +1,4 @@ -# Palo Alto Firewall, version 3.0.1 +# Palo Alto Firewall, version 3.0.2 # Based in docs and samples log provided # Support Syslog CEF && LEEF format && CSV format && KV format # @@ -1543,14 +1543,14 @@ pipeline: source: log.cefOrLeefMsgAll - grok: - patterns: - - fieldName: log.irrelevant - pattern: '{{.data}}(panOSContainerNameSpace=)' - - fieldName: log.panOSContainerNameSpace - pattern: '{{.data}}({{.word}}=)' - - fieldName: log.irrelevant - pattern: '{{.greedy}}' - source: log.cefOrLeefMsgAll + patterns: + - fieldName: log.irrelevant + pattern: '{{.data}}(panOSContainerNameSpace=)' + - fieldName: log.panOSContainerNameSpace + pattern: '{{.data}}({{.word}}=)' + - fieldName: log.irrelevant + pattern: '{{.greedy}}' + source: log.cefOrLeefMsgAll - grok: patterns: @@ -1743,14 +1743,14 @@ pipeline: source: log.cefOrLeefMsgAll - grok: - patterns: - - fieldName: log.irrelevant - pattern: '{{.data}}(panOSDGl1=)' - - fieldName: log.panOSDGl1 - pattern: '{{.data}}({{.word}}=)' - - fieldName: log.irrelevant - pattern: '{{.greedy}}' - source: log.cefOrLeefMsgAll + patterns: + - fieldName: log.irrelevant + pattern: '{{.data}}(panOSDGl1=)' + - fieldName: log.panOSDGl1 + pattern: '{{.data}}({{.word}}=)' + - fieldName: log.irrelevant + pattern: '{{.greedy}}' + source: log.cefOrLeefMsgAll - grok: patterns: @@ -6381,7 +6381,7 @@ pipeline: # Detect if its a TUNNEL INSPECTION log # ..........................................................................# - csv: - from: log.csvMsgAll + source: log.csvMsgAll separator: "," headers: - log.receive_time @@ -6472,7 +6472,7 @@ pipeline: # Detect if its a SCTP log # ..........................................................................# - csv: - from: log.csvMsgAll + source: log.csvMsgAll separator: "," headers: - log.receive_time @@ -6545,7 +6545,7 @@ pipeline: # Detect if its a CONFIG log #......................................................................# - csv: - from: log.csvMsgAll + source: log.csvMsgAll separator: ',' headers: - log.receive_time @@ -6580,7 +6580,7 @@ pipeline: # Detect if its a AUTHENTICATION log #......................................................................# - csv: - from: log.csvMsgAll + source: log.csvMsgAll separator: ',' headers: - log.receive_time @@ -6633,7 +6633,7 @@ pipeline: # Detect if its a SYSTEM log #......................................................................# - csv: - from: log.csvMsgAll + source: log.csvMsgAll separator: ',' headers: - log.receive_time @@ -6667,7 +6667,7 @@ pipeline: # Detect if its a CORRELATED EVENTS log #......................................................................# - csv: - from: log.csvMsgAll + source: log.csvMsgAll separator: "," headers: - log.receive_time @@ -6697,7 +6697,7 @@ pipeline: # Detect if its a GTP log #......................................................................# - csv: - from: log.csvMsgAll + source: log.csvMsgAll separator: "," headers: - log.receive_time @@ -6904,15 +6904,15 @@ pipeline: # ................................................# - cast: fields: - - target.bytessent - - target.bytesreceived + - target.bytesSent + - target.bytesReceived to: float - cast: fields: - - target.pktssent + - target.packagesSent - target.packagesReceived - to: int64 + to: int - cast: fields: @@ -6941,4 +6941,4 @@ pipeline: # ..........................................................................# - delete: fields: - - log.csvMsgAll \ No newline at end of file + - log.csvMsgAll diff --git a/plugins/alerts/paloalto_config_test.go b/plugins/alerts/paloalto_config_test.go new file mode 100644 index 000000000..4531e7eb2 --- /dev/null +++ b/plugins/alerts/paloalto_config_test.go @@ -0,0 +1,56 @@ +package main + +import ( + "strings" + "testing" + + "github.com/threatwinds/go-sdk/plugins" + "github.com/threatwinds/go-sdk/utils" + "google.golang.org/protobuf/encoding/protojson" +) + +// This checks configuration loading against the linked SDK. It does not model +// raw-log extraction, evaluate detections, or claim that a live alert was created. +func TestPaloAltoFilterConfiguration(t *testing.T) { + data, err := utils.ReadPbYaml("../../filters/paloalto/pa_firewall.yml") + if err != nil { + t.Fatal(err) + } + cfg := new(plugins.Config) + if err := protojson.Unmarshal(data, cfg); err != nil { + t.Fatalf("filter must decode without dropping unknown SDK properties: %v", err) + } + if len(cfg.Pipeline) == 0 { + t.Fatal("filter has no pipeline") + } + eventPaths := map[string]bool{} + contractPaths(new(plugins.Event).ProtoReflect().Descriptor(), "", eventPaths) + for stageIndex, stage := range cfg.Pipeline { + if len(stage.Steps) == 0 { + t.Errorf("stage %d has no steps", stageIndex) + } + for stepIndex, step := range stage.Steps { + if csv := step.Csv; csv != nil { + if csv.Source == "" || csv.Separator == "" || len(csv.Headers) == 0 { + t.Errorf("stage %d step %d: incomplete CSV configuration", stageIndex, stepIndex) + } + } + if grok := step.Grok; grok != nil && len(grok.Patterns) == 0 { + t.Errorf("stage %d step %d: grok has no patterns", stageIndex, stepIndex) + } + if cast := step.Cast; cast != nil { + for _, field := range cast.Fields { + if !eventPaths[field] && !strings.HasPrefix(field, "log.") { + t.Errorf("stage %d step %d: cast targets unknown Event field %q", stageIndex, stepIndex, field) + } + } + // Supported types from the official SDK Filter-Steps-Reference. + switch cast.To { + case "int", "float", "string", "bool", "[]string": + default: + t.Errorf("stage %d step %d: unsupported documented cast type %q", stageIndex, stepIndex, cast.To) + } + } + } + } +} From 21bb62012f763824bfa0e5584ea6de6f53c4f600 Mon Sep 17 00:00:00 2001 From: Ricardo Valdes Date: Wed, 23 Sep 2026 09:25:34 -0400 Subject: [PATCH 2/9] fix(paloalto): align native parsing and correlation contracts --- filters/audits/paloalto.md | 147 + filters/paloalto/pa_firewall.yml | 15931 +++++++++------- plugins/alerts/paloalto_contract_test.go | 483 + plugins/alerts/paloalto_history_test.go | 204 + .../testdata/filter-contracts/paloalto.json | 65 + plugins/alerts/testdata/paloalto_raw.json | 2106 ++ .../pa_firewall/ioc_threat_intel_match.yml | 49 +- ...oc_threat_intel_match_server_to_client.yml | 29 + .../pa_firewall/panos_admin_brute_force.yml | 71 +- .../pa_firewall/panos_dns_security_alerts.yml | 77 +- .../panos_spyware_vulnerability.yml | 42 +- ...spyware_vulnerability_server_to_client.yml | 27 + .../panos_url_filtering_blocks.yml | 80 +- .../wildfire_malware_detection.yml | 42 +- ...ire_malware_detection_server_to_client.yml | 28 + .../zero_day_exploit_prevention.yml | 79 +- ...ay_exploit_prevention_server_to_client.yml | 56 + 17 files changed, 12357 insertions(+), 7159 deletions(-) create mode 100644 filters/audits/paloalto.md create mode 100644 plugins/alerts/paloalto_contract_test.go create mode 100644 plugins/alerts/paloalto_history_test.go create mode 100644 plugins/alerts/testdata/filter-contracts/paloalto.json create mode 100644 plugins/alerts/testdata/paloalto_raw.json create mode 100644 rules/paloalto/pa_firewall/ioc_threat_intel_match_server_to_client.yml create mode 100644 rules/paloalto/pa_firewall/panos_spyware_vulnerability_server_to_client.yml create mode 100644 rules/paloalto/pa_firewall/wildfire_malware_detection_server_to_client.yml create mode 100644 rules/paloalto/pa_firewall/zero_day_exploit_prevention_server_to_client.yml diff --git a/filters/audits/paloalto.md b/filters/audits/paloalto.md new file mode 100644 index 000000000..cda12564a --- /dev/null +++ b/filters/audits/paloalto.md @@ -0,0 +1,147 @@ +# Palo Alto PAN-OS filter and correlation review + +Replacement for historical #2614. The standard is the v11-pinned ThreatWinds go-sdk +v1.1.33 protobuf and its official wiki. This proposal changes the PAN-OS filter and +all seven existing detection definitions together; four direction-specific counterparts +bring the resulting rule set to eleven. Existing impact ratings and thresholds are retained. + +## Parsing and standard fields + +- Accept bare/PRI, RFC3164 and RFC5424 envelopes. Select CSV layouts by the actual type + column, without subtype whitelists or matching type names inside a description. Include + the leading FUTURE_USE column, use the SDK's `csv.source` property, and correct the + missing traffic virtual-system column and GTP protocol/action offset. +- Preserve all prior CEF extension keys and the official template's case-sensitive `Pan*` + spellings. Extract at complete field boundaries, including the last extension and escaped + equals signs. Generic THREAT CEF uses Signature ID as threat ID and `cat` as subtype; + URL/Data/WildFire templates reverse those meanings. CONFIG's signature carries its result. + SYSTEM's `cat` carries event ID. Reporter identity stays separate from session endpoints. + This covers the tested seven-field CEF layouts based on the PAN-OS 10.0 guide; some printed + templates have malformed header shapes and are not claimed as supported without profile evidence. +- Preserve the prior seven-field LEEF-labelled compatibility dialect. This is not a claim + of verified standard LEEF 1.0/2.0 support; unmatched formats retain the original raw record. +- Keep source/destination session addresses distinct from NAT, XFF, reporting-firewall and + GlobalProtect private addresses. Validate original IPs before promotion or geolocation, + including semantic unspecified IPv6/IPv4-mapped zero addresses. Preserve invalid vendor + values. Validate port ranges, MAC syntax and nonnegative counters before standard mapping. +- Map users, endpoint hosts/MAC/OS, explicit offset-bearing device time, URL resource, and + client-relative CSV byte/packet counters. CEF packet fields have explicit directions. + Only absolute HTTP(S) requests are promoted to `target.url`; scheme-less requests remain + in `log.misc` because the SDK wiki defines the standard field as a full URL. Common + hostname guards also apply to CONFIG, so missing/empty/`-`/`N/A` names are not promoted. + Only valid hashes are promoted, to the threatened side identified by attack direction. + WildFire `filePath` is the analysis cloud location; it is not a filesystem path. +- Recover user and source address only from explicit SYSTEM auth-fail/auth-success message + shapes. Do not promote an arbitrary address mentioned in a description. CONFIG's admin + client/user belong to the origin, not the reporting firewall or destination user. +- Preserve newer documented optional tail fields. Distinguish old/new URL tails with explicit + timestamp and HTTP-status anchors, and default/custom CONFIG tails with timestamp anchors. + Current URL and Data Filtering tails place cluster name before flow type; generic THREAT + uses the reverse order. Legacy URL's unverified final two fields remain numbered vendor data. + Ambiguous optional tails remain numbered vendor fields rather than invented host/time fields. + This also avoids treating a configuration XPath as a file path. + +## Outcomes and detections + +- TRAFFIC `allow` means the policy allowed traffic. Explicit threat/policy/decryption blocking + session-end reasons override that outcome to denied; resource exhaustion is failure. + THREAT `allow` means a flood-detection alert and never creates success. Alert-only detection, + syncookie and CONFIG Submitted do not prove success. No connectionStatus is inferred. +- Normalize explicit denial and authentication/configuration failures to SDK-wiki values. + Textual informational/low, medium, high and critical become info, warning, error and critical. + Retain original actions, results, severities and vendor fields for review and custom consumers. +- Consume the produced action, category, subtype, threat ID and authentication fields. A blocked + vendor category does not prove an external intelligence-feed match; a known CVE or unknown + category does not prove a zero-day; a WildFire verdict does not prove execution. Rename and + describe these rules accordingly, removing unsupported ATT&CK claims. +- WildFire malware detection requires the malware verdict; benign, grayware and phishing + verdicts are not labeled malware. URL coverage includes alert-only and blocked requests, so + its title no longer claims every match was blocked or every risky category was malware. +- Preserve physical event origin/target. For directional threats, choose the alert adversary + from documented client-to-server/server-to-client direction. For risky URL categories, the + remote resource is the adversary and the requester is the alert target. Missing threat + direction is an attribution gap, not permission to guess a malicious endpoint. +- DNS histories cover the legacy dns subtype plus spyware sinkhole/dns-c2/dns-malware events. + Alert-only ddns, parked and grayware categories are not added to the DNS history. A source + address may identify a forwarding resolver; trace the client before claiming compromise. + DNS and URL union predicates use the general Intrusion Detection category without an + ATT&CK technique: their matched populations do not uniformly establish command and control. +- Count recomputed candidates in five SDK histories: authentication 10/15m, DNS 3/30m, URL + 5/30m, and vulnerability 2/30m for each direction. Require collector, firewall serial and + virtual system; vulnerability also retains both endpoints and direction. Successful or + unrelated activity cannot satisfy the counts. Clear input-supplied candidates and scope. + +## Validation and rollout limits + +The committed suite has **122 fabricated raw fixtures**, positive/negative assertions for all +**eleven rules**, strict final Event decoding, independent alert-side expectations, and **five +real SDK history-request tests** against loopback mocks. History tests cover below/at threshold, +expiration, irrelevant/unmarked events, wrong identities and unresolved required placeholders. +The manifest also validates schema/conditions with the shared contract runner. These checks +use the SDK **v1.1.33** pinned by the reviewed v11 snapshot. + +Read-only sampling on 23 September 2026 also retrieved **34 distinct stored records** and the +mounted filter/rules from two deployments. Twenty-two are native SYSTEM records: nine +authentication failures, three authentication successes and ten other SYSTEM events. Twelve +are Cortex XDR records arriving under this data type and are deliberately not treated as +PAN-OS CSV. Each stored record includes two `unknown operation` errors with an empty step; +the deployed filter contains the corresponding two empty steps. The sampled records were +indexed, but lack the expected normalized event fields. This establishes actual runtime +errors and missing mappings, not wholesale configuration rejection or event loss. + +Private raw replay verifies independently derived SYSTEM columns, explicit authentication +user/address extraction, severity and time. Nine authentication failures match the revised +authentication predicate; successes and other sampled classes remain negative. Documented +traffic/threat/CONFIG CSV and CEF layouts are checked against the cited contracts and fabricated +regressions, not those SYSTEM samples. The legacy LEEF-labelled dialect has compatibility tests +only; neither it nor standard LEEF has vendor-semantic validation here. Ambiguous CEF +counters/severity remain unpromoted. + +Raw extraction uses an explicitly declared offline YAML/Go CSV model. It is not execution of the +closed EventProcessor, geolocation service or live alert creation. Native replay and deployment +identity evidence are maintained separately; no customer records or identifying metadata are +committed. No production alert-volume result is asserted. + +Before rollout, exercise the closed parser with the actual appliance export profiles, measure +throughput, and verify the resulting indexed fields and alerts. In particular: + +- Palo Alto publishes no supported CEF guidance after PAN-OS 10.0. Its guide gives a numeric + 0–10 importance scale but no exact mapping to PAN-OS textual severity bins. Numeric-only CEF + severity remains vendor data and does not satisfy textual high/critical predicates. Verify + the export profile's mapping before enabling that detection coverage; do not silently guess. +- The same CEF guide contradicts the byte orientation of `in`/`out` between its template and + extension dictionary. Both values are retained, but are not promoted until the actual + configured profile establishes orientation. Escaped CEF strings are preserved; full escape + decoding, arbitrary custom profiles and standard LEEF remain unverified. +- Current vendor pages redirect versioned URLs to the general NGFW guide. Tests cover the + documented layouts, not every firmware/export variant. Unknown optional tails stay vendor + data. Counters above the exact numeric comparison range are retained without promotion. +- Cortex XDR has a separate export contract. A Cortex payload on this dataType is not parsed + as a PAN-OS firewall record; routing and Cortex-specific parsing require a separate review. +- Install matching filter/rules together. New candidate fields need up to thirty minutes of + fresh history. Reconcile renamed rule definitions with installed definitions; this proposal + does not rewrite existing indexed documents, custom searches or local rule modifications. +- Indexed `lastEvent.*` grouping requires the shared alert fix #2627, already merged in the + reviewed v11 base. + Validate its grouping/volume behavior independently. The single-event and repeated-signature + detections, and the category and URL detections, can intentionally overlap. + History rules require their scope identities; discrete rules can still match with missing + collector or firewall identity, in which case grouping uses the available keys and is less + specific. Validate the actual export profile and grouping behavior before rollout. + +## References + +- [SDK protobuf, pinned v1.1.33](https://github.com/threatwinds/go-sdk/blob/v1.1.33/plugins/plugins.proto) +- [Filter step semantics](https://github.com/threatwinds/go-sdk/wiki/Filter-Steps-Reference) +- [Rule evaluation and history](https://github.com/threatwinds/go-sdk/wiki/Implementing-Rules) +- [PAN-OS syslog field descriptions](https://docs.paloaltonetworks.com/pan-os/11-1/pan-os-admin/monitoring/use-syslog-for-monitoring/syslog-field-descriptions) +- [Traffic fields and session-end reasons](https://docs.paloaltonetworks.com/ngfw/administration/monitoring/use-syslog-for-monitoring/syslog-field-descriptions/traffic-log-fields) +- [Threat actions, verdicts and direction](https://docs.paloaltonetworks.com/ngfw/administration/monitoring/use-syslog-for-monitoring/syslog-field-descriptions/threat-log-fields) +- [System authentication context](https://docs.paloaltonetworks.com/ngfw/administration/monitoring/use-syslog-for-monitoring/syslog-field-descriptions/system-log-fields) +- [Configuration fields](https://docs.paloaltonetworks.com/ngfw/administration/monitoring/use-syslog-for-monitoring/syslog-field-descriptions/config-log-fields) +- [URL fields](https://docs.paloaltonetworks.com/ngfw/administration/monitoring/use-syslog-for-monitoring/syslog-field-descriptions/url-filtering-log-fields) +- [Data Filtering fields and subtypes](https://docs.paloaltonetworks.com/ngfw/administration/monitoring/use-syslog-for-monitoring/syslog-field-descriptions/data-filtering-log-fields) +- [GTP fields](https://docs.paloaltonetworks.com/ngfw/administration/monitoring/use-syslog-for-monitoring/syslog-field-descriptions/gtp-log-fields) +- [DNS Security logging](https://docs.paloaltonetworks.com/dns-security/administration/monitor-dns-security/view-dns-security-logs) +- [CEF support boundary](https://docs.paloaltonetworks.com/resources/cef) +- [PAN-OS 10.0 CEF guide](https://docs.paloaltonetworks.com/content/dam/techdocs/en_US/pdf/cef/pan-os-10-0-cef-configuration-guide.pdf) diff --git a/filters/paloalto/pa_firewall.yml b/filters/paloalto/pa_firewall.yml index 8d63404b8..95bf7355c 100644 --- a/filters/paloalto/pa_firewall.yml +++ b/filters/paloalto/pa_firewall.yml @@ -1,6944 +1,8989 @@ -# Palo Alto Firewall, version 3.0.2 -# Based in docs and samples log provided -# Support Syslog CEF && LEEF format && CSV format && KV format -# -# Documentations -# 1- https://docs.paloaltonetworks.com/pan-os/10-2/pan-os-admin/monitoring/use-syslog-for-monitoring/syslog-field-descriptions -# 2- https://docs.paloaltonetworks.com/resources/cef -# -# Implementation -# 1. Parsing the RAW field containing the Palo Alto Firewall -# 2. Parsing headers of syslog the message -# 3. Parsing the KV field containing the Palo Alto Firewall -# 4. Parsing the CSV field containing the Palo Alto Firewall - +# Palo Alto Firewall, version 3.1.0 +# Palo Alto PAN-OS CSV and documented PAN-OS 10.0 CEF templates. +# The closed EventProcessor must be exercised in staging before rollout. +# The prior seven-field LEEF-labelled compatibility dialect is retained. +# Standard LEEF/custom layouts remain unverified; original raw is retained. +# https://docs.paloaltonetworks.com/resources/cef +# https://docs.paloaltonetworks.com/pan-os/11-1/pan-os-admin/monitoring/use-syslog-for-monitoring/syslog-field-descriptions +# See filters/audits/paloalto.md for layout/version and CEF escaping limits. pipeline: - - dataTypes: - - firewall-paloalto - steps: - - #......................................................................# - # Using grok to parse syslogHeader of the message - #......................................................................# - - grok: - patterns: - - fieldName: log.priority - pattern: '\<{{.data}}\>' - - fieldName: log.syslogVersion - pattern: '{{.integer}}' - - fieldName: log.deviceTime - pattern: '{{.year}}-{{.monthNumber}}-{{.monthDay}}{{.space}}{{.time}}' - - fieldName: log.syslogHost - pattern: '{{.hostname}}' - - fieldName: log.formatType - pattern: '(CEF:)||(LEEF:)' - - fieldName: log.formatVersion - pattern: '(\s)?{{.integer}}' - - fieldName: log.cefOrLeefMsgAll - pattern: '{{.greedy}}' - source: raw - where: contains("raw", "CEF:") || contains("raw", "LEEF:") - - #......................................................................# - # Removing unnecessary characters of the syslogHeader - #......................................................................# - - trim: - function: prefix - substring: "<" - fields: - - log.priority - - trim: - function: suffix - substring: ">" - fields: - - log.priority - - trim: - function: suffix - substring: ":" - fields: - - log.formatType - - # ......................................................................# - # Logs have different structure according to Firewall Log Types, so first, define Log Type - # Using grok to parse components of the cef_message - # ......................................................................# - # FIREWALL LOGS - # ......................................................................# - # Detect if its a Traffic log - #......................................................................# - - grok: - patterns: - - fieldName: log.embDeviceVendor - pattern: '\|{{.data}}\|' - - fieldName: log.embDeviceProduct - pattern: '{{.data}}\|' - - fieldName: log.paSenderSwVersion - pattern: '{{.data}}\|' - - fieldName: log.paSubtype - pattern: '{{.data}}\|' - - fieldName: log.paType - pattern: '{{.data}}\|' - - fieldName: log.severityLabel - pattern: '{{.data}}\|' - - fieldName: log.cefOrLeefMsg - pattern: '{{.greedy}}' - source: log.cefOrLeefMsgAll - where: contains("log.cefOrLeefMsgAll", "TRAFFIC") || contains("log.cefOrLeefMsgAll", "traffic") - - #......................................................................# - # Detect if its an url threat log - #......................................................................# - - grok: - patterns: - - fieldName: log.embDeviceVendor - pattern: '\|{{.data}}\|' - - fieldName: log.embDeviceProduct - pattern: '{{.data}}\|' - - fieldName: log.paSenderSwVersion - pattern: '{{.data}}\|' - - fieldName: log.paSubtype - pattern: '{{.data}}\|' - - fieldName: log.paType - pattern: '{{.data}}\|' - - fieldName: log.severityLabel - pattern: '{{.data}}\|' - - fieldName: log.cefOrLeefMsg - pattern: '{{.greedy}}' - source: log.cefOrLeefMsgAll - where: contains("log.cefOrLeefMsgAll", "THREAT") || contains("log.cefOrLeefMsgAll", "threat") && (contains("log.cefOrLeefMsgAll", "url") || contains("log.cefOrLeefMsgAll", "URL")) - - #......................................................................# - # Detect if its a data threat log - #......................................................................# - - grok: - patterns: - - fieldName: log.embDeviceVendor - pattern: '\|{{.data}}\|' - - fieldName: log.embDeviceProduct - pattern: '{{.data}}\|' - - fieldName: log.paSenderSwVersion - pattern: '{{.data}}\|' - - fieldName: log.paSubtype - pattern: '{{.data}}\|' - - fieldName: log.paType - pattern: '{{.data}}\|' - - fieldName: log.severityLabel - pattern: '{{.data}}\|' - - fieldName: log.cefOrLeefMsg - pattern: '{{.greedy}}' - source: log.cefOrLeefMsgAll - where: contains("log.cefOrLeefMsgAll", "data") || contains("log.cefOrLeefMsgAll", "DLP") || contains("log.cefOrLeefMsgAll", "DLP-NON-FILE") || contains("log.cefOrLeefMsgAll", "FILE") || contains("log.cefOrLeefMsgAll", "file") || contains("log.cefOrLeefMsgAll", "flood") || contains("log.cefOrLeefMsgAll", "packet") || contains("log.cefOrLeefMsgAll", "scan") || contains("log.cefOrLeefMsgAll", "spyware") || contains("log.cefOrLeefMsgAll", "URL") || contains("log.cefOrLeefMsgAll", "ml-virus") || contains("log.cefOrLeefMsgAll", "virus") || contains("log.cefOrLeefMsgAll", "vulnerability") - - #......................................................................# - # Detect if its a WildFire threat log - #......................................................................# - - grok: - patterns: - - fieldName: log.embDeviceVendor - pattern: '\|{{.data}}\|' - - fieldName: log.embDeviceProduct - pattern: '{{.data}}\|' - - fieldName: log.paSenderSwVersion - pattern: '{{.data}}\|' - - fieldName: log.paSubtype - pattern: '{{.data}}\|' - - fieldName: log.paType - pattern: '{{.data}}\|' - - fieldName: log.severityLabel - pattern: '{{.data}}\|' - - fieldName: log.cefOrLeefMsg - pattern: '{{.greedy}}' - source: log.cefOrLeefMsgAll - where: (contains("log.cefOrLeefMsgAll", "THREAT") || contains("log.cefOrLeefMsgAll", "threat")) && (contains("log.cefOrLeefMsgAll", "wildfire") || contains("log.cefOrLeefMsgAll", "WILDFIRE")) - - # ......................................................................# - # Detect if its general threat log - # ......................................................................# - - grok: - patterns: - - fieldName: log.embDeviceVendor - pattern: '\|{{.data}}\|' - - fieldName: log.embDeviceProduct - pattern: '{{.data}}\|' - - fieldName: log.paSenderSwVersion - pattern: '{{.data}}\|' - - fieldName: log.paSubtype - pattern: '{{.data}}\|' - - fieldName: log.paType - pattern: '{{.data}}\|' - - fieldName: log.severityLabel - pattern: '{{.data}}\|' - - fieldName: log.cefOrLeefMsg - pattern: '{{.greedy}}' - source: log.cefOrLeefMsgAll - where: contains("log.cefOrLeefMsgAll", "THREAT") || contains("log.cefOrLeefMsgAll", "threat") - - #......................................................................# - # Detect if its a CONFIG threat log - #......................................................................# - - grok: - patterns: - - fieldName: log.embDeviceVendor - pattern: '\|{{.data}}\|' - - fieldName: log.embDeviceProduct - pattern: '{{.data}}\|' - - fieldName: log.paSenderSwVersion - pattern: '{{.data}}\|' - - fieldName: log.paSubtype - pattern: '{{.data}}\|' - - fieldName: log.paType - pattern: '{{.data}}\|' - - fieldName: log.severityLabel - pattern: '{{.data}}\|' - - fieldName: log.cefOrLeefMsg - pattern: '{{.greedy}}' - source: log.cefOrLeefMsgAll - where: contains("log.cefOrLeefMsgAll", "CONFIG") || contains("log.cefOrLeefMsgAll", "config") - - #......................................................................# - # Detect if its a System log - #......................................................................# - - grok: - patterns: - - fieldName: log.embDeviceVendor - pattern: '\|{{.data}}\|' - - fieldName: log.embDeviceProduct - pattern: '{{.data}}\|' - - fieldName: log.paSenderSwVersion - pattern: '{{.data}}\|' - - fieldName: log.paSubtype - pattern: '{{.data}}\|' - - fieldName: log.paType - pattern: '{{.data}}\|' - - fieldName: log.severityLabel - pattern: '{{.data}}\|' - - fieldName: log.cefOrLeefMsg - pattern: '{{.greedy}}' - source: log.cefOrLeefMsgAll - where: contains("log.cefOrLeefMsgAll", "SYSTEM") || contains("log.cefOrLeefMsgAll", "system") - - #......................................................................# - # Detect if its a HIP-MATCH log - #......................................................................# - - grok: - patterns: - - fieldName: log.embDeviceVendor - pattern: '\|{{.data}}\|' - - fieldName: log.embDeviceProduct - pattern: '{{.data}}\|' - - fieldName: log.paSenderSwVersion - pattern: '{{.data}}\|' - - fieldName: log.paSubtype - pattern: '{{.data}}\|' - - fieldName: log.paType - pattern: '{{.data}}\|' - - fieldName: log.severityLabel - pattern: '{{.data}}\|' - - fieldName: log.cefOrLeefMsg - pattern: '{{.greedy}}' - source: log.cefOrLeefMsgAll - where: contains("log.cefOrLeefMsgAll", "HIP-MATCH") || contains("log.cefOrLeefMsgAll", "hip-match") - - #......................................................................# - # Detect if its an AUTHENTICATION log - #......................................................................# - - grok: - patterns: - - fieldName: log.embDeviceVendor - pattern: '\|{{.data}}\|' - - fieldName: log.embDeviceProduct - pattern: '{{.data}}\|' - - fieldName: log.paSenderSwVersion - pattern: '{{.data}}\|' - - fieldName: log.paSubtype - pattern: '{{.data}}\|' - - fieldName: log.paType - pattern: '{{.data}}\|' - - fieldName: log.severityLabel - pattern: '{{.data}}\|' - - fieldName: log.cefOrLeefMsg - pattern: '{{.greedy}}' - source: log.cefOrLeefMsgAll - where: contains("log.cefOrLeefMsgAll", "AUTHENTICATION") || contains("log.cefOrLeefMsgAll", "authentication") - - #......................................................................# - # Detect if its an USERID log - #......................................................................# - - grok: - patterns: - - fieldName: log.embDeviceVendor - pattern: '\|{{.data}}\|' - - fieldName: log.embDeviceProduct - pattern: '{{.data}}\|' - - fieldName: log.paSenderSwVersion - pattern: '{{.data}}\|' - - fieldName: log.paSubtype - pattern: '{{.data}}\|' - - fieldName: log.paType - pattern: '{{.data}}\|' - - fieldName: log.severityLabel - pattern: '{{.data}}\|' - - fieldName: log.cefOrLeefMsg - pattern: '{{.greedy}}' - source: log.cefOrLeefMsgAll - where: contains("log.cefOrLeefMsgAll", "USERID") || contains("log.cefOrLeefMsgAll", "userid") - - #......................................................................# - # Detect if its an IPTAG log - #......................................................................# - - grok: - patterns: - - fieldName: log.embDeviceVendor - pattern: '\|{{.data}}\|' - - fieldName: log.embDeviceProduct - pattern: '{{.data}}\|' - - fieldName: log.paSenderSwVersion - pattern: '{{.data}}\|' - - fieldName: log.paSubtype - pattern: '{{.data}}\|' - - fieldName: log.paType - pattern: '{{.data}}\|' - - fieldName: log.severityLabel - pattern: '{{.data}}\|' - - fieldName: log.cefOrLeefMsg - pattern: '{{.greedy}}' - source: log.cefOrLeefMsgAll - where: contains("log.cefOrLeefMsgAll", "IPTAG") || contains("log.cefOrLeefMsgAll", "iptag") - - #......................................................................# - # Detect if its an Tunnel log - #......................................................................# - - grok: - patterns: - - fieldName: log.embDeviceVendor - pattern: '\|{{.data}}\|' - - fieldName: log.embDeviceProduct - pattern: '{{.data}}\|' - - fieldName: log.paSenderSwVersion - pattern: '{{.data}}\|' - - fieldName: log.paSubtype - pattern: '{{.data}}\|' - - fieldName: log.paType - pattern: '{{.data}}\|' - - fieldName: log.severityLabel - pattern: '{{.data}}\|' - - fieldName: log.cefOrLeefMsg - pattern: '{{.greedy}}' - source: log.cefOrLeefMsgAll - where: (contains("log.cefOrLeefMsgAll", "START") || contains("log.cefOrLeefMsgAll", "start")) || (contains("log.cefOrLeefMsgAll", "END") || contains("log.cefOrLeefMsgAll", "end")) - - #......................................................................# - # Detect if its an CORRELATION log - #......................................................................# - - grok: - patterns: - - fieldName: log.embDeviceVendor - pattern: '\|{{.data}}\|' - - fieldName: log.embDeviceProduct - pattern: '{{.data}}\|' - - fieldName: log.paSenderSwVersion - pattern: '{{.data}}\|' - - fieldName: log.paSubtype - pattern: '{{.data}}\|' - - fieldName: log.paType - pattern: '{{.data}}\|' - - fieldName: log.severityLabel - pattern: '{{.data}}\|' - - fieldName: log.cefOrLeefMsg - pattern: '{{.greedy}}' - source: log.cefOrLeefMsgAll - where: contains("log.cefOrLeefMsgAll", "CORRELATION") || contains("log.cefOrLeefMsgAll", "correlation") - - #......................................................................# - # Detect if its an GTP log - #......................................................................# - - grok: - patterns: - - fieldName: log.embDeviceVendor - pattern: '\|{{.data}}\|' - - fieldName: log.embDeviceProduct - pattern: '{{.data}}\|' - - fieldName: log.paSenderSwVersion - pattern: '{{.data}}\|' - - fieldName: log.paSubtype - pattern: '{{.data}}\|' - - fieldName: log.paType - pattern: '{{.data}}\|' - - fieldName: log.severityLabel - pattern: '{{.data}}\|' - - fieldName: log.cefOrLeefMsg - pattern: '{{.greedy}}' - source: log.cefOrLeefMsgAll - where: contains("log.cefOrLeefMsgAll", "GTP") || contains("log.cefOrLeefMsgAll", "gtp") - - #......................................................................# - # Detect if its an SCTP log - #......................................................................# - - grok: - patterns: - - fieldName: log.embDeviceVendor - pattern: '\|{{.data}}\|' - - fieldName: log.embDeviceProduct - pattern: '{{.data}}\|' - - fieldName: log.paSenderSwVersion - pattern: '{{.data}}\|' - - fieldName: log.paType - pattern: '{{.data}}\|' - - fieldName: log.cefOrLeefMsg - pattern: '{{.greedy}}' - source: log.cefOrLeefMsgAll - where: contains("log.cefOrLeefMsgAll", "SCTP") || contains("log.cefOrLeefMsgAll", "sctp") - - #......................................................................# - # Detect if its an GLOBALPROTECT log - #......................................................................# - - grok: - patterns: - - fieldName: log.embDeviceVendor - pattern: '\|{{.data}}\|' - - fieldName: log.embDeviceProduct - pattern: '{{.data}}\|' - - fieldName: log.paSenderSwVersion - pattern: '{{.data}}\|' - - fieldName: log.paType - pattern: '{{.data}}\|' - - fieldName: log.paSubtype - pattern: '{{.data}}\|' - - fieldName: log.cefOrLeefMsg - pattern: '{{.greedy}}' - source: log.cefOrLeefMsgAll - where: contains("log.cefOrLeefMsgAll", "GLOBALPROTECT") || contains("log.cefOrLeefMsgAll", "globalprotect") - - #......................................................................# - # Detect if its an DECRYPTION log - #......................................................................# - - grok: - patterns: - - fieldName: log.embDeviceVendor - pattern: '\|{{.data}}\|' - - fieldName: log.embDeviceProduct - pattern: '{{.data}}\|' - - fieldName: log.paSenderSwVersion - pattern: '{{.data}}\|' - - fieldName: log.paType - pattern: '{{.data}}\|' - - fieldName: log.paSubtype - pattern: '{{.data}}\|' - - fieldName: log.cefOrLeefMsg - pattern: '{{.greedy}}' - source: log.cefOrLeefMsgAll - where: contains("log.cefOrLeefMsgAll", "DECRYPTION") || contains("log.cefOrLeefMsgAll", "decryption") - - #......................................................................# - # Remove unnecessary caracters - #......................................................................# - - trim: - function: prefix - substring: '|' - fields: - - log.embDeviceVendor - - - trim: - function: suffix - substring: '|' - fields: - - log.embDeviceVendor - - log.embDeviceProduct - - log.paSenderSwVersion - - log.paType - - log.paSubtype - - log.severityLabel - - # .......................................................................# - # Using grok to parse kv indiduals fields - # .......................................................................# - - grok: - patterns: - - fieldName: log.irrelevant - pattern: '{{.data}}(act=)' - - fieldName: log.act - pattern: '{{.data}}({{.word}}=)' - - fieldName: log.irrelevant - pattern: '{{.greedy}}' - source: log.cefOrLeefMsgAll - - - grok: - patterns: - - fieldName: log.irrelevant - pattern: '{{.data}}(anOSTimeGeneratedHighResolution=)' - - fieldName: log.anOSTimeGeneratedHighResolution - pattern: '{{.data}}({{.word}}=)' - - fieldName: log.irrelevant - pattern: '{{.greedy}}' - source: log.cefOrLeefMsgAll - - - grok: - patterns: - - fieldName: log.irrelevant - pattern: '{{.data}}(app=)' - - fieldName: log.app - pattern: '{{.data}}({{.word}}=)' - - fieldName: log.irrelevant - pattern: '{{.greedy}}' - source: log.cefOrLeefMsgAll - - - grok: - patterns: - - fieldName: log.irrelevant - pattern: '{{.data}}(c6a2=)' - - fieldName: log.c6a2 - pattern: '{{.data}}({{.word}}=)' - - fieldName: log.irrelevant - pattern: '{{.greedy}}' - source: log.cefOrLeefMsgAll - - - grok: - patterns: - - fieldName: log.irrelevant - pattern: '{{.data}}(c6a2Label=)' - - fieldName: log.c6a2Label - pattern: '{{.data}}({{.word}}=)' - - fieldName: log.irrelevant - pattern: '{{.greedy}}' - source: log.cefOrLeefMsgAll - - - grok: - patterns: - - fieldName: log.irrelevant - pattern: '{{.data}}(cat=)' - - fieldName: log.cat - pattern: '{{.data}}({{.word}}=)' - - fieldName: log.irrelevant - pattern: '{{.greedy}}' - source: log.cefOrLeefMsgAll - - - grok: - patterns: - - fieldName: log.irrelevant - pattern: '{{.data}}(cfp1=)' - - fieldName: log.cfp1 - pattern: '{{.data}}({{.word}}=)' - - fieldName: log.irrelevant - pattern: '{{.greedy}}' - source: log.cefOrLeefMsgAll - - - grok: - patterns: - - fieldName: log.irrelevant - pattern: '{{.data}}(cfp1Label=)' - - fieldName: log.cfp1Label - pattern: '{{.data}}({{.word}}=)' - - fieldName: log.irrelevant - pattern: '{{.greedy}}' - source: log.cefOrLeefMsgAll - - - grok: - patterns: - - fieldName: log.irrelevant - pattern: '{{.data}}(cfp2=)' - - fieldName: log.cfp2 - pattern: '{{.data}}({{.word}}=)' - - fieldName: log.irrelevant - pattern: '{{.greedy}}' - source: log.cefOrLeefMsgAll - - - grok: - patterns: - - fieldName: log.irrelevant - pattern: '{{.data}}(cfp2Label=)' - - fieldName: log.cfp2Label - pattern: '{{.data}}({{.word}}=)' - - fieldName: log.irrelevant - pattern: '{{.greedy}}' - source: log.cefOrLeefMsgAll - - - grok: - patterns: - - fieldName: log.irrelevant - pattern: '{{.data}}(cfp3=)' - - fieldName: log.cfp3 - pattern: '{{.data}}({{.word}}=)' - - fieldName: log.irrelevant - pattern: '{{.greedy}}' - source: log.cefOrLeefMsgAll - - - grok: - patterns: - - fieldName: log.irrelevant - pattern: '{{.data}}(cfp3Label=)' - - fieldName: log.cfp3Label - pattern: '{{.data}}({{.word}}=)' - - fieldName: log.irrelevant - pattern: '{{.greedy}}' - source: log.cefOrLeefMsgAll - - - grok: - patterns: - - fieldName: log.irrelevant - pattern: '{{.data}}(cfp4=)' - - fieldName: log.cfp4 - pattern: '{{.data}}({{.word}}=)' - - fieldName: log.irrelevant - pattern: '{{.greedy}}' - source: log.cefOrLeefMsgAll - - - grok: - patterns: - - fieldName: log.irrelevant - pattern: '{{.data}}(cfp4Label=)' - - fieldName: log.cfp4Label - pattern: '{{.data}}({{.word}}=)' - - fieldName: log.irrelevant - pattern: '{{.greedy}}' - source: log.cefOrLeefMsgAll - - - grok: - patterns: - - fieldName: log.irrelevant - pattern: '{{.data}}(cn1=)' - - fieldName: log.cn1 - pattern: '{{.data}}({{.word}}=)' - - fieldName: log.irrelevant - pattern: '{{.greedy}}' - source: log.cefOrLeefMsgAll - - - grok: - patterns: - - fieldName: log.irrelevant - pattern: '{{.data}}(cn2=)' - - fieldName: log.cn2 - pattern: '{{.data}}({{.word}}=)' - - fieldName: log.irrelevant - pattern: '{{.greedy}}' - source: log.cefOrLeefMsgAll - - - grok: - patterns: - - fieldName: log.irrelevant - pattern: '{{.data}}(cn2Label=)' - - fieldName: log.cn2Label - pattern: '{{.data}}({{.word}}=)' - - fieldName: log.irrelevant - pattern: '{{.greedy}}' - source: log.cefOrLeefMsgAll - - - grok: - patterns: - - fieldName: log.irrelevant - pattern: '{{.data}}(cn3=)' - - fieldName: log.cn3 - pattern: '{{.data}}({{.word}}=)' - - fieldName: log.irrelevant - pattern: '{{.greedy}}' - source: log.cefOrLeefMsgAll - - - grok: - patterns: - - fieldName: log.irrelevant - pattern: '{{.data}}(cn3Label=)' - - fieldName: log.cn3Label - pattern: '{{.data}}({{.word}}=)' - - fieldName: log.irrelevant - pattern: '{{.greedy}}' - source: log.cefOrLeefMsgAll - - - grok: - patterns: - - fieldName: log.irrelevant - pattern: '{{.data}}(cn4=)' - - fieldName: log.cn4 - pattern: '{{.data}}({{.word}}=)' - - fieldName: log.irrelevant - pattern: '{{.greedy}}' - source: log.cefOrLeefMsgAll - - - grok: - patterns: - - fieldName: log.irrelevant - pattern: '{{.data}}(cn4Label=)' - - fieldName: log.cn4Label - pattern: '{{.data}}({{.word}}=)' - - fieldName: log.irrelevant - pattern: '{{.greedy}}' - source: log.cefOrLeefMsgAll - - - grok: - patterns: - - fieldName: log.irrelevant - pattern: '{{.data}}(cn5=)' - - fieldName: log.cn5 - pattern: '{{.data}}({{.word}}=)' - - fieldName: log.irrelevant - pattern: '{{.greedy}}' - source: log.cefOrLeefMsgAll - - - grok: - patterns: - - fieldName: log.irrelevant - pattern: '{{.data}}(cn5Label=)' - - fieldName: log.cn5Label - pattern: '{{.data}}({{.word}}=)' - - fieldName: log.irrelevant - pattern: '{{.greedy}}' - source: log.cefOrLeefMsgAll - - - grok: - patterns: - - fieldName: log.irrelevant - pattern: '{{.data}}(cn6=)' - - fieldName: log.cn6 - pattern: '{{.data}}({{.word}}=)' - - fieldName: log.irrelevant - pattern: '{{.greedy}}' - source: log.cefOrLeefMsgAll - - - grok: - patterns: - - fieldName: log.irrelevant - pattern: '{{.data}}(cnt=)' - - fieldName: log.cnt - pattern: '{{.data}}({{.word}}=)' - - fieldName: log.irrelevant - pattern: '{{.greedy}}' - source: log.cefOrLeefMsgAll - - - grok: - patterns: - - fieldName: log.irrelevant - pattern: '{{.data}}(cs1=)' - - fieldName: log.cs1 - pattern: '{{.data}}({{.word}}=)' - - fieldName: log.irrelevant - pattern: '{{.greedy}}' - source: log.cefOrLeefMsgAll - - - grok: - patterns: - - fieldName: log.irrelevant - pattern: '{{.data}}(cs1Label=)' - - fieldName: log.cs1Label - pattern: '{{.data}}({{.word}}=)' - - fieldName: log.irrelevant - pattern: '{{.greedy}}' - source: log.cefOrLeefMsgAll - - - grok: - patterns: - - fieldName: log.irrelevant - pattern: '{{.data}}(cs2=)' - - fieldName: log.cs2 - pattern: '{{.data}}({{.word}}=)' - - fieldName: log.irrelevant - pattern: '{{.greedy}}' - source: log.cefOrLeefMsgAll - - - grok: - patterns: - - fieldName: log.irrelevant - pattern: '{{.data}}(cs2Label=)' - - fieldName: log.cs2Label - pattern: '{{.data}}({{.word}}=)' - - fieldName: log.irrelevant - pattern: '{{.greedy}}' - source: log.cefOrLeefMsgAll - - - grok: - patterns: - - fieldName: log.irrelevant - pattern: '{{.data}}(cs3=)' - - fieldName: log.cs3 - pattern: '{{.data}}({{.word}}=)' - - fieldName: log.irrelevant - pattern: '{{.greedy}}' - source: log.cefOrLeefMsgAll - - - grok: - patterns: - - fieldName: log.irrelevant - pattern: '{{.data}}(cs3Label=)' - - fieldName: log.cs3Label - pattern: '{{.data}}({{.word}}=)' - - fieldName: log.irrelevant - pattern: '{{.greedy}}' - source: log.cefOrLeefMsgAll - - - grok: - patterns: - - fieldName: log.irrelevant - pattern: '{{.data}}(cs4=)' - - fieldName: log.cs4 - pattern: '{{.data}}({{.word}}=)' - - fieldName: log.irrelevant - pattern: '{{.greedy}}' - source: log.cefOrLeefMsgAll - - - grok: - patterns: - - fieldName: log.irrelevant - pattern: '{{.data}}(cs5=)' - - fieldName: log.cs5 - pattern: '{{.data}}({{.word}}=)' - - fieldName: log.irrelevant - pattern: '{{.greedy}}' - source: log.cefOrLeefMsgAll - - - grok: - patterns: - - fieldName: log.irrelevant - pattern: '{{.data}}(cs5Label=)' - - fieldName: log.cs5Label - pattern: '{{.data}}({{.word}}=)' - - fieldName: log.irrelevant - pattern: '{{.greedy}}' - source: log.cefOrLeefMsgAll - - - grok: - patterns: - - fieldName: log.irrelevant - pattern: '{{.data}}(cs6=)' - - fieldName: log.cs6 - pattern: '{{.data}}({{.word}}=)' - - fieldName: log.irrelevant - pattern: '{{.greedy}}' - source: log.cefOrLeefMsgAll - - - grok: - patterns: - - fieldName: log.irrelevant - pattern: '{{.data}}(cs6Label=)' - - fieldName: log.cs6Label - pattern: '{{.data}}({{.word}}=)' - - fieldName: log.irrelevant - pattern: '{{.greedy}}' - source: log.cefOrLeefMsgAll - - - grok: - patterns: - - fieldName: log.irrelevant - pattern: '{{.data}}(destinationServiceName=)' - - fieldName: log.destinationServiceName - pattern: '{{.data}}({{.word}}=)' - - fieldName: log.irrelevant - pattern: '{{.greedy}}' - source: log.cefOrLeefMsgAll - - - grok: - patterns: - - fieldName: log.irrelevant - pattern: '{{.data}}(destinationTranslatedAddress=)' - - fieldName: log.destinationTranslatedAddress - pattern: '{{.data}}({{.word}}=)' - - fieldName: log.irrelevant - pattern: '{{.greedy}}' - source: log.cefOrLeefMsgAll - - - grok: - patterns: - - fieldName: log.irrelevant - pattern: '{{.data}}(destinationTranslatedPort=)' - - fieldName: log.destinationTranslatedPort - pattern: '{{.data}}({{.word}}=)' - - fieldName: log.irrelevant - pattern: '{{.greedy}}' - source: log.cefOrLeefMsgAll - - - grok: - patterns: - - fieldName: log.irrelevant - pattern: '{{.data}}(deviceExternalId=)' - - fieldName: log.deviceExternalId - pattern: '{{.data}}({{.word}}=)' - - fieldName: log.irrelevant - pattern: '{{.greedy}}' - source: log.cefOrLeefMsgAll - - - grok: - patterns: - - fieldName: log.irrelevant - pattern: '{{.data}}(deviceInboundInterface=)' - - fieldName: log.deviceInboundInterface - pattern: '{{.data}}({{.word}}=)' - - fieldName: log.irrelevant - pattern: '{{.greedy}}' - source: log.cefOrLeefMsgAll - - - grok: - patterns: - - fieldName: log.irrelevant - pattern: '{{.data}}(deviceOutboundInterface=)' - - fieldName: log.deviceOutboundInterface - pattern: '{{.data}}({{.word}}=)' - - fieldName: log.irrelevant - pattern: '{{.greedy}}' - source: log.cefOrLeefMsgAll - - - grok: - patterns: - - fieldName: log.irrelevant - pattern: '{{.data}}(dpt=)' - - fieldName: log.dpt - pattern: '{{.data}}({{.word}}=)' - - fieldName: log.irrelevant - pattern: '{{.greedy}}' - source: log.cefOrLeefMsgAll - - - grok: - patterns: - - fieldName: log.irrelevant - pattern: '{{.data}}(dst=)' - - fieldName: log.dst - pattern: '{{.data}}({{.word}}=)' - - fieldName: log.irrelevant - pattern: '{{.greedy}}' - source: log.cefOrLeefMsgAll - - - grok: - patterns: - - fieldName: log.irrelevant - pattern: '{{.data}}(duid=)' - - fieldName: log.duid - pattern: '{{.data}}({{.word}}=)' - - fieldName: log.irrelevant - pattern: '{{.greedy}}' - source: log.cefOrLeefMsgAll - - - grok: - patterns: - - fieldName: log.irrelevant - pattern: '{{.data}}(duser=)' - - fieldName: log.duser - pattern: '{{.data}}({{.word}}=)' - - fieldName: log.irrelevant - pattern: '{{.greedy}}' - source: log.cefOrLeefMsgAll - - - grok: - patterns: - - fieldName: log.irrelevant - pattern: '{{.data}}(dvchost=)' - - fieldName: log.dvchost - pattern: '{{.data}}({{.word}}=)' - - fieldName: log.irrelevant - pattern: '{{.greedy}}' - source: log.cefOrLeefMsgAll - - - grok: - patterns: - - fieldName: log.irrelevant - pattern: '{{.data}}(end=)' - - fieldName: log.end - pattern: '{{.data}}({{.word}}=)' - - fieldName: log.irrelevant - pattern: '{{.greedy}}' - source: log.cefOrLeefMsgAll - - - grok: - patterns: - - fieldName: log.irrelevant - pattern: '{{.data}}(externalId=)' - - fieldName: log.externalId - pattern: '{{.data}}({{.word}}=)' - - fieldName: log.irrelevant - pattern: '{{.greedy}}' - source: log.cefOrLeefMsgAll - - - grok: - patterns: - - fieldName: log.irrelevant - pattern: '{{.data}}(fileHash=)' - - fieldName: log.fileHash - pattern: '{{.data}}({{.word}}=)' - - fieldName: log.irrelevant - pattern: '{{.greedy}}' - source: log.cefOrLeefMsgAll - - - grok: - patterns: - - fieldName: log.irrelevant - pattern: '{{.data}}(fileId=)' - - fieldName: log.fileId - pattern: '{{.data}}({{.word}}=)' - - fieldName: log.irrelevant - pattern: '{{.greedy}}' - source: log.cefOrLeefMsgAll - - - grok: - patterns: - - fieldName: log.irrelevant - pattern: '{{.data}}(filePath=)' - - fieldName: log.filePath - pattern: '{{.data}}({{.word}}=)' - - fieldName: log.irrelevant - pattern: '{{.greedy}}' - source: log.cefOrLeefMsgAll - - - grok: - patterns: - - fieldName: log.irrelevant - pattern: '{{.data}}(fileType=)' - - fieldName: log.fileType - pattern: '{{.data}}({{.word}}=)' - - fieldName: log.irrelevant - pattern: '{{.greedy}}' - source: log.cefOrLeefMsgAll - - - grok: - patterns: - - fieldName: log.irrelevant - pattern: '{{.data}}(flags=)' - - fieldName: log.flags - pattern: '{{.data}}({{.word}}=)' - - fieldName: log.irrelevant - pattern: '{{.greedy}}' - source: log.cefOrLeefMsgAll - - - grok: - patterns: - - fieldName: log.irrelevant - pattern: '{{.data}}(flexNumber1=)' - - fieldName: log.flexNumber1 - pattern: '{{.data}}({{.word}}=)' - - fieldName: log.irrelevant - pattern: '{{.greedy}}' - source: log.cefOrLeefMsgAll - - - grok: - patterns: - - fieldName: log.irrelevant - pattern: '{{.data}}(flexNumber1Label=)' - - fieldName: log.flexNumber1Label - pattern: '{{.data}}({{.word}}=)' - - fieldName: log.irrelevant - pattern: '{{.greedy}}' - source: log.cefOrLeefMsgAll - - - grok: - patterns: - - fieldName: log.irrelevant - pattern: '{{.data}}(flexNumber2=)' - - fieldName: log.flexNumber2 - pattern: '{{.data}}({{.word}}=)' - - fieldName: log.irrelevant - pattern: '{{.greedy}}' - source: log.cefOrLeefMsgAll - - - grok: - patterns: - - fieldName: log.irrelevant - pattern: '{{.data}}(flexNumber2Label=)' - - fieldName: log.flexNumber2Label - pattern: '{{.data}}({{.word}}=)' - - fieldName: log.irrelevant - pattern: '{{.greedy}}' - source: log.cefOrLeefMsgAll - - - grok: - patterns: - - fieldName: log.irrelevant - pattern: '{{.data}}(flexString1=)' - - fieldName: log.flexString1 - pattern: '{{.data}}({{.word}}=)' - - fieldName: log.irrelevant - pattern: '{{.greedy}}' - source: log.cefOrLeefMsgAll - - - grok: - patterns: - - fieldName: log.irrelevant - pattern: '{{.data}}(flexString1Label=)' - - fieldName: log.flexString1Label - pattern: '{{.data}}({{.word}}=)' - - fieldName: log.irrelevant - pattern: '{{.greedy}}' - source: log.cefOrLeefMsgAll - - - grok: - patterns: - - fieldName: log.irrelevant - pattern: '{{.data}}(flexString2=)' - - fieldName: log.flexString2 - pattern: '{{.data}}({{.word}}=)' - - fieldName: log.irrelevant - pattern: '{{.greedy}}' - source: log.cefOrLeefMsgAll - - - grok: - patterns: - - fieldName: log.irrelevant - pattern: '{{.data}}(flexString2Label=)' - - fieldName: log.flexString2Label - pattern: '{{.data}}({{.word}}=)' - - fieldName: log.irrelevant - pattern: '{{.greedy}}' - source: log.cefOrLeefMsgAll - - - grok: - patterns: - - fieldName: log.irrelevant - pattern: '{{.data}}(fname=)' - - fieldName: log.fname - pattern: '{{.data}}({{.word}}=)' - - fieldName: log.irrelevant - pattern: '{{.greedy}}' - source: log.cefOrLeefMsgAll - - - grok: - patterns: - - fieldName: log.irrelevant - pattern: '{{.data}}(in=)' - - fieldName: log.in - pattern: '{{.data}}({{.word}}=)' - - fieldName: log.irrelevant - pattern: '{{.greedy}}' - source: log.cefOrLeefMsgAll - - - grok: - patterns: - - fieldName: log.irrelevant - pattern: '{{.data}}(msg=)' - - fieldName: log.msg - pattern: '{{.data}}({{.word}}=)' - - fieldName: log.irrelevant - pattern: '{{.greedy}}' - source: log.cefOrLeefMsgAll - - - grok: - patterns: - - fieldName: log.irrelevant - pattern: '{{.data}}(oldFileId=)' - - fieldName: log.oldFileId - pattern: '{{.data}}({{.word}}=)' - - fieldName: log.irrelevant - pattern: '{{.greedy}}' - source: log.cefOrLeefMsgAll - - - grok: - patterns: - - fieldName: log.irrelevant - pattern: '{{.data}}(panASServiceDiff=)' - - fieldName: log.panASServiceDiff - pattern: '{{.data}}({{.word}}=)' - - fieldName: log.irrelevant - pattern: '{{.greedy}}' - source: log.cefOrLeefMsgAll - - - grok: - patterns: - - fieldName: log.irrelevant - pattern: '{{.data}}(panASServiceType=)' - - fieldName: log.panASServiceType - pattern: '{{.data}}({{.word}}=)' - - fieldName: log.irrelevant - pattern: '{{.greedy}}' - source: log.cefOrLeefMsgAll - - - grok: - patterns: - - fieldName: log.irrelevant - pattern: '{{.data}}(panContainerName=)' - - fieldName: log.panContainerName - pattern: '{{.data}}({{.word}}=)' - - fieldName: log.irrelevant - pattern: '{{.greedy}}' - source: log.cefOrLeefMsgAll - - - grok: - patterns: - - fieldName: log.irrelevant - pattern: '{{.data}}(panDomainEDL=)' - - fieldName: log.panDomainEDL - pattern: '{{.data}}({{.word}}=)' - - fieldName: log.irrelevant - pattern: '{{.greedy}}' - source: log.cefOrLeefMsgAll - - - grok: - patterns: - - fieldName: log.irrelevant - pattern: '{{.data}}(panDstDAG=)' - - fieldName: log.panDstDAG - pattern: '{{.data}}({{.word}}=)' - - fieldName: log.irrelevant - pattern: '{{.greedy}}' - source: log.cefOrLeefMsgAll - - - grok: - patterns: - - fieldName: log.irrelevant - pattern: '{{.data}}(panDstDeviceCat=)' - - fieldName: log.panDstDeviceCat - pattern: '{{.data}}({{.word}}=)' - - fieldName: log.irrelevant - pattern: '{{.greedy}}' - source: log.cefOrLeefMsgAll - - - grok: - patterns: - - fieldName: log.irrelevant - pattern: '{{.data}}(panDstDeviceModel=)' - - fieldName: log.panDstDeviceModel - pattern: '{{.data}}({{.word}}=)' - - fieldName: log.irrelevant - pattern: '{{.greedy}}' - source: log.cefOrLeefMsgAll - - - grok: - patterns: - - fieldName: log.irrelevant - pattern: '{{.data}}(panDstDeviceOS=)' - - fieldName: log.panDstDeviceOS - pattern: '{{.data}}({{.word}}=)' - - fieldName: log.irrelevant - pattern: '{{.greedy}}' - source: log.cefOrLeefMsgAll - - - grok: - patterns: - - fieldName: log.irrelevant - pattern: '{{.data}}(panDstDeviceOSv=)' - - fieldName: log.panDstDeviceOSv - pattern: '{{.data}}({{.word}}=)' - - fieldName: log.irrelevant - pattern: '{{.greedy}}' - source: log.cefOrLeefMsgAll - - - grok: - patterns: - - fieldName: log.irrelevant - pattern: '{{.data}}(panDstDeviceProf=)' - - fieldName: log.panDstDeviceProf - pattern: '{{.data}}({{.word}}=)' - - fieldName: log.irrelevant - pattern: '{{.greedy}}' - source: log.cefOrLeefMsgAll - - - grok: - patterns: - - fieldName: log.irrelevant - pattern: '{{.data}}(panDstDeviceVendor=)' - - fieldName: log.panDstDeviceVendor - pattern: '{{.data}}({{.word}}=)' - - fieldName: log.irrelevant - pattern: '{{.greedy}}' - source: log.cefOrLeefMsgAll - - - grok: - patterns: - - fieldName: log.irrelevant - pattern: '{{.data}}(panDstEDL=)' - - fieldName: log.panDstEDL - pattern: '{{.data}}({{.word}}=)' - - fieldName: log.irrelevant - pattern: '{{.greedy}}' - source: log.cefOrLeefMsgAll - - - grok: - patterns: - - fieldName: log.irrelevant - pattern: '{{.data}}(panDstHostname=)' - - fieldName: log.panDstHostname - pattern: '{{.data}}({{.word}}=)' - - fieldName: log.irrelevant - pattern: '{{.greedy}}' - source: log.cefOrLeefMsgAll - - - grok: - patterns: - - fieldName: log.irrelevant - pattern: '{{.data}}(panDstMac=)' - - fieldName: log.panDstMac - pattern: '{{.data}}({{.word}}=)' - - fieldName: log.irrelevant - pattern: '{{.greedy}}' - source: log.cefOrLeefMsgAll - - - grok: - patterns: - - fieldName: log.irrelevant - pattern: '{{.data}}(panDynamicUsrgrp=)' - - fieldName: log.panDynamicUsrgrp - pattern: '{{.data}}({{.word}}=)' - - fieldName: log.irrelevant - pattern: '{{.greedy}}' - source: log.cefOrLeefMsgAll - - - grok: - patterns: - - fieldName: log.irrelevant - pattern: '{{.data}}(panEPSerial=)' - - fieldName: log.panEPSerial - pattern: '{{.data}}({{.word}}=)' - - fieldName: log.irrelevant - pattern: '{{.greedy}}' - source: log.cefOrLeefMsgAll - - - grok: - patterns: - - fieldName: log.irrelevant - pattern: '{{.data}}(panGPHostID=)' - - fieldName: log.panGPHostID - pattern: '{{.data}}({{.word}}=)' - - fieldName: log.irrelevant - pattern: '{{.greedy}}' - source: log.cefOrLeefMsgAll - - - grok: - patterns: - - fieldName: log.irrelevant - pattern: '{{.data}}(panHASessionOwner=)' - - fieldName: log.panHASessionOwner - pattern: '{{.data}}({{.word}}=)' - - fieldName: log.irrelevant - pattern: '{{.greedy}}' - source: log.cefOrLeefMsgAll - - - grok: - patterns: - - fieldName: log.irrelevant - pattern: '{{.data}}(panJustification=)' - - fieldName: log.panJustification - pattern: '{{.data}}({{.word}}=)' - - fieldName: log.irrelevant - pattern: '{{.greedy}}' - source: log.cefOrLeefMsgAll - - - grok: - patterns: - - fieldName: log.irrelevant - pattern: '{{.data}}(panLinkChange=)' - - fieldName: log.panLinkChange - pattern: '{{.data}}({{.word}}=)' - - fieldName: log.irrelevant - pattern: '{{.greedy}}' - source: log.cefOrLeefMsgAll - - - grok: - patterns: - - fieldName: log.irrelevant - pattern: '{{.data}}(panLinkDetail=)' - - fieldName: log.panLinkDetail - pattern: '{{.data}}({{.word}}=)' - - fieldName: log.irrelevant - pattern: '{{.greedy}}' - source: log.cefOrLeefMsgAll - - - grok: - patterns: - - fieldName: log.irrelevant - pattern: '{{.data}}(panOSActionFlags=)' - - fieldName: log.panOSActionFlags - pattern: '{{.data}}({{.word}}=)' - - fieldName: log.irrelevant - pattern: '{{.greedy}}' - source: log.cefOrLeefMsgAll - - - grok: - patterns: - - fieldName: log.irrelevant - pattern: '{{.data}}(panOSAPName=)' - - fieldName: log.panOSAPName - pattern: '{{.data}}({{.word}}=)' - - fieldName: log.irrelevant - pattern: '{{.greedy}}' - source: log.cefOrLeefMsgAll - - - grok: - patterns: - - fieldName: log.irrelevant - pattern: '{{.data}}(panOSAreaCode=)' - - fieldName: log.panOSAreaCode - pattern: '{{.data}}({{.word}}=)' - - fieldName: log.irrelevant - pattern: '{{.greedy}}' - source: log.cefOrLeefMsgAll - - - grok: - patterns: - - fieldName: log.irrelevant - pattern: '{{.data}}(panOSAssocID=)' - - fieldName: log.panOSAssocID - pattern: '{{.data}}({{.word}}=)' - - fieldName: log.irrelevant - pattern: '{{.greedy}}' - source: log.cefOrLeefMsgAll - - - grok: - patterns: - - fieldName: log.irrelevant - pattern: '{{.data}}(panOSAttemptedGateways=)' - - fieldName: log.panOSAttemptedGateways - pattern: '{{.data}}({{.word}}=)' - - fieldName: log.irrelevant - pattern: '{{.greedy}}' - source: log.cefOrLeefMsgAll - - - grok: - patterns: - - fieldName: log.irrelevant - pattern: '{{.data}}(panOSAuthMethod=)' - - fieldName: log.panOSAuthMethod - pattern: '{{.data}}({{.word}}=)' - - fieldName: log.irrelevant - pattern: '{{.greedy}}' - source: log.cefOrLeefMsgAll - - - grok: - patterns: - - fieldName: log.irrelevant - pattern: '{{.data}}(panOSCellID=)' - - fieldName: log.panOSCellID - pattern: '{{.data}}({{.word}}=)' - - fieldName: log.irrelevant - pattern: '{{.greedy}}' - source: log.cefOrLeefMsgAll - - - grok: - patterns: - - fieldName: log.irrelevant - pattern: '{{.data}}(panOSCertificateFlags=)' - - fieldName: log.panOSCertificateFlags - pattern: '{{.data}}({{.word}}=)' - - fieldName: log.irrelevant - pattern: '{{.greedy}}' - source: log.cefOrLeefMsgAll - - - grok: - patterns: - - fieldName: log.irrelevant - pattern: '{{.data}}(panOSCertificateSerial=)' - - fieldName: log.panOSCertificateSerial - pattern: '{{.data}}({{.word}}=)' - - fieldName: log.irrelevant - pattern: '{{.greedy}}' - source: log.cefOrLeefMsgAll - - - grok: - patterns: - - fieldName: log.irrelevant - pattern: '{{.data}}(panOSCertificateSize=)' - - fieldName: log.panOSCertificateSize - pattern: '{{.data}}({{.word}}=)' - - fieldName: log.irrelevant - pattern: '{{.greedy}}' - source: log.cefOrLeefMsgAll - - - grok: - patterns: - - fieldName: log.irrelevant - pattern: '{{.data}}(panOSCertificateVersion=)' - - fieldName: log.panOSCertificateVersion - pattern: '{{.data}}({{.word}}=)' - - fieldName: log.irrelevant - pattern: '{{.greedy}}' - source: log.cefOrLeefMsgAll - - - grok: - patterns: - - fieldName: log.irrelevant - pattern: '{{.data}}(panOSChainStatus=)' - - fieldName: log.panOSChainStatus - pattern: '{{.data}}({{.word}}=)' - - fieldName: log.irrelevant - pattern: '{{.greedy}}' - source: log.cefOrLeefMsgAll - - - grok: - patterns: - - fieldName: log.irrelevant - pattern: '{{.data}}(panOSChunkType=)' - - fieldName: log.panOSChunkType - pattern: '{{.data}}({{.word}}=)' - - fieldName: log.irrelevant - pattern: '{{.greedy}}' - source: log.cefOrLeefMsgAll - - - grok: - patterns: - - fieldName: log.irrelevant - pattern: '{{.data}}(panOSClientToFirewall=)' - - fieldName: log.panOSClientToFirewall - pattern: '{{.data}}({{.word}}=)' - - fieldName: log.irrelevant - pattern: '{{.greedy}}' - source: log.cefOrLeefMsgAll - - - grok: - patterns: - - fieldName: log.irrelevant - pattern: '{{.data}}(panOSCommonName=)' - - fieldName: log.panOSCommonName - pattern: '{{.data}}({{.word}}=)' - - fieldName: log.irrelevant - pattern: '{{.greedy}}' - source: log.cefOrLeefMsgAll - - - grok: - patterns: - - fieldName: log.irrelevant - pattern: '{{.data}}(panOSCommonNameLength=)' - - fieldName: log.panOSCommonNameLength - pattern: '{{.data}}({{.word}}=)' - - fieldName: log.irrelevant - pattern: '{{.greedy}}' - source: log.cefOrLeefMsgAll - - - grok: - patterns: - - fieldName: log.irrelevant - pattern: '{{.data}}(panOSConfigVersion=)' - - fieldName: log.panOSConfigVersion - pattern: '{{.data}}({{.word}}=)' - - fieldName: log.irrelevant - pattern: '{{.greedy}}' - source: log.cefOrLeefMsgAll - - - grok: - patterns: - - fieldName: log.irrelevant - pattern: '{{.data}}(panOSConnectionError=)' - - fieldName: log.panOSConnectionError - pattern: '{{.data}}({{.word}}=)' - - fieldName: log.irrelevant - pattern: '{{.greedy}}' - source: log.cefOrLeefMsgAll - - - grok: - patterns: - - fieldName: log.irrelevant - pattern: '{{.data}}(panOSConnectionErrorID=)' - - fieldName: log.panOSConnectionErrorID - pattern: '{{.data}}({{.word}}=)' - - fieldName: log.irrelevant - pattern: '{{.greedy}}' - source: log.cefOrLeefMsgAll - - - grok: - patterns: - - fieldName: log.irrelevant - pattern: '{{.data}}(panOSConnectionMethod=)' - - fieldName: log.panOSConnectionMethod - pattern: '{{.data}}({{.word}}=)' - - fieldName: log.irrelevant - pattern: '{{.greedy}}' - source: log.cefOrLeefMsgAll - - - grok: - patterns: - - fieldName: log.irrelevant - pattern: '{{.data}}(panOSContainerID=)' - - fieldName: log.panOSContainerID - pattern: '{{.data}}({{.word}}=)' - - fieldName: log.irrelevant - pattern: '{{.greedy}}' - source: log.cefOrLeefMsgAll - - - grok: - patterns: - - fieldName: log.irrelevant - pattern: '{{.data}}(panOSContainerName=)' - - fieldName: log.panOSContainerName - pattern: '{{.data}}({{.word}}=)' - - fieldName: log.irrelevant - pattern: '{{.greedy}}' - source: log.cefOrLeefMsgAll - - - grok: - patterns: - - fieldName: log.irrelevant - pattern: '{{.data}}(panOSContainerNameSpace=)' - - fieldName: log.panOSContainerNameSpace - pattern: '{{.data}}({{.word}}=)' - - fieldName: log.irrelevant - pattern: '{{.greedy}}' - source: log.cefOrLeefMsgAll - - - grok: - patterns: - - fieldName: log.irrelevant - pattern: '{{.data}}(panOSContentVer=)' - - fieldName: log.panOSContentVer - pattern: '{{.data}}({{.word}}=)' - - fieldName: log.irrelevant - pattern: '{{.greedy}}' - source: log.cefOrLeefMsgAll - - - grok: - patterns: - - fieldName: log.irrelevant - pattern: '{{.data}}(panOSCountOfRepeats=)' - - fieldName: log.panOSCountOfRepeats - pattern: '{{.data}}({{.word}}=)' - - fieldName: log.irrelevant - pattern: '{{.greedy}}' - source: log.cefOrLeefMsgAll - - - grok: - patterns: - - fieldName: log.irrelevant - pattern: '{{.data}}(panOSDataSourceName=)' - - fieldName: log.panOSDataSourceName - pattern: '{{.data}}({{.word}}=)' - - fieldName: log.irrelevant - pattern: '{{.greedy}}' - source: log.cefOrLeefMsgAll - - - grok: - patterns: - - fieldName: log.irrelevant - pattern: '{{.data}}(panOSDataSourceSubType=)' - - fieldName: log.panOSDataSourceSubType - pattern: '{{.data}}({{.word}}=)' - - fieldName: log.irrelevant - pattern: '{{.greedy}}' - source: log.cefOrLeefMsgAll - - - grok: - patterns: - - fieldName: log.irrelevant - pattern: '{{.data}}(panOSDataSourceType=)' - - fieldName: log.panOSDataSourceType - pattern: '{{.data}}({{.word}}=)' - - fieldName: log.irrelevant - pattern: '{{.greedy}}' - source: log.cefOrLeefMsgAll - - - grok: - patterns: - - fieldName: log.irrelevant - pattern: '{{.data}}(panOSDesc=)' - - fieldName: log.panOSDesc - pattern: '{{.data}}({{.word}}=)' - - fieldName: log.irrelevant - pattern: '{{.greedy}}' - source: log.cefOrLeefMsgAll - - - grok: - patterns: - - fieldName: log.irrelevant - pattern: '{{.data}}(panOSDescription=)' - - fieldName: log.panOSDescription - pattern: '{{.data}}({{.word}}=)' - - fieldName: log.irrelevant - pattern: '{{.greedy}}' - source: log.cefOrLeefMsgAll - - - grok: - patterns: - - fieldName: log.irrelevant - pattern: '{{.data}}(panOSDestinationDeviceCategory=)' - - fieldName: log.panOSDestinationDeviceCategory - pattern: '{{.data}}({{.word}}=)' - - fieldName: log.irrelevant - pattern: '{{.greedy}}' - source: log.cefOrLeefMsgAll - - - grok: - patterns: - - fieldName: log.irrelevant - pattern: '{{.data}}(panOSDestinationDeviceHost=)' - - fieldName: log.panOSDestinationDeviceHost - pattern: '{{.data}}({{.word}}=)' - - fieldName: log.irrelevant - pattern: '{{.greedy}}' - source: log.cefOrLeefMsgAll - - - grok: - patterns: - - fieldName: log.irrelevant - pattern: '{{.data}}(panOSDestinationDeviceMac=)' - - fieldName: log.panOSDestinationDeviceMac - pattern: '{{.data}}({{.word}}=)' - - fieldName: log.irrelevant - pattern: '{{.greedy}}' - source: log.cefOrLeefMsgAll - - - grok: - patterns: - - fieldName: log.irrelevant - pattern: '{{.data}}(panOSDestinationDeviceModel=)' - - fieldName: log.panOSDestinationDeviceModel - pattern: '{{.data}}({{.word}}=)' - - fieldName: log.irrelevant - pattern: '{{.greedy}}' - source: log.cefOrLeefMsgAll - - - grok: - patterns: - - fieldName: log.irrelevant - pattern: '{{.data}}(panOSDestinationDeviceOSFamily=)' - - fieldName: log.panOSDestinationDeviceOSFamily - pattern: '{{.data}}({{.word}}=)' - - fieldName: log.irrelevant - pattern: '{{.greedy}}' - source: log.cefOrLeefMsgAll - - - grok: - patterns: - - fieldName: log.irrelevant - pattern: '{{.data}}(panOSDestinationDeviceOSVersion=)' - - fieldName: log.panOSDestinationDeviceOSVersion - pattern: '{{.data}}({{.word}}=)' - - fieldName: log.irrelevant - pattern: '{{.greedy}}' - source: log.cefOrLeefMsgAll - - - grok: - patterns: - - fieldName: log.irrelevant - pattern: '{{.data}}(panOSDestinationDeviceProfile=)' - - fieldName: log.panOSDestinationDeviceProfile - pattern: '{{.data}}({{.word}}=)' - - fieldName: log.irrelevant - pattern: '{{.greedy}}' - source: log.cefOrLeefMsgAll - - - grok: - patterns: - - fieldName: log.irrelevant - pattern: '{{.data}}(panOSDestinationDeviceVendor=)' - - fieldName: log.panOSDestinationDeviceVendor - pattern: '{{.data}}({{.word}}=)' - - fieldName: log.irrelevant - pattern: '{{.greedy}}' - source: log.cefOrLeefMsgAll - - - grok: - patterns: - - fieldName: log.irrelevant - pattern: '{{.data}}(panOSDestinationDynamicAddressGroup=)' - - fieldName: log.panOSDestinationDynamicAddressGroup - pattern: '{{.data}}({{.word}}=)' - - fieldName: log.irrelevant - pattern: '{{.greedy}}' - source: log.cefOrLeefMsgAll - - - grok: - patterns: - - fieldName: log.irrelevant - pattern: '{{.data}}(panOSDestinationEDL=)' - - fieldName: log.panOSDestinationEDL - pattern: '{{.data}}({{.word}}=)' - - fieldName: log.irrelevant - pattern: '{{.greedy}}' - source: log.cefOrLeefMsgAll - - - grok: - patterns: - - fieldName: log.irrelevant - pattern: '{{.data}}(panOSDestinationUUID=)' - - fieldName: log.panOSDestinationUUID - pattern: '{{.data}}({{.word}}=)' - - fieldName: log.irrelevant - pattern: '{{.greedy}}' - source: log.cefOrLeefMsgAll - - - grok: - patterns: - - fieldName: log.irrelevant - pattern: '{{.data}}(panOSDeviceSN=)' - - fieldName: log.panOSDeviceSN - pattern: '{{.data}}({{.word}}=)' - - fieldName: log.irrelevant - pattern: '{{.greedy}}' - source: log.cefOrLeefMsgAll - - - grok: - patterns: - - fieldName: log.irrelevant - pattern: '{{.data}}(panOSDGl1=)' - - fieldName: log.panOSDGl1 - pattern: '{{.data}}({{.word}}=)' - - fieldName: log.irrelevant - pattern: '{{.greedy}}' - source: log.cefOrLeefMsgAll - - - grok: - patterns: - - fieldName: log.irrelevant - pattern: '{{.data}}(panOSDGl2=)' - - fieldName: log.panOSDGl2 - pattern: '{{.data}}({{.word}}=)' - - fieldName: log.irrelevant - pattern: '{{.greedy}}' - source: log.cefOrLeefMsgAll - - - grok: - patterns: - - fieldName: log.irrelevant - pattern: '{{.data}}(panOSDGl3=)' - - fieldName: log.panOSDGl3 - pattern: '{{.data}}({{.word}}=)' - - fieldName: log.irrelevant - pattern: '{{.greedy}}' - source: log.cefOrLeefMsgAll - - - grok: - patterns: - - fieldName: log.irrelevant - pattern: '{{.data}}(panOSDGl4=)' - - fieldName: log.panOSDGl4 - pattern: '{{.data}}({{.word}}=)' - - fieldName: log.irrelevant - pattern: '{{.greedy}}' - source: log.cefOrLeefMsgAll - - - grok: - patterns: - - fieldName: log.irrelevant - pattern: '{{.data}}(panOSDiameterApp=)' - - fieldName: log.panOSDiameterApp - pattern: '{{.data}}({{.word}}=)' - - fieldName: log.irrelevant - pattern: '{{.greedy}}' - source: log.cefOrLeefMsgAll - - - grok: - patterns: - - fieldName: log.irrelevant - pattern: '{{.data}}(panOSDiameterAVPCode=)' - - fieldName: log.panOSDiameterAVPCode - pattern: '{{.data}}({{.word}}=)' - - fieldName: log.irrelevant - pattern: '{{.greedy}}' - source: log.cefOrLeefMsgAll - - - grok: - patterns: - - fieldName: log.irrelevant - pattern: '{{.data}}(panOSDiameterCmdCode=)' - - fieldName: log.panOSDiameterCmdCode - pattern: '{{.data}}({{.word}}=)' - - fieldName: log.irrelevant - pattern: '{{.greedy}}' - source: log.cefOrLeefMsgAll - - - grok: - patterns: - - fieldName: log.irrelevant - pattern: '{{.data}}(panOSDstUUID=)' - - fieldName: log.panOSDstUUID - pattern: '{{.data}}({{.word}}=)' - - fieldName: log.irrelevant - pattern: '{{.greedy}}' - source: log.cefOrLeefMsgAll - - - grok: - patterns: - - fieldName: log.irrelevant - pattern: '{{.data}}(panOSEllipticCurve=)' - - fieldName: log.panOSEllipticCurve - pattern: '{{.data}}({{.word}}=)' - - fieldName: log.irrelevant - pattern: '{{.greedy}}' - source: log.cefOrLeefMsgAll - - - grok: - patterns: - - fieldName: log.irrelevant - pattern: '{{.data}}(panOSEndpointDeviceName=)' - - fieldName: log.panOSEndpointDeviceName - pattern: '{{.data}}({{.word}}=)' - - fieldName: log.irrelevant - pattern: '{{.greedy}}' - source: log.cefOrLeefMsgAll - - - grok: - patterns: - - fieldName: log.irrelevant - pattern: '{{.data}}(panOSEndpointMac=)' - - fieldName: log.panOSEndpointMac - pattern: '{{.data}}({{.word}}=)' - - fieldName: log.irrelevant - pattern: '{{.greedy}}' - source: log.cefOrLeefMsgAll - - - grok: - patterns: - - fieldName: log.irrelevant - pattern: '{{.data}}(panOSEndpointOSType=)' - - fieldName: log.panOSEndpointOSType - pattern: '{{.data}}({{.word}}=)' - - fieldName: log.irrelevant - pattern: '{{.greedy}}' - source: log.cefOrLeefMsgAll - - - grok: - patterns: - - fieldName: log.irrelevant - pattern: '{{.data}}(panOSEndpointOSVersion=)' - - fieldName: log.panOSEndpointOSVersion - pattern: '{{.data}}({{.word}}=)' - - fieldName: log.irrelevant - pattern: '{{.greedy}}' - source: log.cefOrLeefMsgAll - - - grok: - patterns: - - fieldName: log.irrelevant - pattern: '{{.data}}(panOSEndpointSerialNumber=)' - - fieldName: log.panOSEndpointSerialNumber - pattern: '{{.data}}({{.word}}=)' - - fieldName: log.irrelevant - pattern: '{{.greedy}}' - source: log.cefOrLeefMsgAll - - - grok: - patterns: - - fieldName: log.irrelevant - pattern: '{{.data}}(panOSEndUserIP=)' - - fieldName: log.panOSEndUserIP - pattern: '{{.data}}({{.word}}=)' - - fieldName: log.irrelevant - pattern: '{{.greedy}}' - source: log.cefOrLeefMsgAll - - - grok: - patterns: - - fieldName: log.irrelevant - pattern: '{{.data}}(panOSErrorIndex=)' - - fieldName: log.panOSErrorIndex - pattern: '{{.data}}({{.word}}=)' - - fieldName: log.irrelevant - pattern: '{{.greedy}}' - source: log.cefOrLeefMsgAll - - - grok: - patterns: - - fieldName: log.irrelevant - pattern: '{{.data}}(panOSErrorMessage=)' - - fieldName: log.panOSErrorMessage - pattern: '{{.data}}({{.word}}=)' - - fieldName: log.irrelevant - pattern: '{{.greedy}}' - source: log.cefOrLeefMsgAll - - - grok: - patterns: - - fieldName: log.irrelevant - pattern: '{{.data}}(panOSEventID=)' - - fieldName: log.panOSEventID - pattern: '{{.data}}({{.word}}=)' - - fieldName: log.irrelevant - pattern: '{{.greedy}}' - source: log.cefOrLeefMsgAll - - - grok: - patterns: - - fieldName: log.irrelevant - pattern: '{{.data}}(panOSEventStatus=)' - - fieldName: log.panOSEventStatus - pattern: '{{.data}}({{.word}}=)' - - fieldName: log.irrelevant - pattern: '{{.greedy}}' - source: log.cefOrLeefMsgAll - - - grok: - patterns: - - fieldName: log.irrelevant - pattern: '{{.data}}(panOSFingerprint=)' - - fieldName: log.panOSFingerprint - pattern: '{{.data}}({{.word}}=)' - - fieldName: log.irrelevant - pattern: '{{.greedy}}' - source: log.cefOrLeefMsgAll - - - grok: - patterns: - - fieldName: log.irrelevant - pattern: '{{.data}}(panOSFirewallToServer=)' - - fieldName: log.panOSFirewallToServer - pattern: '{{.data}}({{.word}}=)' - - fieldName: log.irrelevant - pattern: '{{.greedy}}' - source: log.cefOrLeefMsgAll - - - grok: - patterns: - - fieldName: log.irrelevant - pattern: '{{.data}}(panOSFWDeviceGroup=)' - - fieldName: log.panOSFWDeviceGroup - pattern: '{{.data}}({{.word}}=)' - - fieldName: log.irrelevant - pattern: '{{.greedy}}' - source: log.cefOrLeefMsgAll - - - grok: - patterns: - - fieldName: log.irrelevant - pattern: '{{.data}}(panOSGateway=)' - - fieldName: log.panOSGateway - pattern: '{{.data}}({{.word}}=)' - - fieldName: log.irrelevant - pattern: '{{.greedy}}' - source: log.cefOrLeefMsgAll - - - grok: - patterns: - - fieldName: log.irrelevant - pattern: '{{.data}}(panOSGatewayPriority=)' - - fieldName: log.panOSGatewayPriority - pattern: '{{.data}}({{.word}}=)' - - fieldName: log.irrelevant - pattern: '{{.greedy}}' - source: log.cefOrLeefMsgAll - - - grok: - patterns: - - fieldName: log.irrelevant - pattern: '{{.data}}(panOSGatewaySelectionType=)' - - fieldName: log.panOSGatewaySelectionType - pattern: '{{.data}}({{.word}}=)' - - fieldName: log.irrelevant - pattern: '{{.greedy}}' - source: log.cefOrLeefMsgAll - - - grok: - patterns: - - fieldName: log.irrelevant - pattern: '{{.data}}(panOSGlobalProtectClientVersion=)' - - fieldName: log.panOSGlobalProtectClientVersion - pattern: '{{.data}}({{.word}}=)' - - fieldName: log.irrelevant - pattern: '{{.greedy}}' - source: log.cefOrLeefMsgAll - - - grok: - patterns: - - fieldName: log.irrelevant - pattern: '{{.data}}(panOSGPGatewayLocation=)' - - fieldName: log.panOSGPGatewayLocation - pattern: '{{.data}}({{.word}}=)' - - fieldName: log.irrelevant - pattern: '{{.greedy}}' - source: log.cefOrLeefMsgAll - - - grok: - patterns: - - fieldName: log.irrelevant - pattern: '{{.data}}(panOSGTPCause=)' - - fieldName: log.panOSGTPCause - pattern: '{{.data}}({{.word}}=)' - - fieldName: log.irrelevant - pattern: '{{.greedy}}' - source: log.cefOrLeefMsgAll - - - grok: - patterns: - - fieldName: log.irrelevant - pattern: '{{.data}}(panOSGTPEventCode=)' - - fieldName: log.panOSGTPEventCode - pattern: '{{.data}}({{.word}}=)' - - fieldName: log.irrelevant - pattern: '{{.greedy}}' - source: log.cefOrLeefMsgAll - - - grok: - patterns: - - fieldName: log.irrelevant - pattern: '{{.data}}(panOSGTPEventType=)' - - fieldName: log.panOSGTPEventType - pattern: '{{.data}}({{.word}}=)' - - fieldName: log.irrelevant - pattern: '{{.greedy}}' - source: log.cefOrLeefMsgAll - - - grok: - patterns: - - fieldName: log.irrelevant - pattern: '{{.data}}(panOSGTPInterface=)' - - fieldName: log.panOSGTPInterface - pattern: '{{.data}}({{.word}}=)' - - fieldName: log.irrelevant - pattern: '{{.greedy}}' - source: log.cefOrLeefMsgAll - - - grok: - patterns: - - fieldName: log.irrelevant - pattern: '{{.data}}(panOSGTPMsgType=)' - - fieldName: log.panOSGTPMsgType - pattern: '{{.data}}({{.word}}=)' - - fieldName: log.irrelevant - pattern: '{{.greedy}}' - source: log.cefOrLeefMsgAll - - - grok: - patterns: - - fieldName: log.irrelevant - pattern: '{{.data}}(panOSHostID=)' - - fieldName: log.panOSHostID - pattern: '{{.data}}({{.word}}=)' - - fieldName: log.irrelevant - pattern: '{{.greedy}}' - source: log.cefOrLeefMsgAll - - - grok: - patterns: - - fieldName: log.irrelevant - pattern: '{{.data}}(panOSHTTP2Con=)' - - fieldName: log.panOSHTTP2Con - pattern: '{{.data}}({{.word}}=)' - - fieldName: log.irrelevant - pattern: '{{.greedy}}' - source: log.cefOrLeefMsgAll - - - grok: - patterns: - - fieldName: log.irrelevant - pattern: '{{.data}}(panOSHTTPHeader=)' - - fieldName: log.panOSHTTPHeader - pattern: '{{.data}}({{.word}}=)' - - fieldName: log.irrelevant - pattern: '{{.greedy}}' - source: log.cefOrLeefMsgAll - - - grok: - patterns: - - fieldName: log.irrelevant - pattern: '{{.data}}(panOSHTTPUserAgent=)' - - fieldName: log.panOSHTTPUserAgent - pattern: '{{.data}}({{.word}}=)' - - fieldName: log.irrelevant - pattern: '{{.greedy}}' - source: log.cefOrLeefMsgAll - - - grok: - patterns: - - fieldName: log.irrelevant - pattern: '{{.data}}(panOSIssuerCommonName=)' - - fieldName: log.panOSIssuerCommonName - pattern: '{{.data}}({{.word}}=)' - - fieldName: log.irrelevant - pattern: '{{.greedy}}' - source: log.cefOrLeefMsgAll - - - grok: - patterns: - - fieldName: log.irrelevant - pattern: '{{.data}}(panOSIssuerNameLength=)' - - fieldName: log.panOSIssuerNameLength - pattern: '{{.data}}({{.word}}=)' - - fieldName: log.irrelevant - pattern: '{{.greedy}}' - source: log.cefOrLeefMsgAll - - - grok: - patterns: - - fieldName: log.irrelevant - pattern: '{{.data}}(panOSLoginDuration=)' - - fieldName: log.panOSLoginDuration - pattern: '{{.data}}({{.word}}=)' - - fieldName: log.irrelevant - pattern: '{{.greedy}}' - source: log.cefOrLeefMsgAll - - - grok: - patterns: - - fieldName: log.irrelevant - pattern: '{{.data}}(panOSLogTimeStamp=)' - - fieldName: log.panOSLogTimeStamp - pattern: '{{.data}}({{.word}}=)' - - fieldName: log.irrelevant - pattern: '{{.greedy}}' - source: log.cefOrLeefMsgAll - - - grok: - patterns: - - fieldName: log.irrelevant - pattern: '{{.data}}(panOSLogTypeSeqNo=)' - - fieldName: log.panOSLogTypeSeqNo - pattern: '{{.data}}({{.word}}=)' - - fieldName: log.irrelevant - pattern: '{{.greedy}}' - source: log.cefOrLeefMsgAll - - - grok: - patterns: - - fieldName: log.irrelevant - pattern: '{{.data}}(panOSMonitorTag=)' - - fieldName: log.panOSMonitorTag - pattern: '{{.data}}({{.word}}=)' - - fieldName: log.irrelevant - pattern: '{{.greedy}}' - source: log.cefOrLeefMsgAll - - - grok: - patterns: - - fieldName: log.irrelevant - pattern: '{{.data}}(panOSMSISDN=)' - - fieldName: log.panOSMSISDN - pattern: '{{.data}}({{.word}}=)' - - fieldName: log.irrelevant - pattern: '{{.greedy}}' - source: log.cefOrLeefMsgAll - - - grok: - patterns: - - fieldName: log.irrelevant - pattern: '{{.data}}(panOSOpCode=)' - - fieldName: log.panOSOpCode - pattern: '{{.data}}({{.word}}=)' - - fieldName: log.irrelevant - pattern: '{{.greedy}}' - source: log.cefOrLeefMsgAll - - - grok: - patterns: - - fieldName: log.irrelevant - pattern: '{{.data}}(panOSPacketsReceived=)' - - fieldName: log.panOSPacketsReceived - pattern: '{{.data}}({{.word}}=)' - - fieldName: log.irrelevant - pattern: '{{.greedy}}' - source: log.cefOrLeefMsgAll - - - grok: - patterns: - - fieldName: log.irrelevant - pattern: '{{.data}}(panOSPacketsSent=)' - - fieldName: log.panOSPacketsSent - pattern: '{{.data}}({{.word}}=)' - - fieldName: log.irrelevant - pattern: '{{.greedy}}' - source: log.cefOrLeefMsgAll - - - grok: - patterns: - - fieldName: log.irrelevant - pattern: '{{.data}}(panOSParentSessionID=)' - - fieldName: log.panOSParentSessionID - pattern: '{{.data}}({{.word}}=)' - - fieldName: log.irrelevant - pattern: '{{.greedy}}' - source: log.cefOrLeefMsgAll - - - grok: - patterns: - - fieldName: log.irrelevant - pattern: '{{.data}}(panOSParentStartTime=)' - - fieldName: log.panOSParentStartTime - pattern: '{{.data}}({{.word}}=)' - - fieldName: log.irrelevant - pattern: '{{.greedy}}' - source: log.cefOrLeefMsgAll - - - grok: - patterns: - - fieldName: log.irrelevant - pattern: '{{.data}}(panOSPayloadProtID=)' - - fieldName: log.panOSPayloadProtID - pattern: '{{.data}}({{.word}}=)' - - fieldName: log.irrelevant - pattern: '{{.greedy}}' - source: log.cefOrLeefMsgAll - - - grok: - patterns: - - fieldName: log.irrelevant - pattern: '{{.data}}(panOSPcapID=)' - - fieldName: log.panOSPcapID - pattern: '{{.data}}({{.word}}=)' - - fieldName: log.irrelevant - pattern: '{{.greedy}}' - source: log.cefOrLeefMsgAll - - - grok: - patterns: - - fieldName: log.irrelevant - pattern: '{{.data}}(panOSPolicyAuditComment=)' - - fieldName: log.panOSPolicyAuditComment - pattern: '{{.data}}({{.word}}=)' - - fieldName: log.irrelevant - pattern: '{{.greedy}}' - source: log.cefOrLeefMsgAll - - - grok: - patterns: - - fieldName: log.irrelevant - pattern: '{{.data}}(panOSPolicyName=)' - - fieldName: log.panOSPolicyName - pattern: '{{.data}}({{.word}}=)' - - fieldName: log.irrelevant - pattern: '{{.greedy}}' - source: log.cefOrLeefMsgAll - - - grok: - patterns: - - fieldName: log.irrelevant - pattern: '{{.data}}(panOSPortal=)' - - fieldName: log.panOSPortal - pattern: '{{.data}}({{.word}}=)' - - fieldName: log.irrelevant - pattern: '{{.greedy}}' - source: log.cefOrLeefMsgAll - - - grok: - patterns: - - fieldName: log.irrelevant - pattern: '{{.data}}(panOSPPID=)' - - fieldName: log.panOSPPID - pattern: '{{.data}}({{.word}}=)' - - fieldName: log.irrelevant - pattern: '{{.greedy}}' - source: log.cefOrLeefMsgAll - - - grok: - patterns: - - fieldName: log.irrelevant - pattern: '{{.data}}(panOSPrivateIPv4=)' - - fieldName: log.panOSPrivateIPv4 - pattern: '{{.data}}({{.word}}=)' - - fieldName: log.irrelevant - pattern: '{{.greedy}}' - source: log.cefOrLeefMsgAll - - - grok: - patterns: - - fieldName: log.irrelevant - pattern: '{{.data}}(panOSPrivateIPv6=)' - - fieldName: log.panOSPrivateIPv6 - pattern: '{{.data}}({{.word}}=)' - - fieldName: log.irrelevant - pattern: '{{.greedy}}' - source: log.cefOrLeefMsgAll - - - grok: - patterns: - - fieldName: log.irrelevant - pattern: '{{.data}}(panOSProxyType=)' - - fieldName: log.panOSProxyType - pattern: '{{.data}}({{.word}}=)' - - fieldName: log.irrelevant - pattern: '{{.greedy}}' - source: log.cefOrLeefMsgAll - - - grok: - patterns: - - fieldName: log.irrelevant - pattern: '{{.data}}(panOSPublicIPv4=)' - - fieldName: log.panOSPublicIPv4 - pattern: '{{.data}}({{.word}}=)' - - fieldName: log.irrelevant - pattern: '{{.greedy}}' - source: log.cefOrLeefMsgAll - - - grok: - patterns: - - fieldName: log.irrelevant - pattern: '{{.data}}(panOSPublicIPv6=)' - - fieldName: log.panOSPublicIPv6 - pattern: '{{.data}}({{.word}}=)' - - fieldName: log.irrelevant - pattern: '{{.greedy}}' - source: log.cefOrLeefMsgAll - - - grok: - patterns: - - fieldName: log.irrelevant - pattern: '{{.data}}(panOSQuarantineReason=)' - - fieldName: log.panOSQuarantineReason - pattern: '{{.data}}({{.word}}=)' - - fieldName: log.irrelevant - pattern: '{{.greedy}}' - source: log.cefOrLeefMsgAll - - - grok: - patterns: - - fieldName: log.irrelevant - pattern: '{{.data}}(panOSRadioTech=)' - - fieldName: log.panOSRadioTech - pattern: '{{.data}}({{.word}}=)' - - fieldName: log.irrelevant - pattern: '{{.greedy}}' - source: log.cefOrLeefMsgAll - - - grok: - patterns: - - fieldName: log.irrelevant - pattern: '{{.data}}(panOSReferer=)' - - fieldName: log.panOSReferer - pattern: '{{.data}}({{.word}}=)' - - fieldName: log.irrelevant - pattern: '{{.greedy}}' - source: log.cefOrLeefMsgAll - - - grok: - patterns: - - fieldName: log.irrelevant - pattern: '{{.data}}(panOSRmtUserID=)' - - fieldName: log.panOSRmtUserID - pattern: '{{.data}}({{.word}}=)' - - fieldName: log.irrelevant - pattern: '{{.greedy}}' - source: log.cefOrLeefMsgAll - - - grok: - patterns: - - fieldName: log.irrelevant - pattern: '{{.data}}(panOSRmtUserIP=)' - - fieldName: log.panOSRmtUserIP - pattern: '{{.data}}({{.word}}=)' - - fieldName: log.irrelevant - pattern: '{{.greedy}}' - source: log.cefOrLeefMsgAll - - - grok: - patterns: - - fieldName: log.irrelevant - pattern: '{{.data}}(panOSRootCNLength=)' - - fieldName: log.panOSRootCNLength - pattern: '{{.data}}({{.word}}=)' - - fieldName: log.irrelevant - pattern: '{{.greedy}}' - source: log.cefOrLeefMsgAll - - - grok: - patterns: - - fieldName: log.irrelevant - pattern: '{{.data}}(panOSRootCommonName=)' - - fieldName: log.panOSRootCommonName - pattern: '{{.data}}({{.word}}=)' - - fieldName: log.irrelevant - pattern: '{{.greedy}}' - source: log.cefOrLeefMsgAll - - - grok: - patterns: - - fieldName: log.irrelevant - pattern: '{{.data}}(panOSRootStatus=)' - - fieldName: log.panOSRootStatus - pattern: '{{.data}}({{.word}}=)' - - fieldName: log.irrelevant - pattern: '{{.greedy}}' - source: log.cefOrLeefMsgAll - - - grok: - patterns: - - fieldName: log.irrelevant - pattern: '{{.data}}(panOSRuleUUID=)' - - fieldName: log.panOSRuleUUID - pattern: '{{.data}}({{.word}}=)' - - fieldName: log.irrelevant - pattern: '{{.greedy}}' - source: log.cefOrLeefMsgAll - - - grok: - patterns: - - fieldName: log.irrelevant - pattern: '{{.data}}(panOSSCCPCallingGT=)' - - fieldName: log.panOSSCCPCallingGT - pattern: '{{.data}}({{.word}}=)' - - fieldName: log.irrelevant - pattern: '{{.greedy}}' - source: log.cefOrLeefMsgAll - - - grok: - patterns: - - fieldName: log.irrelevant - pattern: '{{.data}}(panOSSCCPCallingPartySSN=)' - - fieldName: log.panOSSCCPCallingPartySSN - pattern: '{{.data}}({{.word}}=)' - - fieldName: log.irrelevant - pattern: '{{.greedy}}' - source: log.cefOrLeefMsgAll - - - grok: - patterns: - - fieldName: log.irrelevant - pattern: '{{.data}}(panOSSCTPAssocEndReason=)' - - fieldName: log.panOSSCTPAssocEndReason - pattern: '{{.data}}({{.word}}=)' - - fieldName: log.irrelevant - pattern: '{{.greedy}}' - source: log.cefOrLeefMsgAll - - - grok: - patterns: - - fieldName: log.irrelevant - pattern: '{{.data}}(panOSSCTPAssocID=)' - - fieldName: log.panOSSCTPAssocID - pattern: '{{.data}}({{.word}}=)' - - fieldName: log.irrelevant - pattern: '{{.greedy}}' - source: log.cefOrLeefMsgAll - - - grok: - patterns: - - fieldName: log.irrelevant - pattern: '{{.data}}(panOSSCTPCauseCode=)' - - fieldName: log.panOSSCTPCauseCode - pattern: '{{.data}}({{.word}}=)' - - fieldName: log.irrelevant - pattern: '{{.greedy}}' - source: log.cefOrLeefMsgAll - - - grok: - patterns: - - fieldName: log.irrelevant - pattern: '{{.data}}(panOSSCTPChunkRcv=)' - - fieldName: log.panOSSCTPChunkRcv - pattern: '{{.data}}({{.word}}=)' - - fieldName: log.irrelevant - pattern: '{{.greedy}}' - source: log.cefOrLeefMsgAll - - - grok: - patterns: - - fieldName: log.irrelevant - pattern: '{{.data}}(panOSSCTPChunks=)' - - fieldName: log.panOSSCTPChunks - pattern: '{{.data}}({{.word}}=)' - - fieldName: log.irrelevant - pattern: '{{.greedy}}' - source: log.cefOrLeefMsgAll - - - grok: - patterns: - - fieldName: log.irrelevant - pattern: '{{.data}}(panOSSCTPChunkSent=)' - - fieldName: log.panOSSCTPChunkSent - pattern: '{{.data}}({{.word}}=)' - - fieldName: log.irrelevant - pattern: '{{.greedy}}' - source: log.cefOrLeefMsgAll - - - grok: - patterns: - - fieldName: log.irrelevant - pattern: '{{.data}}(panOSSCTPChunksRcv=)' - - fieldName: log.panOSSCTPChunksRcv - pattern: '{{.data}}({{.word}}=)' - - fieldName: log.irrelevant - pattern: '{{.greedy}}' - source: log.cefOrLeefMsgAll - - - grok: - patterns: - - fieldName: log.irrelevant - pattern: '{{.data}}(panOSSCTPFilter=)' - - fieldName: log.panOSSCTPFilter - pattern: '{{.data}}({{.word}}=)' - - fieldName: log.irrelevant - pattern: '{{.greedy}}' - source: log.cefOrLeefMsgAll - - - grok: - patterns: - - fieldName: log.irrelevant - pattern: '{{.data}}(panOSSCTPStreamID=)' - - fieldName: log.panOSSCTPStreamID - pattern: '{{.data}}({{.word}}=)' - - fieldName: log.irrelevant - pattern: '{{.greedy}}' - source: log.cefOrLeefMsgAll - - - grok: - patterns: - - fieldName: log.irrelevant - pattern: '{{.data}}(panOSSCTPVerTag1=)' - - fieldName: log.panOSSCTPVerTag1 - pattern: '{{.data}}({{.word}}=)' - - fieldName: log.irrelevant - pattern: '{{.greedy}}' - source: log.cefOrLeefMsgAll - - - grok: - patterns: - - fieldName: log.irrelevant - pattern: '{{.data}}(panOSSCTPVerTag2=)' - - fieldName: log.panOSSCTPVerTag2 - pattern: '{{.data}}({{.word}}=)' - - fieldName: log.irrelevant - pattern: '{{.greedy}}' - source: log.cefOrLeefMsgAll - - - grok: - patterns: - - fieldName: log.irrelevant - pattern: '{{.data}}(panOSSequenceNo=)' - - fieldName: log.panOSSequenceNo - pattern: '{{.data}}({{.word}}=)' - - fieldName: log.irrelevant - pattern: '{{.greedy}}' - source: log.cefOrLeefMsgAll - - - grok: - patterns: - - fieldName: log.irrelevant - pattern: '{{.data}}(panOSServerNameIndication=)' - - fieldName: log.panOSServerNameIndication - pattern: '{{.data}}({{.word}}=)' - - fieldName: log.irrelevant - pattern: '{{.greedy}}' - source: log.cefOrLeefMsgAll - - - grok: - patterns: - - fieldName: log.irrelevant - pattern: '{{.data}}(panOSServingCntryMCC=)' - - fieldName: log.panOSServingCntryMCC - pattern: '{{.data}}({{.word}}=)' - - fieldName: log.irrelevant - pattern: '{{.greedy}}' - source: log.cefOrLeefMsgAll - - - grok: - patterns: - - fieldName: log.irrelevant - pattern: '{{.data}}(panOSServingNetMNC=)' - - fieldName: log.panOSServingNetMNC - pattern: '{{.data}}({{.word}}=)' - - fieldName: log.irrelevant - pattern: '{{.greedy}}' - source: log.cefOrLeefMsgAll - - - grok: - patterns: - - fieldName: log.irrelevant - pattern: '{{.data}}(panOSSeverity=)' - - fieldName: log.panOSSeverity - pattern: '{{.data}}({{.word}}=)' - - fieldName: log.irrelevant - pattern: '{{.greedy}}' - source: log.cefOrLeefMsgAll - - - grok: - patterns: - - fieldName: log.irrelevant - pattern: '{{.data}}(panOSSNILength=)' - - fieldName: log.panOSSNILength - pattern: '{{.data}}({{.word}}=)' - - fieldName: log.irrelevant - pattern: '{{.greedy}}' - source: log.cefOrLeefMsgAll - - - grok: - patterns: - - fieldName: log.irrelevant - pattern: '{{.data}}(panOSSourceDeviceCategory=)' - - fieldName: log.panOSSourceDeviceCategory - pattern: '{{.data}}({{.word}}=)' - - fieldName: log.irrelevant - pattern: '{{.greedy}}' - source: log.cefOrLeefMsgAll - - - grok: - patterns: - - fieldName: log.irrelevant - pattern: '{{.data}}(panOSSourceDeviceHost=)' - - fieldName: log.panOSSourceDeviceHost - pattern: '{{.data}}({{.word}}=)' - - fieldName: log.irrelevant - pattern: '{{.greedy}}' - source: log.cefOrLeefMsgAll - - - grok: - patterns: - - fieldName: log.irrelevant - pattern: '{{.data}}(panOSSourceDeviceMac=)' - - fieldName: log.panOSSourceDeviceMac - pattern: '{{.data}}({{.word}}=)' - - fieldName: log.irrelevant - pattern: '{{.greedy}}' - source: log.cefOrLeefMsgAll - - - grok: - patterns: - - fieldName: log.irrelevant - pattern: '{{.data}}(panOSSourceDeviceModel=)' - - fieldName: log.panOSSourceDeviceModel - pattern: '{{.data}}({{.word}}=)' - - fieldName: log.irrelevant - pattern: '{{.greedy}}' - source: log.cefOrLeefMsgAll - - - grok: - patterns: - - fieldName: log.irrelevant - pattern: '{{.data}}(panOSSourceDeviceOSFamily=)' - - fieldName: log.panOSSourceDeviceOSFamily - pattern: '{{.data}}({{.word}}=)' - - fieldName: log.irrelevant - pattern: '{{.greedy}}' - source: log.cefOrLeefMsgAll - - - grok: - patterns: - - fieldName: log.irrelevant - pattern: '{{.data}}(panOSSourceDeviceOSVersion=)' - - fieldName: log.panOSSourceDeviceOSVersion - pattern: '{{.data}}({{.word}}=)' - - fieldName: log.irrelevant - pattern: '{{.greedy}}' - source: log.cefOrLeefMsgAll - - - grok: - patterns: - - fieldName: log.irrelevant - pattern: '{{.data}}(panOSSourceDeviceProfile=)' - - fieldName: log.panOSSourceDeviceProfile - pattern: '{{.data}}({{.word}}=)' - - fieldName: log.irrelevant - pattern: '{{.greedy}}' - source: log.cefOrLeefMsgAll - - - grok: - patterns: - - fieldName: log.irrelevant - pattern: '{{.data}}(panOSSourceDeviceVendor=)' - - fieldName: log.panOSSourceDeviceVendor - pattern: '{{.data}}({{.word}}=)' - - fieldName: log.irrelevant - pattern: '{{.greedy}}' - source: log.cefOrLeefMsgAll - - - grok: - patterns: - - fieldName: log.irrelevant - pattern: '{{.data}}(panOSSourceDynamicAddressGroup=)' - - fieldName: log.panOSSourceDynamicAddressGroup - pattern: '{{.data}}({{.word}}=)' - - fieldName: log.irrelevant - pattern: '{{.greedy}}' - source: log.cefOrLeefMsgAll - - - grok: - patterns: - - fieldName: log.irrelevant - pattern: '{{.data}}(panOSSourceEDL=)' - - fieldName: log.panOSSourceEDL - pattern: '{{.data}}({{.word}}=)' - - fieldName: log.irrelevant - pattern: '{{.greedy}}' - source: log.cefOrLeefMsgAll - - - grok: - patterns: - - fieldName: log.irrelevant - pattern: '{{.data}}(panOSSourceHostname=)' - - fieldName: log.panOSSourceHostname - pattern: '{{.data}}({{.word}}=)' - - fieldName: log.irrelevant - pattern: '{{.greedy}}' - source: log.cefOrLeefMsgAll - - - grok: - patterns: - - fieldName: log.irrelevant - pattern: '{{.data}}(panOSSourceMac=)' - - fieldName: log.panOSSourceMac - pattern: '{{.data}}({{.word}}=)' - - fieldName: log.irrelevant - pattern: '{{.greedy}}' - source: log.cefOrLeefMsgAll - - - grok: - patterns: - - fieldName: log.irrelevant - pattern: '{{.data}}(panOSSourceRegion=)' - - fieldName: log.panOSSourceRegion - pattern: '{{.data}}({{.word}}=)' - - fieldName: log.irrelevant - pattern: '{{.greedy}}' - source: log.cefOrLeefMsgAll - - - grok: - patterns: - - fieldName: log.irrelevant - pattern: '{{.data}}(panOSSourceUserName=)' - - fieldName: log.panOSSourceUserName - pattern: '{{.data}}({{.word}}=)' - - fieldName: log.irrelevant - pattern: '{{.greedy}}' - source: log.cefOrLeefMsgAll - - - grok: - patterns: - - fieldName: log.irrelevant - pattern: '{{.data}}(panOSSourceUUID=)' - - fieldName: log.panOSSourceUUID - pattern: '{{.data}}({{.word}}=)' - - fieldName: log.irrelevant - pattern: '{{.greedy}}' - source: log.cefOrLeefMsgAll - - - grok: - patterns: - - fieldName: log.irrelevant - pattern: '{{.data}}(panOSSrcUUID=)' - - fieldName: log.panOSSrcUUID - pattern: '{{.data}}({{.word}}=)' - - fieldName: log.irrelevant - pattern: '{{.greedy}}' - source: log.cefOrLeefMsgAll - - - grok: - patterns: - - fieldName: log.irrelevant - pattern: '{{.data}}(panOSSSLResponseTime=)' - - fieldName: log.panOSSSLResponseTime - pattern: '{{.data}}({{.word}}=)' - - fieldName: log.irrelevant - pattern: '{{.greedy}}' - source: log.cefOrLeefMsgAll - - - grok: - patterns: - - fieldName: log.irrelevant - pattern: '{{.data}}(panOSStage=)' - - fieldName: log.panOSStage - pattern: '{{.data}}({{.word}}=)' - - fieldName: log.irrelevant - pattern: '{{.greedy}}' - source: log.cefOrLeefMsgAll - - - grok: - patterns: - - fieldName: log.irrelevant - pattern: '{{.data}}(panOSTagName=)' - - fieldName: log.panOSTagName - pattern: '{{.data}}({{.word}}=)' - - fieldName: log.irrelevant - pattern: '{{.greedy}}' - source: log.cefOrLeefMsgAll - - - grok: - patterns: - - fieldName: log.irrelevant - pattern: '{{.data}}(panOSThreatCategory=)' - - fieldName: log.panOSThreatCategory - pattern: '{{.data}}({{.word}}=)' - - fieldName: log.irrelevant - pattern: '{{.greedy}}' - source: log.cefOrLeefMsgAll - - - grok: - patterns: - - fieldName: log.irrelevant - pattern: '{{.data}}(panOSTimeGeneratedHighResolution=)' - - fieldName: log.panOSTimeGeneratedHighResolution - pattern: '{{.data}}({{.word}}=)' - - fieldName: log.irrelevant - pattern: '{{.greedy}}' - source: log.cefOrLeefMsgAll - - - grok: - patterns: - - fieldName: log.irrelevant - pattern: '{{.data}}(panOSTimeNotAfter=)' - - fieldName: log.panOSTimeNotAfter - pattern: '{{.data}}({{.word}}=)' - - fieldName: log.irrelevant - pattern: '{{.greedy}}' - source: log.cefOrLeefMsgAll - - - grok: - patterns: - - fieldName: log.irrelevant - pattern: '{{.data}}(panOSTimeNotBefore=)' - - fieldName: log.panOSTimeNotBefore - pattern: '{{.data}}({{.word}}=)' - - fieldName: log.irrelevant - pattern: '{{.greedy}}' - source: log.cefOrLeefMsgAll - - - grok: - patterns: - - fieldName: log.irrelevant - pattern: '{{.data}}(panOSTimeout=)' - - fieldName: log.panOSTimeout - pattern: '{{.data}}({{.word}}=)' - - fieldName: log.irrelevant - pattern: '{{.greedy}}' - source: log.cefOrLeefMsgAll - - - grok: - patterns: - - fieldName: log.irrelevant - pattern: '{{.data}}(panOSTimeReceivedManagementPlane=)' - - fieldName: log.panOSTimeReceivedManagementPlane - pattern: '{{.data}}({{.word}}=)' - - fieldName: log.irrelevant - pattern: '{{.greedy}}' - source: log.cefOrLeefMsgAll - - - grok: - patterns: - - fieldName: log.irrelevant - pattern: '{{.data}}(panOSTLSAuth=)' - - fieldName: log.panOSTLSAuth - pattern: '{{.data}}({{.word}}=)' - - fieldName: log.irrelevant - pattern: '{{.greedy}}' - source: log.cefOrLeefMsgAll - - - grok: - patterns: - - fieldName: log.irrelevant - pattern: '{{.data}}(panOSTLSEncryptionAlgorithm=)' - - fieldName: log.panOSTLSEncryptionAlgorithm - pattern: '{{.data}}({{.word}}=)' - - fieldName: log.irrelevant - pattern: '{{.greedy}}' - source: log.cefOrLeefMsgAll - - - grok: - patterns: - - fieldName: log.irrelevant - pattern: '{{.data}}(panOSTLSKeyExchange=)' - - fieldName: log.panOSTLSKeyExchange - pattern: '{{.data}}({{.word}}=)' - - fieldName: log.irrelevant - pattern: '{{.greedy}}' - source: log.cefOrLeefMsgAll - - - grok: - patterns: - - fieldName: log.irrelevant - pattern: '{{.data}}(panOSTLSVersion=)' - - fieldName: log.panOSTLSVersion - pattern: '{{.data}}({{.word}}=)' - - fieldName: log.irrelevant - pattern: '{{.greedy}}' - source: log.cefOrLeefMsgAll - - - grok: - patterns: - - fieldName: log.irrelevant - pattern: '{{.data}}(panOSTrafficOriginRegion=)' - - fieldName: log.panOSTrafficOriginRegion - pattern: '{{.data}}({{.word}}=)' - - fieldName: log.irrelevant - pattern: '{{.greedy}}' - source: log.cefOrLeefMsgAll - - - grok: - patterns: - - fieldName: log.irrelevant - pattern: '{{.data}}(panOSTrafficSessionID=)' - - fieldName: log.panOSTrafficSessionID - pattern: '{{.data}}({{.word}}=)' - - fieldName: log.irrelevant - pattern: '{{.greedy}}' - source: log.cefOrLeefMsgAll - - - grok: - patterns: - - fieldName: log.irrelevant - pattern: '{{.data}}(panOSTunneInspectionRule=)' - - fieldName: log.panOSTunneInspectionRule - pattern: '{{.data}}({{.word}}=)' - - fieldName: log.irrelevant - pattern: '{{.greedy}}' - source: log.cefOrLeefMsgAll - - - grok: - patterns: - - fieldName: log.irrelevant - pattern: '{{.data}}(panOSTunnel=)' - - fieldName: log.panOSTunnel - pattern: '{{.data}}({{.word}}=)' - - fieldName: log.irrelevant - pattern: '{{.greedy}}' - source: log.cefOrLeefMsgAll - - - grok: - patterns: - - fieldName: log.irrelevant - pattern: '{{.data}}(panOSTunnelEndptID1=)' - - fieldName: log.panOSTunnelEndptID1 - pattern: '{{.data}}({{.word}}=)' - - fieldName: log.irrelevant - pattern: '{{.greedy}}' - source: log.cefOrLeefMsgAll - - - grok: - patterns: - - fieldName: log.irrelevant - pattern: '{{.data}}(panOSTunnelEndptID2=)' - - fieldName: log.panOSTunnelEndptID2 - pattern: '{{.data}}({{.word}}=)' - - fieldName: log.irrelevant - pattern: '{{.greedy}}' - source: log.cefOrLeefMsgAll - - - grok: - patterns: - - fieldName: log.irrelevant - pattern: '{{.data}}(panOSTunnelFragment=)' - - fieldName: log.panOSTunnelFragment - pattern: '{{.data}}({{.word}}=)' - - fieldName: log.irrelevant - pattern: '{{.greedy}}' - source: log.cefOrLeefMsgAll - - - grok: - patterns: - - fieldName: log.irrelevant - pattern: '{{.data}}(panOSTunnelID=)' - - fieldName: log.panOSTunnelID - pattern: '{{.data}}({{.word}}=)' - - fieldName: log.irrelevant - pattern: '{{.greedy}}' - source: log.cefOrLeefMsgAll - - - grok: - patterns: - - fieldName: log.irrelevant - pattern: '{{.data}}(panOSTunnelInspectionRule=)' - - fieldName: log.panOSTunnelInspectionRule - pattern: '{{.data}}({{.word}}=)' - - fieldName: log.irrelevant - pattern: '{{.greedy}}' - source: log.cefOrLeefMsgAll - - - grok: - patterns: - - fieldName: log.irrelevant - pattern: '{{.data}}(panOSTunnelType=)' - - fieldName: log.panOSTunnelType - pattern: '{{.data}}({{.word}}=)' - - fieldName: log.irrelevant - pattern: '{{.greedy}}' - source: log.cefOrLeefMsgAll - - - grok: - patterns: - - fieldName: log.irrelevant - pattern: '{{.data}}(panOSUGFlags=)' - - fieldName: log.panOSUGFlags - pattern: '{{.data}}({{.word}}=)' - - fieldName: log.irrelevant - pattern: '{{.greedy}}' - source: log.cefOrLeefMsgAll - - - grok: - patterns: - - fieldName: log.irrelevant - pattern: '{{.data}}(panOSURLCatList=)' - - fieldName: log.panOSURLCatList - pattern: '{{.data}}({{.word}}=)' - - fieldName: log.irrelevant - pattern: '{{.greedy}}' - source: log.cefOrLeefMsgAll - - - grok: - patterns: - - fieldName: log.irrelevant - pattern: '{{.data}}(panOSUserBySource=)' - - fieldName: log.panOSUserBySource - pattern: '{{.data}}({{.word}}=)' - - fieldName: log.irrelevant - pattern: '{{.greedy}}' - source: log.cefOrLeefMsgAll - - - grok: - patterns: - - fieldName: log.irrelevant - pattern: '{{.data}}(panOSVirtualSystem=)' - - fieldName: log.panOSVirtualSystem - pattern: '{{.data}}({{.word}}=)' - - fieldName: log.irrelevant - pattern: '{{.greedy}}' - source: log.cefOrLeefMsgAll - - - grok: - patterns: - - fieldName: log.irrelevant - pattern: '{{.data}}(panOSVsysName=)' - - fieldName: log.panOSVsysName - pattern: '{{.data}}({{.word}}=)' - - fieldName: log.irrelevant - pattern: '{{.greedy}}' - source: log.cefOrLeefMsgAll - - - grok: - patterns: - - fieldName: log.irrelevant - pattern: '{{.data}}(panOSXForwarderfor=)' - - fieldName: log.panOSXForwarderfor - pattern: '{{.data}}({{.word}}=)' - - fieldName: log.irrelevant - pattern: '{{.greedy}}' - source: log.cefOrLeefMsgAll - - - grok: - patterns: - - fieldName: log.irrelevant - pattern: '{{.data}}(panPartialHash=)' - - fieldName: log.panPartialHash - pattern: '{{.data}}({{.word}}=)' - - fieldName: log.irrelevant - pattern: '{{.greedy}}' - source: log.cefOrLeefMsgAll - - - grok: - patterns: - - fieldName: log.irrelevant - pattern: '{{.data}}(panPODName=)' - - fieldName: log.panPODName - pattern: '{{.data}}({{.word}}=)' - - fieldName: log.irrelevant - pattern: '{{.greedy}}' - source: log.cefOrLeefMsgAll - - - grok: - patterns: - - fieldName: log.irrelevant - pattern: '{{.data}}(panPODNamespace=)' - - fieldName: log.panPODNamespace - pattern: '{{.data}}({{.word}}=)' - - fieldName: log.irrelevant - pattern: '{{.greedy}}' - source: log.cefOrLeefMsgAll - - - grok: - patterns: - - fieldName: log.irrelevant - pattern: '{{.data}}(panPolicyID=)' - - fieldName: log.panPolicyID - pattern: '{{.data}}({{.word}}=)' - - fieldName: log.irrelevant - pattern: '{{.greedy}}' - source: log.cefOrLeefMsgAll - - - grok: - patterns: - - fieldName: log.irrelevant - pattern: '{{.data}}(panReasonFilteringAction=)' - - fieldName: log.panReasonFilteringAction - pattern: '{{.data}}({{.word}}=)' - - fieldName: log.irrelevant - pattern: '{{.greedy}}' - source: log.cefOrLeefMsgAll - - - grok: - patterns: - - fieldName: log.irrelevant - pattern: '{{.data}}(panSDWANCluster=)' - - fieldName: log.panSDWANCluster - pattern: '{{.data}}({{.word}}=)' - - fieldName: log.irrelevant - pattern: '{{.greedy}}' - source: log.cefOrLeefMsgAll - - - grok: - patterns: - - fieldName: log.irrelevant - pattern: '{{.data}}(panSDWANClustype=)' - - fieldName: log.panSDWANClustype - pattern: '{{.data}}({{.word}}=)' - - fieldName: log.irrelevant - pattern: '{{.greedy}}' - source: log.cefOrLeefMsgAll - - - grok: - patterns: - - fieldName: log.irrelevant - pattern: '{{.data}}(panSDWANDevice=)' - - fieldName: log.panSDWANDevice - pattern: '{{.data}}({{.word}}=)' - - fieldName: log.irrelevant - pattern: '{{.greedy}}' - source: log.cefOrLeefMsgAll - - - grok: - patterns: - - fieldName: log.irrelevant - pattern: '{{.data}}(panSDWANSite=)' - - fieldName: log.panSDWANSite - pattern: '{{.data}}({{.word}}=)' - - fieldName: log.irrelevant - pattern: '{{.greedy}}' - source: log.cefOrLeefMsgAll - - - grok: - patterns: - - fieldName: log.irrelevant - pattern: '{{.data}}(panSrcDAG=)' - - fieldName: log.panSrcDAG - pattern: '{{.data}}({{.word}}=)' - - fieldName: log.irrelevant - pattern: '{{.greedy}}' - source: log.cefOrLeefMsgAll - - - grok: - patterns: - - fieldName: log.irrelevant - pattern: '{{.data}}(panSrcDeviceCat=)' - - fieldName: log.panSrcDeviceCat - pattern: '{{.data}}({{.word}}=)' - - fieldName: log.irrelevant - pattern: '{{.greedy}}' - source: log.cefOrLeefMsgAll - - - grok: - patterns: - - fieldName: log.irrelevant - pattern: '{{.data}}(panSrcDeviceModel=)' - - fieldName: log.panSrcDeviceModel - pattern: '{{.data}}({{.word}}=)' - - fieldName: log.irrelevant - pattern: '{{.greedy}}' - source: log.cefOrLeefMsgAll - - - grok: - patterns: - - fieldName: log.irrelevant - pattern: '{{.data}}(panSrcDeviceOS=)' - - fieldName: log.panSrcDeviceOS - pattern: '{{.data}}({{.word}}=)' - - fieldName: log.irrelevant - pattern: '{{.greedy}}' - source: log.cefOrLeefMsgAll - - - grok: - patterns: - - fieldName: log.irrelevant - pattern: '{{.data}}(panSrcDeviceOSv=)' - - fieldName: log.panSrcDeviceOSv - pattern: '{{.data}}({{.word}}=)' - - fieldName: log.irrelevant - pattern: '{{.greedy}}' - source: log.cefOrLeefMsgAll - - - grok: - patterns: - - fieldName: log.irrelevant - pattern: '{{.data}}(panSrcDeviceProf=)' - - fieldName: log.panSrcDeviceProf - pattern: '{{.data}}({{.word}}=)' - - fieldName: log.irrelevant - pattern: '{{.greedy}}' - source: log.cefOrLeefMsgAll - - - grok: - patterns: - - fieldName: log.irrelevant - pattern: '{{.data}}(panSrcDeviceVendor=)' - - fieldName: log.panSrcDeviceVendor - pattern: '{{.data}}({{.word}}=)' - - fieldName: log.irrelevant - pattern: '{{.greedy}}' - source: log.cefOrLeefMsgAll - - - grok: - patterns: - - fieldName: log.irrelevant - pattern: '{{.data}}(panSrcEDL=)' - - fieldName: log.panSrcEDL - pattern: '{{.data}}({{.word}}=)' - - fieldName: log.irrelevant - pattern: '{{.greedy}}' - source: log.cefOrLeefMsgAll - - - grok: - patterns: - - fieldName: log.irrelevant - pattern: '{{.data}}(panSrcHostname=)' - - fieldName: log.panSrcHostname - pattern: '{{.data}}({{.word}}=)' - - fieldName: log.irrelevant - pattern: '{{.greedy}}' - source: log.cefOrLeefMsgAll - - - grok: - patterns: - - fieldName: log.irrelevant - pattern: '{{.data}}(panSrcMac=)' - - fieldName: log.panSrcMac - pattern: '{{.data}}({{.word}}=)' - - fieldName: log.irrelevant - pattern: '{{.greedy}}' - source: log.cefOrLeefMsgAll - - - grok: - patterns: - - fieldName: log.irrelevant - pattern: '{{.data}}(panTimeHighRes=)' - - fieldName: log.panTimeHighRes - pattern: '{{.data}}({{.word}}=)' - - fieldName: log.irrelevant - pattern: '{{.greedy}}' - source: log.cefOrLeefMsgAll - - - grok: - patterns: - - fieldName: log.irrelevant - pattern: '{{.data}}(panXFFIP=)' - - fieldName: log.panXFFIP - pattern: '{{.data}}({{.word}}=)' - - fieldName: log.irrelevant - pattern: '{{.greedy}}' - source: log.cefOrLeefMsgAll - - - grok: - patterns: - - fieldName: log.irrelevant - pattern: '{{.data}}(proto=)' - - fieldName: log.proto - pattern: '{{.data}}({{.word}}=)' - - fieldName: log.irrelevant - pattern: '{{.greedy}}' - source: log.cefOrLeefMsgAll - - - grok: - patterns: - - fieldName: log.irrelevant - pattern: '{{.data}}(reason=)' - - fieldName: log.reason - pattern: '{{.data}}({{.word}}=)' - - fieldName: log.irrelevant - pattern: '{{.greedy}}' - source: log.cefOrLeefMsgAll - - - grok: - patterns: - - fieldName: log.irrelevant - pattern: '{{.data}}(request=)' - - fieldName: log.request - pattern: '{{.data}}({{.word}}=)' - - fieldName: log.irrelevant - pattern: '{{.greedy}}' - source: log.cefOrLeefMsgAll - - - grok: - patterns: - - fieldName: log.irrelevant - pattern: '{{.data}}(requestContext=)' - - fieldName: log.requestContext - pattern: '{{.data}}({{.word}}=)' - - fieldName: log.irrelevant - pattern: '{{.greedy}}' - source: log.cefOrLeefMsgAll - - - grok: - patterns: - - fieldName: log.irrelevant - pattern: '{{.data}}(requestMethod=)' - - fieldName: log.requestMethod - pattern: '{{.data}}({{.word}}=)' - - fieldName: log.irrelevant - pattern: '{{.greedy}}' - source: log.cefOrLeefMsgAll - - - grok: - patterns: - - fieldName: log.irrelevant - pattern: '{{.data}}(rt=)' - - fieldName: log.rt - pattern: '{{.data}}({{.word}}=)' - - fieldName: log.irrelevant - pattern: '{{.greedy}}' - source: log.cefOrLeefMsgAll - - - grok: - patterns: - - fieldName: log.irrelevant - pattern: '{{.data}}(shost=)' - - fieldName: log.shost - pattern: '{{.data}}({{.word}}=)' - - fieldName: log.irrelevant - pattern: '{{.greedy}}' - source: log.cefOrLeefMsgAll - - - grok: - patterns: - - fieldName: log.irrelevant - pattern: '{{.data}}(sourceTranslatedAddress=)' - - fieldName: log.sourceTranslatedAddress - pattern: '{{.data}}({{.word}}=)' - - fieldName: log.irrelevant - pattern: '{{.greedy}}' - source: log.cefOrLeefMsgAll - - - grok: - patterns: - - fieldName: log.irrelevant - pattern: '{{.data}}(sourceTranslatedPort=)' - - fieldName: log.sourceTranslatedPort - pattern: '{{.data}}({{.word}}=)' - - fieldName: log.irrelevant - pattern: '{{.greedy}}' - source: log.cefOrLeefMsgAll - - - grok: - patterns: - - fieldName: log.irrelevant - pattern: '{{.data}}(spt=)' - - fieldName: log.spt - pattern: '{{.data}}({{.word}}=)' - - fieldName: log.irrelevant - pattern: '{{.greedy}}' - source: log.cefOrLeefMsgAll - - - grok: - patterns: - - fieldName: log.irrelevant - pattern: '{{.data}}(src=)' - - fieldName: log.src - pattern: '{{.data}}({{.word}}=)' - - fieldName: log.irrelevant - pattern: '{{.greedy}}' - source: log.cefOrLeefMsgAll - - - grok: - patterns: - - fieldName: log.irrelevant - pattern: '{{.data}}(start=)' - - fieldName: log.start - pattern: '{{.data}}({{.word}}=)' - - fieldName: log.irrelevant - pattern: '{{.greedy}}' - source: log.cefOrLeefMsgAll - - - grok: - patterns: - - fieldName: log.irrelevant - pattern: '{{.data}}(suid=)' - - fieldName: log.suid - pattern: '{{.data}}({{.word}}=)' - - fieldName: log.irrelevant - pattern: '{{.greedy}}' - source: log.cefOrLeefMsgAll - - - grok: - patterns: - - fieldName: log.irrelevant - pattern: '{{.data}}(suser=)' - - fieldName: log.suser - pattern: '{{.data}}({{.word}}=)' - - fieldName: log.irrelevant - pattern: '{{.greedy}}' - source: log.cefOrLeefMsgAll - - # .................................................# - # Applying grok to remove unnecessary data - # .................................................# - - grok: - patterns: - - fieldName: log.act - pattern: '{{.greedy}}{{.space}}' - - fieldName: log.irrelevant - pattern: '{{.word}}(=)' - source: log.act - - - grok: - patterns: - - fieldName: log.anOSTimeGeneratedHighResolution - pattern: '{{.greedy}}{{.space}}' - - fieldName: log.irrelevant - pattern: '{{.word}}(=)' - source: log.anOSTimeGeneratedHighResolution - - - grok: - patterns: - - fieldName: log.app - pattern: '{{.greedy}}{{.space}}' - - fieldName: log.irrelevant - pattern: '{{.word}}(=)' - source: log.app - - - grok: - patterns: - - fieldName: log.c6a2 - pattern: '{{.greedy}}{{.space}}' - - fieldName: log.irrelevant - pattern: '{{.word}}(=)' - source: log.c6a2 - - - grok: - patterns: - - fieldName: log.cat - pattern: '{{.greedy}}{{.space}}' - - fieldName: log.irrelevant - pattern: '{{.word}}(=)' - source: log.cat - - - grok: - patterns: - - fieldName: log.cfp1 - pattern: '{{.greedy}}{{.space}}' - - fieldName: log.irrelevant - pattern: '{{.word}}(=)' - source: log.cfp1 - - - grok: - patterns: - - fieldName: log.cfp1Label - pattern: '{{.greedy}}{{.space}}' - - fieldName: log.irrelevant - pattern: '{{.word}}(=)' - source: log.cfp1Label - - - grok: - patterns: - - fieldName: log.cfp2 - pattern: '{{.greedy}}{{.space}}' - - fieldName: log.irrelevant - pattern: '{{.word}}(=)' - source: log.cfp2 - - - grok: - patterns: - - fieldName: log.cfp2Label - pattern: '{{.greedy}}{{.space}}' - - fieldName: log.irrelevant - pattern: '{{.word}}(=)' - source: log.cfp2Label - - - grok: - patterns: - - fieldName: log.cfp3 - pattern: '{{.greedy}}{{.space}}' - - fieldName: log.irrelevant - pattern: '{{.word}}(=)' - source: log.cfp3 - - - grok: - patterns: - - fieldName: log.cfp3Label - pattern: '{{.greedy}}{{.space}}' - - fieldName: log.irrelevant - pattern: '{{.word}}(=)' - source: log.cfp3Label - - - grok: - patterns: - - fieldName: log.cfp4 - pattern: '{{.greedy}}{{.space}}' - - fieldName: log.irrelevant - pattern: '{{.word}}(=)' - source: log.cfp4 - - - grok: - patterns: - - fieldName: log.cn1 - pattern: '{{.greedy}}{{.space}}' - - fieldName: log.irrelevant - pattern: '{{.word}}(=)' - source: log.cn1 - - - grok: - patterns: - - fieldName: log.cn1Label - pattern: '{{.greedy}}{{.space}}' - - fieldName: log.irrelevant - pattern: '{{.word}}(=)' - source: log.cn1Label - - - grok: - patterns: - - fieldName: log.cn2 - pattern: '{{.greedy}}{{.space}}' - - fieldName: log.irrelevant - pattern: '{{.word}}(=)' - source: log.cn2 - - - grok: - patterns: - - fieldName: log.cn2Label - pattern: '{{.greedy}}{{.space}}' - - fieldName: log.irrelevant - pattern: '{{.word}}(=)' - source: log.cn2Label - - - grok: - patterns: - - fieldName: log.cn3 - pattern: '{{.greedy}}{{.space}}' - - fieldName: log.irrelevant - pattern: '{{.word}}(=)' - source: log.cn3 - - - grok: - patterns: - - fieldName: log.cn3Label - pattern: '{{.greedy}}{{.space}}' - - fieldName: log.irrelevant - pattern: '{{.word}}(=)' - source: log.cn3Label - - - grok: - patterns: - - fieldName: log.cn4 - pattern: '{{.greedy}}{{.space}}' - - fieldName: log.irrelevant - pattern: '{{.word}}(=)' - source: log.cn4 - - - grok: - patterns: - - fieldName: log.cn4Label - pattern: '{{.greedy}}{{.space}}' - - fieldName: log.irrelevant - pattern: '{{.word}}(=)' - source: log.cn4Label - - - grok: - patterns: - - fieldName: log.cn5 - pattern: '{{.greedy}}{{.space}}' - - fieldName: log.irrelevant - pattern: '{{.word}}(=)' - source: log.cn5 - - - grok: - patterns: - - fieldName: log.cn5Label - pattern: '{{.greedy}}{{.space}}' - - fieldName: log.irrelevant - pattern: '{{.word}}(=)' - source: log.cn5Label - - - grok: - patterns: - - fieldName: log.cn6 - pattern: '{{.greedy}}{{.space}}' - - fieldName: log.irrelevant - pattern: '{{.word}}(=)' - source: log.cn6 - - - grok: - patterns: - - fieldName: log.cn6Label - pattern: '{{.greedy}}{{.space}}' - - fieldName: log.irrelevant - pattern: '{{.word}}(=)' - source: log.cn6Label - - - grok: - patterns: - - fieldName: log.cnt - pattern: '{{.greedy}}{{.space}}' - - fieldName: log.irrelevant - pattern: '{{.word}}(=)' - source: log.cnt - - - grok: - patterns: - - fieldName: log.cs1 - pattern: '{{.greedy}}{{.space}}' - - fieldName: log.irrelevant - pattern: '{{.word}}(=)' - source: log.cs1 - - - grok: - patterns: - - fieldName: log.cs1Label - pattern: '{{.greedy}}{{.space}}' - - fieldName: log.irrelevant - pattern: '{{.word}}(=)' - source: log.cs1Label - - - grok: - patterns: - - fieldName: log.cs2 - pattern: '{{.greedy}}{{.space}}' - - fieldName: log.irrelevant - pattern: '{{.word}}(=)' - source: log.cs2 - - - grok: - patterns: - - fieldName: log.cs2Label - pattern: '{{.greedy}}{{.space}}' - - fieldName: log.irrelevant - pattern: '{{.word}}(=)' - source: log.cs2Label - - - grok: - patterns: - - fieldName: log.cs3 - pattern: '{{.greedy}}{{.space}}' - - fieldName: log.irrelevant - pattern: '{{.word}}(=)' - source: log.cs3 - - - grok: - patterns: - - fieldName: log.cs3Label - pattern: '{{.greedy}}{{.space}}' - - fieldName: log.irrelevant - pattern: '{{.word}}(=)' - source: log.cs3Label - - - grok: - patterns: - - fieldName: log.cs4 - pattern: '{{.greedy}}{{.space}}' - - fieldName: log.irrelevant - pattern: '{{.word}}(=)' - source: log.cs4 - - - grok: - patterns: - - fieldName: log.cs4Label - pattern: '{{.greedy}}{{.space}}' - - fieldName: log.irrelevant - pattern: '{{.word}}(=)' - source: log.cs4Label - - - grok: - patterns: - - fieldName: log.cs5 - pattern: '{{.greedy}}{{.space}}' - - fieldName: log.irrelevant - pattern: '{{.word}}(=)' - source: log.cs5 - - - grok: - patterns: - - fieldName: log.cs5Label - pattern: '{{.greedy}}{{.space}}' - - fieldName: log.irrelevant - pattern: '{{.word}}(=)' - source: log.cs5Label - - - grok: - patterns: - - fieldName: log.cs6 - pattern: '{{.greedy}}{{.space}}' - - fieldName: log.irrelevant - pattern: '{{.word}}(=)' - source: log.cs6 - - - grok: - patterns: - - fieldName: log.cs6Label - pattern: '{{.greedy}}{{.space}}' - - fieldName: log.irrelevant - pattern: '{{.word}}(=)' - source: log.cs6Label - - - grok: - patterns: - - fieldName: log.destinationServiceName - pattern: '{{.greedy}}{{.space}}' - - fieldName: log.irrelevant - pattern: '{{.word}}(=)' - source: log.destinationServiceName - - - grok: - patterns: - - fieldName: log.destinationTranslatedAddress - pattern: '{{.greedy}}{{.space}}' - - fieldName: log.irrelevant - pattern: '{{.word}}(=)' - source: log.destinationTranslatedAddress - - - grok: - patterns: - - fieldName: log.destinationTranslatedPort - pattern: '{{.greedy}}{{.space}}' - - fieldName: log.irrelevant - pattern: '{{.word}}(=)' - source: log.destinationTranslatedPort - - - grok: - patterns: - - fieldName: log.deviceExternalId - pattern: '{{.greedy}}{{.space}}' - - fieldName: log.irrelevant - pattern: '{{.word}}(=)' - source: log.deviceExternalId - - - grok: - patterns: - - fieldName: log.deviceInboundInterface - pattern: '{{.greedy}}{{.space}}' - - fieldName: log.irrelevant - pattern: '{{.word}}(=)' - source: log.deviceInboundInterface - - - grok: - patterns: - - fieldName: log.deviceOutboundInterface - pattern: '{{.greedy}}{{.space}}' - - fieldName: log.irrelevant - pattern: '{{.word}}(=)' - source: log.deviceOutboundInterface - - - grok: - patterns: - - fieldName: log.dpt - pattern: '{{.greedy}}{{.space}}' - - fieldName: log.irrelevant - pattern: '{{.word}}(=)' - source: log.dpt - - - grok: - patterns: - - fieldName: log.dst - pattern: '{{.greedy}}{{.space}}' - - fieldName: log.irrelevant - pattern: '{{.word}}(=)' - source: log.dst - - - grok: - patterns: - - fieldName: log.duid - pattern: '{{.greedy}}{{.space}}' - - fieldName: log.irrelevant - pattern: '{{.word}}(=)' - source: log.duid - - - grok: - patterns: - - fieldName: log.duser - pattern: '{{.greedy}}{{.space}}' - - fieldName: log.irrelevant - pattern: '{{.word}}(=)' - source: log.duser - - - grok: - patterns: - - fieldName: log.dvchost - pattern: '{{.greedy}}{{.space}}' - - fieldName: log.irrelevant - pattern: '{{.word}}(=)' - source: log.dvchost - - - grok: - patterns: - - fieldName: log.end - pattern: '{{.greedy}}{{.space}}' - - fieldName: log.irrelevant - pattern: '{{.word}}(=)' - source: log.end - - - grok: - patterns: - - fieldName: log.externalId - pattern: '{{.greedy}}{{.space}}' - - fieldName: log.irrelevant - pattern: '{{.word}}(=)' - source: log.externalId - - - grok: - patterns: - - fieldName: log.fileHash - pattern: '{{.greedy}}{{.space}}' - - fieldName: log.irrelevant - pattern: '{{.word}}(=)' - source: log.fileHash - - - grok: - patterns: - - fieldName: log.fileId - pattern: '{{.greedy}}{{.space}}' - - fieldName: log.irrelevant - pattern: '{{.word}}(=)' - source: log.fileId - - - grok: - patterns: - - fieldName: log.filePath - pattern: '{{.greedy}}{{.space}}' - - fieldName: log.irrelevant - pattern: '{{.word}}(=)' - source: log.filePath - - - grok: - patterns: - - fieldName: log.fileType - pattern: '{{.greedy}}{{.space}}' - - fieldName: log.irrelevant - pattern: '{{.word}}(=)' - source: log.fileType - - - grok: - patterns: - - fieldName: log.flags - pattern: '{{.greedy}}{{.space}}' - - fieldName: log.irrelevant - pattern: '{{.word}}(=)' - source: log.flags - - - grok: - patterns: - - fieldName: log.flexNumber1 - pattern: '{{.greedy}}{{.space}}' - - fieldName: log.irrelevant - pattern: '{{.word}}(=)' - source: log.flexNumber1 - - - grok: - patterns: - - fieldName: log.flexNumber1Label - pattern: '{{.greedy}}{{.space}}' - - fieldName: log.irrelevant - pattern: '{{.word}}(=)' - source: log.flexNumber1Label - - - grok: - patterns: - - fieldName: log.flexNumber2 - pattern: '{{.greedy}}{{.space}}' - - fieldName: log.irrelevant - pattern: '{{.word}}(=)' - source: log.flexNumber2 - - - grok: - patterns: - - fieldName: log.flexNumber2Label - pattern: '{{.greedy}}{{.space}}' - - fieldName: log.irrelevant - pattern: '{{.word}}(=)' - source: log.flexNumber2Label - - - grok: - patterns: - - fieldName: log.flexString1 - pattern: '{{.greedy}}{{.space}}' - - fieldName: log.irrelevant - pattern: '{{.word}}(=)' - source: log.flexString1 - - - grok: - patterns: - - fieldName: log.flexString1Label - pattern: '{{.greedy}}{{.space}}' - - fieldName: log.irrelevant - pattern: '{{.word}}(=)' - source: log.flexString1Label - - - grok: - patterns: - - fieldName: log.flexString2 - pattern: '{{.greedy}}{{.space}}' - - fieldName: log.irrelevant - pattern: '{{.word}}(=)' - source: log.flexString2 - - - grok: - patterns: - - fieldName: log.flexString2Label - pattern: '{{.greedy}}{{.space}}' - - fieldName: log.irrelevant - pattern: '{{.word}}(=)' - source: log.flexString2Label - - - grok: - patterns: - - fieldName: log.fname - pattern: '{{.greedy}}{{.space}}' - - fieldName: log.irrelevant - pattern: '{{.word}}(=)' - source: log.fname - - - grok: - patterns: - - fieldName: log.in - pattern: '{{.greedy}}{{.space}}' - - fieldName: log.irrelevant - pattern: '{{.word}}(=)' - source: log.in - - - grok: - patterns: - - fieldName: log.msg - pattern: '{{.greedy}}{{.space}}' - - fieldName: log.irrelevant - pattern: '{{.word}}(=)' - source: log.msg - - - grok: - patterns: - - fieldName: log.oldFileId - pattern: '{{.greedy}}{{.space}}' - - fieldName: log.irrelevant - pattern: '{{.word}}(=)' - source: log.oldFileId - - - grok: - patterns: - - fieldName: log.out - pattern: '{{.greedy}}{{.space}}' - - fieldName: log.irrelevant - pattern: '{{.word}}(=)' - source: log.out - - - grok: - patterns: - - fieldName: log.panASServiceDiff - pattern: '{{.greedy}}{{.space}}' - - fieldName: log.irrelevant - pattern: '{{.word}}(=)' - source: log.panASServiceDiff - - - grok: - patterns: - - fieldName: log.panASServiceType - pattern: '{{.greedy}}{{.space}}' - - fieldName: log.irrelevant - pattern: '{{.word}}(=)' - source: log.panASServiceType - - - grok: - patterns: - - fieldName: log.panContainerName - pattern: '{{.greedy}}{{.space}}' - - fieldName: log.irrelevant - pattern: '{{.word}}(=)' - source: log.panContainerName - - - grok: - patterns: - - fieldName: log.panDomainEDL - pattern: '{{.greedy}}{{.space}}' - - fieldName: log.irrelevant - pattern: '{{.word}}(=)' - source: log.panDomainEDL - - - grok: - patterns: - - fieldName: log.panDstDAG - pattern: '{{.greedy}}{{.space}}' - - fieldName: log.irrelevant - pattern: '{{.word}}(=)' - source: log.panDstDAG - - - grok: - patterns: - - fieldName: log.panDstDeviceCat - pattern: '{{.greedy}}{{.space}}' - - fieldName: log.irrelevant - pattern: '{{.word}}(=)' - source: log.panDstDeviceCat - - - grok: - patterns: - - fieldName: log.panDstDeviceModel - pattern: '{{.greedy}}{{.space}}' - - fieldName: log.irrelevant - pattern: '{{.word}}(=)' - source: log.panDstDeviceModel - - - grok: - patterns: - - fieldName: log.panDstDeviceOS - pattern: '{{.greedy}}{{.space}}' - - fieldName: log.irrelevant - pattern: '{{.word}}(=)' - source: log.panDstDeviceOS - - - grok: - patterns: - - fieldName: log.panDstDeviceOSv - pattern: '{{.greedy}}{{.space}}' - - fieldName: log.irrelevant - pattern: '{{.word}}(=)' - source: log.panDstDeviceOSv - - - grok: - patterns: - - fieldName: log.panDstDeviceProf - pattern: '{{.greedy}}{{.space}}' - - fieldName: log.irrelevant - pattern: '{{.word}}(=)' - source: log.panDstDeviceProf - - - grok: - patterns: - - fieldName: log.panDstDeviceVendor - pattern: '{{.greedy}}{{.space}}' - - fieldName: log.irrelevant - pattern: '{{.word}}(=)' - source: log.panDstDeviceVendor - - - grok: - patterns: - - fieldName: log.panDstEDL - pattern: '{{.greedy}}{{.space}}' - - fieldName: log.irrelevant - pattern: '{{.word}}(=)' - source: log.panDstEDL - - - grok: - patterns: - - fieldName: log.panDstHostname - pattern: '{{.greedy}}{{.space}}' - - fieldName: log.irrelevant - pattern: '{{.word}}(=)' - source: log.panDstHostname - - - grok: - patterns: - - fieldName: log.panDstMac - pattern: '{{.greedy}}{{.space}}' - - fieldName: log.irrelevant - pattern: '{{.word}}(=)' - source: log.panDstMac - - - grok: - patterns: - - fieldName: log.panDynamicUsrgrp - pattern: '{{.greedy}}{{.space}}' - - fieldName: log.irrelevant - pattern: '{{.word}}(=)' - source: log.panDynamicUsrgrp - - - grok: - patterns: - - fieldName: log.panEPSerial - pattern: '{{.greedy}}{{.space}}' - - fieldName: log.irrelevant - pattern: '{{.word}}(=)' - source: log.panEPSerial - - - grok: - patterns: - - fieldName: log.panGPHostID - pattern: '{{.greedy}}{{.space}}' - - fieldName: log.irrelevant - pattern: '{{.word}}(=)' - source: log.panGPHostID - - - grok: - patterns: - - fieldName: log.panHASessionOwner - pattern: '{{.greedy}}{{.space}}' - - fieldName: log.irrelevant - pattern: '{{.word}}(=)' - source: log.panHASessionOwner - - - grok: - patterns: - - fieldName: log.panJustification - pattern: '{{.greedy}}{{.space}}' - - fieldName: log.irrelevant - pattern: '{{.word}}(=)' - source: log.panJustification - - - grok: - patterns: - - fieldName: log.panLinkChange - pattern: '{{.greedy}}{{.space}}' - - fieldName: log.irrelevant - pattern: '{{.word}}(=)' - source: log.panLinkChange - - - grok: - patterns: - - fieldName: log.panLinkDetail - pattern: '{{.greedy}}{{.space}}' - - fieldName: log.irrelevant - pattern: '{{.word}}(=)' - source: log.panLinkDetail - - - grok: - patterns: - - fieldName: log.panOSActionFlags - pattern: '{{.greedy}}{{.space}}' - - fieldName: log.irrelevant - pattern: '{{.word}}(=)' - source: log.panOSActionFlags - - - grok: - patterns: - - fieldName: log.panOSAPName - pattern: '{{.greedy}}{{.space}}' - - fieldName: log.irrelevant - pattern: '{{.word}}(=)' - source: log.panOSAPName - - - grok: - patterns: - - fieldName: log.panOSAreaCode - pattern: '{{.greedy}}{{.space}}' - - fieldName: log.irrelevant - pattern: '{{.word}}(=)' - source: log.panOSAreaCode - - - grok: - patterns: - - fieldName: log.panOSAssocID - pattern: '{{.greedy}}{{.space}}' - - fieldName: log.irrelevant - pattern: '{{.word}}(=)' - source: log.panOSAssocID - - - grok: - patterns: - - fieldName: log.panOSAttemptedGateways - pattern: '{{.greedy}}{{.space}}' - - fieldName: log.irrelevant - pattern: '{{.word}}(=)' - source: log.panOSAttemptedGateways - - - grok: - patterns: - - fieldName: log.panOSAuthMethod - pattern: '{{.greedy}}{{.space}}' - - fieldName: log.irrelevant - pattern: '{{.word}}(=)' - source: log.panOSAuthMethod - - - grok: - patterns: - - fieldName: log.panOSCellID - pattern: '{{.greedy}}{{.space}}' - - fieldName: log.irrelevant - pattern: '{{.word}}(=)' - source: log.panOSCellID - - - grok: - patterns: - - fieldName: log.panOSCertificateFlags - pattern: '{{.greedy}}{{.space}}' - - fieldName: log.irrelevant - pattern: '{{.word}}(=)' - source: log.panOSCertificateFlags - - - grok: - patterns: - - fieldName: log.panOSCertificateSerial - pattern: '{{.greedy}}{{.space}}' - - fieldName: log.irrelevant - pattern: '{{.word}}(=)' - source: log.panOSCertificateSerial - - - grok: - patterns: - - fieldName: log.panOSCertificateSize - pattern: '{{.greedy}}{{.space}}' - - fieldName: log.irrelevant - pattern: '{{.word}}(=)' - source: log.panOSCertificateSize - - - grok: - patterns: - - fieldName: log.panOSCertificateVersion - pattern: '{{.greedy}}{{.space}}' - - fieldName: log.irrelevant - pattern: '{{.word}}(=)' - source: log.panOSCertificateVersion - - - grok: - patterns: - - fieldName: log.panOSChainStatus - pattern: '{{.greedy}}{{.space}}' - - fieldName: log.irrelevant - pattern: '{{.word}}(=)' - source: log.panOSChainStatus - - - grok: - patterns: - - fieldName: log.panOSChunkType - pattern: '{{.greedy}}{{.space}}' - - fieldName: log.irrelevant - pattern: '{{.word}}(=)' - source: log.panOSChunkType - - - grok: - patterns: - - fieldName: log.panOSClientToFirewall - pattern: '{{.greedy}}{{.space}}' - - fieldName: log.irrelevant - pattern: '{{.word}}(=)' - source: log.panOSClientToFirewall - - - grok: - patterns: - - fieldName: log.panOSCommonName - pattern: '{{.greedy}}{{.space}}' - - fieldName: log.irrelevant - pattern: '{{.word}}(=)' - source: log.panOSCommonName - - - grok: - patterns: - - fieldName: log.panOSCommonNameLength - pattern: '{{.greedy}}{{.space}}' - - fieldName: log.irrelevant - pattern: '{{.word}}(=)' - source: log.panOSCommonNameLength - - - grok: - patterns: - - fieldName: log.panOSConfigVersion - pattern: '{{.greedy}}{{.space}}' - - fieldName: log.irrelevant - pattern: '{{.word}}(=)' - source: log.panOSConfigVersion - - - grok: - patterns: - - fieldName: log.panOSConnectionError - pattern: '{{.greedy}}{{.space}}' - - fieldName: log.irrelevant - pattern: '{{.word}}(=)' - source: log.panOSConnectionError - - - grok: - patterns: - - fieldName: log.panOSConnectionErrorID - pattern: '{{.greedy}}{{.space}}' - - fieldName: log.irrelevant - pattern: '{{.word}}(=)' - source: log.panOSConnectionErrorID - - - grok: - patterns: - - fieldName: log.panOSConnectionMethod - pattern: '{{.greedy}}{{.space}}' - - fieldName: log.irrelevant - pattern: '{{.word}}(=)' - source: log.panOSConnectionMethod - - - grok: - patterns: - - fieldName: log.panOSContainerID - pattern: '{{.greedy}}{{.space}}' - - fieldName: log.irrelevant - pattern: '{{.word}}(=)' - source: log.panOSContainerID - - - grok: - patterns: - - fieldName: log.panOSContainerName - pattern: '{{.greedy}}{{.space}}' - - fieldName: log.irrelevant - pattern: '{{.word}}(=)' - source: log.panOSContainerName - - - grok: - patterns: - - fieldName: log.panOSContainerNameSpace - pattern: '{{.greedy}}{{.space}}' - - fieldName: log.irrelevant - pattern: '{{.word}}(=)' - source: log.panOSContainerNameSpace - - - grok: - patterns: - - fieldName: log.panOSContentVer - pattern: '{{.greedy}}{{.space}}' - - fieldName: log.irrelevant - pattern: '{{.word}}(=)' - source: log.panOSContentVer - - - grok: - patterns: - - fieldName: log.panOSCountOfRepeats - pattern: '{{.greedy}}{{.space}}' - - fieldName: log.irrelevant - pattern: '{{.word}}(=)' - source: log.panOSCountOfRepeats - - - grok: - patterns: - - fieldName: log.panOSDataSourceName - pattern: '{{.greedy}}{{.space}}' - - fieldName: log.irrelevant - pattern: '{{.word}}(=)' - source: log.panOSDataSourceName - - - grok: - patterns: - - fieldName: log.panOSDataSourceSubType - pattern: '{{.greedy}}{{.space}}' - - fieldName: log.irrelevant - pattern: '{{.word}}(=)' - source: log.panOSDataSourceSubType - - - grok: - patterns: - - fieldName: log.panOSDataSourceType - pattern: '{{.greedy}}{{.space}}' - - fieldName: log.irrelevant - pattern: '{{.word}}(=)' - source: log.panOSDataSourceType - - - grok: - patterns: - - fieldName: log.panOSDesc - pattern: '{{.greedy}}{{.space}}' - - fieldName: log.irrelevant - pattern: '{{.word}}(=)' - source: log.panOSDesc - - - grok: - patterns: - - fieldName: log.panOSDescription - pattern: '{{.greedy}}{{.space}}' - - fieldName: log.irrelevant - pattern: '{{.word}}(=)' - source: log.panOSDescription - - - grok: - patterns: - - fieldName: log.panOSDestinationDeviceCategory - pattern: '{{.greedy}}{{.space}}' - - fieldName: log.irrelevant - pattern: '{{.word}}(=)' - source: log.panOSDestinationDeviceCategory - - - grok: - patterns: - - fieldName: log.panOSDestinationDeviceHost - pattern: '{{.greedy}}{{.space}}' - - fieldName: log.irrelevant - pattern: '{{.word}}(=)' - source: log.panOSDestinationDeviceHost - - - grok: - patterns: - - fieldName: log.panOSDestinationDeviceMac - pattern: '{{.greedy}}{{.space}}' - - fieldName: log.irrelevant - pattern: '{{.word}}(=)' - source: log.panOSDestinationDeviceMac - - - grok: - patterns: - - fieldName: log.panOSDestinationDeviceModel - pattern: '{{.greedy}}{{.space}}' - - fieldName: log.irrelevant - pattern: '{{.word}}(=)' - source: log.panOSDestinationDeviceModel - - - grok: - patterns: - - fieldName: log.panOSDestinationDeviceOSFamily - pattern: '{{.greedy}}{{.space}}' - - fieldName: log.irrelevant - pattern: '{{.word}}(=)' - source: log.panOSDestinationDeviceOSFamily - - - grok: - patterns: - - fieldName: log.panOSDestinationDeviceOSVersion - pattern: '{{.greedy}}{{.space}}' - - fieldName: log.irrelevant - pattern: '{{.word}}(=)' - source: log.panOSDestinationDeviceOSVersion - - - grok: - patterns: - - fieldName: log.panOSDestinationDeviceProfile - pattern: '{{.greedy}}{{.space}}' - - fieldName: log.irrelevant - pattern: '{{.word}}(=)' - source: log.panOSDestinationDeviceProfile - - - grok: - patterns: - - fieldName: log.panOSDestinationDeviceVendor - pattern: '{{.greedy}}{{.space}}' - - fieldName: log.irrelevant - pattern: '{{.word}}(=)' - source: log.panOSDestinationDeviceVendor - - - grok: - patterns: - - fieldName: log.panOSDestinationDynamicAddressGroup - pattern: '{{.greedy}}{{.space}}' - - fieldName: log.irrelevant - pattern: '{{.word}}(=)' - source: log.panOSDestinationDynamicAddressGroup - - - grok: - patterns: - - fieldName: log.panOSDestinationEDL - pattern: '{{.greedy}}{{.space}}' - - fieldName: log.irrelevant - pattern: '{{.word}}(=)' - source: log.panOSDestinationEDL - - - grok: - patterns: - - fieldName: log.panOSDestinationUUID - pattern: '{{.greedy}}{{.space}}' - - fieldName: log.irrelevant - pattern: '{{.word}}(=)' - source: log.panOSDestinationUUID - - - grok: - patterns: - - fieldName: log.panOSDeviceSN - pattern: '{{.greedy}}{{.space}}' - - fieldName: log.irrelevant - pattern: '{{.word}}(=)' - source: log.panOSDeviceSN - - - grok: - patterns: - - fieldName: log.panOSDGl1 - pattern: '{{.greedy}}{{.space}}' - - fieldName: log.irrelevant - pattern: '{{.word}}(=)' - source: log.panOSDGl1 - - - grok: - patterns: - - fieldName: log.panOSDGl2 - pattern: '{{.greedy}}{{.space}}' - - fieldName: log.irrelevant - pattern: '{{.word}}(=)' - source: log.panOSDGl2 - - - grok: - patterns: - - fieldName: log.panOSDGl3 - pattern: '{{.greedy}}{{.space}}' - - fieldName: log.irrelevant - pattern: '{{.word}}(=)' - source: log.panOSDGl3 - - - grok: - patterns: - - fieldName: log.panOSDGl4 - pattern: '{{.greedy}}{{.space}}' - - fieldName: log.irrelevant - pattern: '{{.word}}(=)' - source: log.panOSDGl4 - - - grok: - patterns: - - fieldName: log.panOSDiameterApp - pattern: '{{.greedy}}{{.space}}' - - fieldName: log.irrelevant - pattern: '{{.word}}(=)' - source: log.panOSDiameterApp - - - grok: - patterns: - - fieldName: log.panOSDiameterAVPCode - pattern: '{{.greedy}}{{.space}}' - - fieldName: log.irrelevant - pattern: '{{.word}}(=)' - source: log.panOSDiameterAVPCode - - - grok: - patterns: - - fieldName: log.panOSDiameterCmdCode - pattern: '{{.greedy}}{{.space}}' - - fieldName: log.irrelevant - pattern: '{{.word}}(=)' - source: log.panOSDiameterCmdCode - - - grok: - patterns: - - fieldName: log.panOSDstUUID - pattern: '{{.greedy}}{{.space}}' - - fieldName: log.irrelevant - pattern: '{{.word}}(=)' - source: log.panOSDstUUID - - - grok: - patterns: - - fieldName: log.panOSEllipticCurve - pattern: '{{.greedy}}{{.space}}' - - fieldName: log.irrelevant - pattern: '{{.word}}(=)' - source: log.panOSEllipticCurve - - - grok: - patterns: - - fieldName: log.panOSEndpointDeviceName - pattern: '{{.greedy}}{{.space}}' - - fieldName: log.irrelevant - pattern: '{{.word}}(=)' - source: log.panOSEndpointDeviceName - - - grok: - patterns: - - fieldName: log.panOSEndpointMac - pattern: '{{.greedy}}{{.space}}' - - fieldName: log.irrelevant - pattern: '{{.word}}(=)' - source: log.panOSEndpointMac - - - grok: - patterns: - - fieldName: log.panOSEndpointOSType - pattern: '{{.greedy}}{{.space}}' - - fieldName: log.irrelevant - pattern: '{{.word}}(=)' - source: log.panOSEndpointOSType - - - grok: - patterns: - - fieldName: log.panOSEndpointOSVersion - pattern: '{{.greedy}}{{.space}}' - - fieldName: log.irrelevant - pattern: '{{.word}}(=)' - source: log.panOSEndpointOSVersion - - - grok: - patterns: - - fieldName: log.panOSEndpointSerialNumber - pattern: '{{.greedy}}{{.space}}' - - fieldName: log.irrelevant - pattern: '{{.word}}(=)' - source: log.panOSEndpointSerialNumber - - - grok: - patterns: - - fieldName: log.panOSEndUserIP - pattern: '{{.greedy}}{{.space}}' - - fieldName: log.irrelevant - pattern: '{{.word}}(=)' - source: log.panOSEndUserIP - - - grok: - patterns: - - fieldName: log.panOSErrorIndex - pattern: '{{.greedy}}{{.space}}' - - fieldName: log.irrelevant - pattern: '{{.word}}(=)' - source: log.panOSErrorIndex - - - grok: - patterns: - - fieldName: log.panOSErrorMessage - pattern: '{{.greedy}}{{.space}}' - - fieldName: log.irrelevant - pattern: '{{.word}}(=)' - source: log.panOSErrorMessage - - - grok: - patterns: - - fieldName: log.panOSEventID - pattern: '{{.greedy}}{{.space}}' - - fieldName: log.irrelevant - pattern: '{{.word}}(=)' - source: log.panOSEventID - - - grok: - patterns: - - fieldName: log.panOSEventStatus - pattern: '{{.greedy}}{{.space}}' - - fieldName: log.irrelevant - pattern: '{{.word}}(=)' - source: log.panOSEventStatus - - - grok: - patterns: - - fieldName: log.panOSFingerprint - pattern: '{{.greedy}}{{.space}}' - - fieldName: log.irrelevant - pattern: '{{.word}}(=)' - source: log.panOSFingerprint - - - grok: - patterns: - - fieldName: log.panOSFirewallToServer - pattern: '{{.greedy}}{{.space}}' - - fieldName: log.irrelevant - pattern: '{{.word}}(=)' - source: log.panOSFirewallToServer - - - grok: - patterns: - - fieldName: log.panOSFWDeviceGroup - pattern: '{{.greedy}}{{.space}}' - - fieldName: log.irrelevant - pattern: '{{.word}}(=)' - source: log.panOSFWDeviceGroup - - - grok: - patterns: - - fieldName: log.panOSGateway - pattern: '{{.greedy}}{{.space}}' - - fieldName: log.irrelevant - pattern: '{{.word}}(=)' - source: log.panOSGateway - - - grok: - patterns: - - fieldName: log.panOSGatewayPriority - pattern: '{{.greedy}}{{.space}}' - - fieldName: log.irrelevant - pattern: '{{.word}}(=)' - source: log.panOSGatewayPriority - - - grok: - patterns: - - fieldName: log.panOSGatewaySelectionType - pattern: '{{.greedy}}{{.space}}' - - fieldName: log.irrelevant - pattern: '{{.word}}(=)' - source: log.panOSGatewaySelectionType - - - grok: - patterns: - - fieldName: log.panOSGlobalProtectClientVersion - pattern: '{{.greedy}}{{.space}}' - - fieldName: log.irrelevant - pattern: '{{.word}}(=)' - source: log.panOSGlobalProtectClientVersion - - - grok: - patterns: - - fieldName: log.panOSGPGatewayLocation - pattern: '{{.greedy}}{{.space}}' - - fieldName: log.irrelevant - pattern: '{{.word}}(=)' - source: log.panOSGPGatewayLocation - - - grok: - patterns: - - fieldName: log.panOSGTPCause - pattern: '{{.greedy}}{{.space}}' - - fieldName: log.irrelevant - pattern: '{{.word}}(=)' - source: log.panOSGTPCause - - - grok: - patterns: - - fieldName: log.panOSGTPEventCode - pattern: '{{.greedy}}{{.space}}' - - fieldName: log.irrelevant - pattern: '{{.word}}(=)' - source: log.panOSGTPEventCode - - - grok: - patterns: - - fieldName: log.panOSGTPEventType - pattern: '{{.greedy}}{{.space}}' - - fieldName: log.irrelevant - pattern: '{{.word}}(=)' - source: log.panOSGTPEventType - - - grok: - patterns: - - fieldName: log.panOSGTPInterface - pattern: '{{.greedy}}{{.space}}' - - fieldName: log.irrelevant - pattern: '{{.word}}(=)' - source: log.panOSGTPInterface - - - grok: - patterns: - - fieldName: log.panOSGTPMsgType - pattern: '{{.greedy}}{{.space}}' - - fieldName: log.irrelevant - pattern: '{{.word}}(=)' - source: log.panOSGTPMsgType - - - grok: - patterns: - - fieldName: log.panOSHostID - pattern: '{{.greedy}}{{.space}}' - - fieldName: log.irrelevant - pattern: '{{.word}}(=)' - source: log.panOSHostID - - - grok: - patterns: - - fieldName: log.panOSHTTP2Con - pattern: '{{.greedy}}{{.space}}' - - fieldName: log.irrelevant - pattern: '{{.word}}(=)' - source: log.panOSHTTP2Con - - - grok: - patterns: - - fieldName: log.panOSHTTPHeader - pattern: '{{.greedy}}{{.space}}' - - fieldName: log.irrelevant - pattern: '{{.word}}(=)' - source: log.panOSHTTPHeader - - - grok: - patterns: - - fieldName: log.panOSHTTPUserAgent - pattern: '{{.greedy}}{{.space}}' - - fieldName: log.irrelevant - pattern: '{{.word}}(=)' - source: log.panOSHTTPUserAgent - - - grok: - patterns: - - fieldName: log.panOSIssuerCommonName - pattern: '{{.greedy}}{{.space}}' - - fieldName: log.irrelevant - pattern: '{{.word}}(=)' - source: log.panOSIssuerCommonName - - - grok: - patterns: - - fieldName: log.panOSIssuerNameLength - pattern: '{{.greedy}}{{.space}}' - - fieldName: log.irrelevant - pattern: '{{.word}}(=)' - source: log.panOSIssuerNameLength - - - grok: - patterns: - - fieldName: log.panOSLoginDuration - pattern: '{{.greedy}}{{.space}}' - - fieldName: log.irrelevant - pattern: '{{.word}}(=)' - source: log.panOSLoginDuration - - - grok: - patterns: - - fieldName: log.panOSLogTimeStamp - pattern: '{{.greedy}}{{.space}}' - - fieldName: log.irrelevant - pattern: '{{.word}}(=)' - source: log.panOSLogTimeStamp - - - grok: - patterns: - - fieldName: log.panOSLogTypeSeqNo - pattern: '{{.greedy}}{{.space}}' - - fieldName: log.irrelevant - pattern: '{{.word}}(=)' - source: log.panOSLogTypeSeqNo - - - grok: - patterns: - - fieldName: log.panOSMonitorTag - pattern: '{{.greedy}}{{.space}}' - - fieldName: log.irrelevant - pattern: '{{.word}}(=)' - source: log.panOSMonitorTag - - - grok: - patterns: - - fieldName: log.panOSMSISDN - pattern: '{{.greedy}}{{.space}}' - - fieldName: log.irrelevant - pattern: '{{.word}}(=)' - source: log.panOSMSISDN - - - grok: - patterns: - - fieldName: log.panOSOpCode - pattern: '{{.greedy}}{{.space}}' - - fieldName: log.irrelevant - pattern: '{{.word}}(=)' - source: log.panOSOpCode - - - grok: - patterns: - - fieldName: log.panOSPacketsReceived - pattern: '{{.greedy}}{{.space}}' - - fieldName: log.irrelevant - pattern: '{{.word}}(=)' - source: log.panOSPacketsReceived - - - grok: - patterns: - - fieldName: log.panOSPacketsSent - pattern: '{{.greedy}}{{.space}}' - - fieldName: log.irrelevant - pattern: '{{.word}}(=)' - source: log.panOSPacketsSent - - - grok: - patterns: - - fieldName: log.panOSParentSessionID - pattern: '{{.greedy}}{{.space}}' - - fieldName: log.irrelevant - pattern: '{{.word}}(=)' - source: log.panOSParentSessionID - - - grok: - patterns: - - fieldName: log.panOSParentStartTime - pattern: '{{.greedy}}{{.space}}' - - fieldName: log.irrelevant - pattern: '{{.word}}(=)' - source: log.panOSParentStartTime - - - grok: - patterns: - - fieldName: log.panOSPayloadProtID - pattern: '{{.greedy}}{{.space}}' - - fieldName: log.irrelevant - pattern: '{{.word}}(=)' - source: log.panOSPayloadProtID - - - grok: - patterns: - - fieldName: log.panOSPcapID - pattern: '{{.greedy}}{{.space}}' - - fieldName: log.irrelevant - pattern: '{{.word}}(=)' - source: log.panOSPcapID - - - grok: - patterns: - - fieldName: log.panOSPolicyAuditComment - pattern: '{{.greedy}}{{.space}}' - - fieldName: log.irrelevant - pattern: '{{.word}}(=)' - source: log.panOSPolicyAuditComment - - - grok: - patterns: - - fieldName: log.panOSPolicyName - pattern: '{{.greedy}}{{.space}}' - - fieldName: log.irrelevant - pattern: '{{.word}}(=)' - source: log.panOSPolicyName - - - grok: - patterns: - - fieldName: log.panOSPortal - pattern: '{{.greedy}}{{.space}}' - - fieldName: log.irrelevant - pattern: '{{.word}}(=)' - source: log.panOSPortal - - - grok: - patterns: - - fieldName: log.panOSPPID - pattern: '{{.greedy}}{{.space}}' - - fieldName: log.irrelevant - pattern: '{{.word}}(=)' - source: log.panOSPPID - - - grok: - patterns: - - fieldName: log.panOSPrivateIPv4 - pattern: '{{.greedy}}{{.space}}' - - fieldName: log.irrelevant - pattern: '{{.word}}(=)' - source: log.panOSPrivateIPv4 - - - grok: - patterns: - - fieldName: log.panOSPrivateIPv6 - pattern: '{{.greedy}}{{.space}}' - - fieldName: log.irrelevant - pattern: '{{.word}}(=)' - source: log.panOSPrivateIPv6 - - - grok: - patterns: - - fieldName: log.panOSProxyType - pattern: '{{.greedy}}{{.space}}' - - fieldName: log.irrelevant - pattern: '{{.word}}(=)' - source: log.panOSProxyType - - - grok: - patterns: - - fieldName: log.panOSPublicIPv4 - pattern: '{{.greedy}}{{.space}}' - - fieldName: log.irrelevant - pattern: '{{.word}}(=)' - source: log.panOSPublicIPv4 - - - grok: - patterns: - - fieldName: log.panOSPublicIPv6 - pattern: '{{.greedy}}{{.space}}' - - fieldName: log.irrelevant - pattern: '{{.word}}(=)' - source: log.panOSPublicIPv6 - - - grok: - patterns: - - fieldName: log.panOSQuarantineReason - pattern: '{{.greedy}}{{.space}}' - - fieldName: log.irrelevant - pattern: '{{.word}}(=)' - source: log.panOSQuarantineReason - - - grok: - patterns: - - fieldName: log.panOSRadioTech - pattern: '{{.greedy}}{{.space}}' - - fieldName: log.irrelevant - pattern: '{{.word}}(=)' - source: log.panOSRadioTech - - - grok: - patterns: - - fieldName: log.panOSReferer - pattern: '{{.greedy}}{{.space}}' - - fieldName: log.irrelevant - pattern: '{{.word}}(=)' - source: log.panOSReferer - - - grok: - patterns: - - fieldName: log.panOSRmtUserID - pattern: '{{.greedy}}{{.space}}' - - fieldName: log.irrelevant - pattern: '{{.word}}(=)' - source: log.panOSRmtUserID - - - grok: - patterns: - - fieldName: log.panOSRmtUserIP - pattern: '{{.greedy}}{{.space}}' - - fieldName: log.irrelevant - pattern: '{{.word}}(=)' - source: log.panOSRmtUserIP - - - grok: - patterns: - - fieldName: log.panOSRootCNLength - pattern: '{{.greedy}}{{.space}}' - - fieldName: log.irrelevant - pattern: '{{.word}}(=)' - source: log.panOSRootCNLength - - - grok: - patterns: - - fieldName: log.panOSRootCommonName - pattern: '{{.greedy}}{{.space}}' - - fieldName: log.irrelevant - pattern: '{{.word}}(=)' - source: log.panOSRootCommonName - - - grok: - patterns: - - fieldName: log.panOSRootStatus - pattern: '{{.greedy}}{{.space}}' - - fieldName: log.irrelevant - pattern: '{{.word}}(=)' - source: log.panOSRootStatus - - - grok: - patterns: - - fieldName: log.panOSRuleUUID - pattern: '{{.greedy}}{{.space}}' - - fieldName: log.irrelevant - pattern: '{{.word}}(=)' - source: log.panOSRuleUUID - - - grok: - patterns: - - fieldName: log.panOSSCCPCallingGT - pattern: '{{.greedy}}{{.space}}' - - fieldName: log.irrelevant - pattern: '{{.word}}(=)' - source: log.panOSSCCPCallingGT - - - grok: - patterns: - - fieldName: log.panOSSCCPCallingPartySSN - pattern: '{{.greedy}}{{.space}}' - - fieldName: log.irrelevant - pattern: '{{.word}}(=)' - source: log.panOSSCCPCallingPartySSN - - - grok: - patterns: - - fieldName: log.panOSSCTPAssocEndReason - pattern: '{{.greedy}}{{.space}}' - - fieldName: log.irrelevant - pattern: '{{.word}}(=)' - source: log.panOSSCTPAssocEndReason - - - grok: - patterns: - - fieldName: log.panOSSCTPAssocID - pattern: '{{.greedy}}{{.space}}' - - fieldName: log.irrelevant - pattern: '{{.word}}(=)' - source: log.panOSSCTPAssocID - - - grok: - patterns: - - fieldName: log.panOSSCTPCauseCode - pattern: '{{.greedy}}{{.space}}' - - fieldName: log.irrelevant - pattern: '{{.word}}(=)' - source: log.panOSSCTPCauseCode - - - grok: - patterns: - - fieldName: log.panOSSCTPChunkRcv - pattern: '{{.greedy}}{{.space}}' - - fieldName: log.irrelevant - pattern: '{{.word}}(=)' - source: log.panOSSCTPChunkRcv - - - grok: - patterns: - - fieldName: log.panOSSCTPChunks - pattern: '{{.greedy}}{{.space}}' - - fieldName: log.irrelevant - pattern: '{{.word}}(=)' - source: log.panOSSCTPChunks - - - grok: - patterns: - - fieldName: log.panOSSCTPChunkSent - pattern: '{{.greedy}}{{.space}}' - - fieldName: log.irrelevant - pattern: '{{.word}}(=)' - source: log.panOSSCTPChunkSent - - - grok: - patterns: - - fieldName: log.panOSSCTPChunksRcv - pattern: '{{.greedy}}{{.space}}' - - fieldName: log.irrelevant - pattern: '{{.word}}(=)' - source: log.panOSSCTPChunksRcv - - - grok: - patterns: - - fieldName: log.panOSSCTPFilter - pattern: '{{.greedy}}{{.space}}' - - fieldName: log.irrelevant - pattern: '{{.word}}(=)' - source: log.panOSSCTPFilter - - - grok: - patterns: - - fieldName: log.panOSSCTPStreamID - pattern: '{{.greedy}}{{.space}}' - - fieldName: log.irrelevant - pattern: '{{.word}}(=)' - source: log.panOSSCTPStreamID - - - grok: - patterns: - - fieldName: log.panOSSCTPVerTag1 - pattern: '{{.greedy}}{{.space}}' - - fieldName: log.irrelevant - pattern: '{{.word}}(=)' - source: log.panOSSCTPVerTag1 - - - grok: - patterns: - - fieldName: log.panOSSCTPVerTag2 - pattern: '{{.greedy}}{{.space}}' - - fieldName: log.irrelevant - pattern: '{{.word}}(=)' - source: log.panOSSCTPVerTag2 - - - grok: - patterns: - - fieldName: log.panOSSequenceNo - pattern: '{{.greedy}}{{.space}}' - - fieldName: log.irrelevant - pattern: '{{.word}}(=)' - source: log.panOSSequenceNo - - - grok: - patterns: - - fieldName: log.panOSServerNameIndication - pattern: '{{.greedy}}{{.space}}' - - fieldName: log.irrelevant - pattern: '{{.word}}(=)' - source: log.panOSServerNameIndication - - - grok: - patterns: - - fieldName: log.panOSServingCntryMCC - pattern: '{{.greedy}}{{.space}}' - - fieldName: log.irrelevant - pattern: '{{.word}}(=)' - source: log.panOSServingCntryMCC - - - grok: - patterns: - - fieldName: log.panOSServingNetMNC - pattern: '{{.greedy}}{{.space}}' - - fieldName: log.irrelevant - pattern: '{{.word}}(=)' - source: log.panOSServingNetMNC - - - grok: - patterns: - - fieldName: log.panOSSeverity - pattern: '{{.greedy}}{{.space}}' - - fieldName: log.irrelevant - pattern: '{{.word}}(=)' - source: log.panOSSeverity - - - grok: - patterns: - - fieldName: log.panOSSNILength - pattern: '{{.greedy}}{{.space}}' - - fieldName: log.irrelevant - pattern: '{{.word}}(=)' - source: log.panOSSNILength - - - grok: - patterns: - - fieldName: log.panOSSourceDeviceCategory - pattern: '{{.greedy}}{{.space}}' - - fieldName: log.irrelevant - pattern: '{{.word}}(=)' - source: log.panOSSourceDeviceCategory - - - grok: - patterns: - - fieldName: log.panOSSourceDeviceHost - pattern: '{{.greedy}}{{.space}}' - - fieldName: log.irrelevant - pattern: '{{.word}}(=)' - source: log.panOSSourceDeviceHost - - - grok: - patterns: - - fieldName: log.panOSSourceDeviceMac - pattern: '{{.greedy}}{{.space}}' - - fieldName: log.irrelevant - pattern: '{{.word}}(=)' - source: log.panOSSourceDeviceMac - - - grok: - patterns: - - fieldName: log.panOSSourceDeviceModel - pattern: '{{.greedy}}{{.space}}' - - fieldName: log.irrelevant - pattern: '{{.word}}(=)' - source: log.panOSSourceDeviceModel - - - grok: - patterns: - - fieldName: log.panOSSourceDeviceOSFamily - pattern: '{{.greedy}}{{.space}}' - - fieldName: log.irrelevant - pattern: '{{.word}}(=)' - source: log.panOSSourceDeviceOSFamily - - - grok: - patterns: - - fieldName: log.panOSSourceDeviceOSVersion - pattern: '{{.greedy}}{{.space}}' - - fieldName: log.irrelevant - pattern: '{{.word}}(=)' - source: log.panOSSourceDeviceOSVersion - - - grok: - patterns: - - fieldName: log.panOSSourceDeviceProfile - pattern: '{{.greedy}}{{.space}}' - - fieldName: log.irrelevant - pattern: '{{.word}}(=)' - source: log.panOSSourceDeviceProfile - - - grok: - patterns: - - fieldName: log.panOSSourceDeviceVendor - pattern: '{{.greedy}}{{.space}}' - - fieldName: log.irrelevant - pattern: '{{.word}}(=)' - source: log.panOSSourceDeviceVendor - - - grok: - patterns: - - fieldName: log.panOSSourceDynamicAddressGroup - pattern: '{{.greedy}}{{.space}}' - - fieldName: log.irrelevant - pattern: '{{.word}}(=)' - source: log.panOSSourceDynamicAddressGroup - - - grok: - patterns: - - fieldName: log.panOSSourceEDL - pattern: '{{.greedy}}{{.space}}' - - fieldName: log.irrelevant - pattern: '{{.word}}(=)' - source: log.panOSSourceEDL - - - grok: - patterns: - - fieldName: log.panOSSourceHostname - pattern: '{{.greedy}}{{.space}}' - - fieldName: log.irrelevant - pattern: '{{.word}}(=)' - source: log.panOSSourceHostname - - - grok: - patterns: - - fieldName: log.panOSSourceMac - pattern: '{{.greedy}}{{.space}}' - - fieldName: log.irrelevant - pattern: '{{.word}}(=)' - source: log.panOSSourceMac - - - grok: - patterns: - - fieldName: log.panOSSourceRegion - pattern: '{{.greedy}}{{.space}}' - - fieldName: log.irrelevant - pattern: '{{.word}}(=)' - source: log.panOSSourceRegion - - - grok: - patterns: - - fieldName: log.panOSSourceUserName - pattern: '{{.greedy}}{{.space}}' - - fieldName: log.irrelevant - pattern: '{{.word}}(=)' - source: log.panOSSourceUserName - - - grok: - patterns: - - fieldName: log.panOSSourceUUID - pattern: '{{.greedy}}{{.space}}' - - fieldName: log.irrelevant - pattern: '{{.word}}(=)' - source: log.panOSSourceUUID - - - grok: - patterns: - - fieldName: log.panOSSrcUUID - pattern: '{{.greedy}}{{.space}}' - - fieldName: log.irrelevant - pattern: '{{.word}}(=)' - source: log.panOSSrcUUID - - - grok: - patterns: - - fieldName: log.panOSSSLResponseTime - pattern: '{{.greedy}}{{.space}}' - - fieldName: log.irrelevant - pattern: '{{.word}}(=)' - source: log.panOSSSLResponseTime - - - grok: - patterns: - - fieldName: log.panOSStage - pattern: '{{.greedy}}{{.space}}' - - fieldName: log.irrelevant - pattern: '{{.word}}(=)' - source: log.panOSStage - - - grok: - patterns: - - fieldName: log.panOSTagName - pattern: '{{.greedy}}{{.space}}' - - fieldName: log.irrelevant - pattern: '{{.word}}(=)' - source: log.panOSTagName - - - grok: - patterns: - - fieldName: log.panOSThreatCategory - pattern: '{{.greedy}}{{.space}}' - - fieldName: log.irrelevant - pattern: '{{.word}}(=)' - source: log.panOSThreatCategory - - - grok: - patterns: - - fieldName: log.panOSTimeGeneratedHighResolution - pattern: '{{.greedy}}{{.space}}' - - fieldName: log.irrelevant - pattern: '{{.word}}(=)' - source: log.panOSTimeGeneratedHighResolution - - - grok: - patterns: - - fieldName: log.panOSTimeNotAfter - pattern: '{{.greedy}}{{.space}}' - - fieldName: log.irrelevant - pattern: '{{.word}}(=)' - source: log.panOSTimeNotAfter - - - grok: - patterns: - - fieldName: log.panOSTimeNotBefore - pattern: '{{.greedy}}{{.space}}' - - fieldName: log.irrelevant - pattern: '{{.word}}(=)' - source: log.panOSTimeNotBefore - - - grok: - patterns: - - fieldName: log.panOSTimeout - pattern: '{{.greedy}}{{.space}}' - - fieldName: log.irrelevant - pattern: '{{.word}}(=)' - source: log.panOSTimeout - - - grok: - patterns: - - fieldName: log.panOSTimeReceivedManagementPlane - pattern: '{{.greedy}}{{.space}}' - - fieldName: log.irrelevant - pattern: '{{.word}}(=)' - source: log.panOSTimeReceivedManagementPlane - - - grok: - patterns: - - fieldName: log.panOSTLSAuth - pattern: '{{.greedy}}{{.space}}' - - fieldName: log.irrelevant - pattern: '{{.word}}(=)' - source: log.panOSTLSAuth - - - grok: - patterns: - - fieldName: log.panOSTLSEncryptionAlgorithm - pattern: '{{.greedy}}{{.space}}' - - fieldName: log.irrelevant - pattern: '{{.word}}(=)' - source: log.panOSTLSEncryptionAlgorithm - - - grok: - patterns: - - fieldName: log.panOSTLSKeyExchange - pattern: '{{.greedy}}{{.space}}' - - fieldName: log.irrelevant - pattern: '{{.word}}(=)' - source: log.panOSTLSKeyExchange - - - grok: - patterns: - - fieldName: log.panOSTLSVersion - pattern: '{{.greedy}}{{.space}}' - - fieldName: log.irrelevant - pattern: '{{.word}}(=)' - source: log.panOSTLSVersion - - - grok: - patterns: - - fieldName: log.panOSTrafficOriginRegion - pattern: '{{.greedy}}{{.space}}' - - fieldName: log.irrelevant - pattern: '{{.word}}(=)' - source: log.panOSTrafficOriginRegion - - - grok: - patterns: - - fieldName: log.panOSTrafficSessionID - pattern: '{{.greedy}}{{.space}}' - - fieldName: log.irrelevant - pattern: '{{.word}}(=)' - source: log.panOSTrafficSessionID - - - grok: - patterns: - - fieldName: log.panOSTunneInspectionRule - pattern: '{{.greedy}}{{.space}}' - - fieldName: log.irrelevant - pattern: '{{.word}}(=)' - source: log.panOSTunneInspectionRule - - - grok: - patterns: - - fieldName: log.panOSTunnel - pattern: '{{.greedy}}{{.space}}' - - fieldName: log.irrelevant - pattern: '{{.word}}(=)' - source: log.panOSTunnel - - - grok: - patterns: - - fieldName: log.panOSTunnelEndptID1 - pattern: '{{.greedy}}{{.space}}' - - fieldName: log.irrelevant - pattern: '{{.word}}(=)' - source: log.panOSTunnelEndptID1 - - - grok: - patterns: - - fieldName: log.panOSTunnelEndptID2 - pattern: '{{.greedy}}{{.space}}' - - fieldName: log.irrelevant - pattern: '{{.word}}(=)' - source: log.panOSTunnelEndptID2 - - - grok: - patterns: - - fieldName: log.panOSTunnelFragment - pattern: '{{.greedy}}{{.space}}' - - fieldName: log.irrelevant - pattern: '{{.word}}(=)' - source: log.panOSTunnelFragment - - - grok: - patterns: - - fieldName: log.panOSTunnelID - pattern: '{{.greedy}}{{.space}}' - - fieldName: log.irrelevant - pattern: '{{.word}}(=)' - source: log.panOSTunnelID - - - grok: - patterns: - - fieldName: log.panOSTunnelInspectionRule - pattern: '{{.greedy}}{{.space}}' - - fieldName: log.irrelevant - pattern: '{{.word}}(=)' - source: log.panOSTunnelInspectionRule - - - grok: - patterns: - - fieldName: log.panOSTunnelType - pattern: '{{.greedy}}{{.space}}' - - fieldName: log.irrelevant - pattern: '{{.word}}(=)' - source: log.panOSTunnelType - - - grok: - patterns: - - fieldName: log.panOSUGFlags - pattern: '{{.greedy}}{{.space}}' - - fieldName: log.irrelevant - pattern: '{{.word}}(=)' - source: log.panOSUGFlags - - - grok: - patterns: - - fieldName: log.panOSURLCatList - pattern: '{{.greedy}}{{.space}}' - - fieldName: log.irrelevant - pattern: '{{.word}}(=)' - source: log.panOSURLCatList - - - grok: - patterns: - - fieldName: log.panOSUserBySource - pattern: '{{.greedy}}{{.space}}' - - fieldName: log.irrelevant - pattern: '{{.word}}(=)' - source: log.panOSUserBySource - - - grok: - patterns: - - fieldName: log.panOSVirtualSystem - pattern: '{{.greedy}}{{.space}}' - - fieldName: log.irrelevant - pattern: '{{.word}}(=)' - source: log.panOSVirtualSystem - - - grok: - patterns: - - fieldName: log.panOSVsysName - pattern: '{{.greedy}}{{.space}}' - - fieldName: log.irrelevant - pattern: '{{.word}}(=)' - source: log.panOSVsysName - - - grok: - patterns: - - fieldName: log.panOSXForwarderfor - pattern: '{{.greedy}}{{.space}}' - - fieldName: log.irrelevant - pattern: '{{.word}}(=)' - source: log.panOSXForwarderfor - - - grok: - patterns: - - fieldName: log.panPartialHash - pattern: '{{.greedy}}{{.space}}' - - fieldName: log.irrelevant - pattern: '{{.word}}(=)' - source: log.panPartialHash - - - grok: - patterns: - - fieldName: log.panPODName - pattern: '{{.greedy}}{{.space}}' - - fieldName: log.irrelevant - pattern: '{{.word}}(=)' - source: log.panPODName - - - grok: - patterns: - - fieldName: log.panPODNamespace - pattern: '{{.greedy}}{{.space}}' - - fieldName: log.irrelevant - pattern: '{{.word}}(=)' - source: log.panPODNamespace - - - grok: - patterns: - - fieldName: log.panPolicyID - pattern: '{{.greedy}}{{.space}}' - - fieldName: log.irrelevant - pattern: '{{.word}}(=)' - source: log.panPolicyID - - - grok: - patterns: - - fieldName: log.panReasonFilteringAction - pattern: '{{.greedy}}{{.space}}' - - fieldName: log.irrelevant - pattern: '{{.word}}(=)' - source: log.panReasonFilteringAction - - - grok: - patterns: - - fieldName: log.panSDWANCluster - pattern: '{{.greedy}}{{.space}}' - - fieldName: log.irrelevant - pattern: '{{.word}}(=)' - source: log.panSDWANCluster - - - grok: - patterns: - - fieldName: log.panSDWANClustype - pattern: '{{.greedy}}{{.space}}' - - fieldName: log.irrelevant - pattern: '{{.word}}(=)' - source: log.panSDWANClustype - - - grok: - patterns: - - fieldName: log.panSDWANDevice - pattern: '{{.greedy}}{{.space}}' - - fieldName: log.irrelevant - pattern: '{{.word}}(=)' - source: log.panSDWANDevice - - - grok: - patterns: - - fieldName: log.panSDWANSite - pattern: '{{.greedy}}{{.space}}' - - fieldName: log.irrelevant - pattern: '{{.word}}(=)' - source: log.panSDWANSite - - - grok: - patterns: - - fieldName: log.panSrcDAG - pattern: '{{.greedy}}{{.space}}' - - fieldName: log.irrelevant - pattern: '{{.word}}(=)' - source: log.panSrcDAG - - - grok: - patterns: - - fieldName: log.panSrcDeviceCat - pattern: '{{.greedy}}{{.space}}' - - fieldName: log.irrelevant - pattern: '{{.word}}(=)' - source: log.panSrcDeviceCat - - - grok: - patterns: - - fieldName: log.panSrcDeviceModel - pattern: '{{.greedy}}{{.space}}' - - fieldName: log.irrelevant - pattern: '{{.word}}(=)' - source: log.panSrcDeviceModel - - - grok: - patterns: - - fieldName: log.panSrcDeviceOS - pattern: '{{.greedy}}{{.space}}' - - fieldName: log.irrelevant - pattern: '{{.word}}(=)' - source: log.panSrcDeviceOS - - - grok: - patterns: - - fieldName: log.panSrcDeviceOSv - pattern: '{{.greedy}}{{.space}}' - - fieldName: log.irrelevant - pattern: '{{.word}}(=)' - source: log.panSrcDeviceOSv - - - grok: - patterns: - - fieldName: log.panSrcDeviceProf - pattern: '{{.greedy}}{{.space}}' - - fieldName: log.irrelevant - pattern: '{{.word}}(=)' - source: log.panSrcDeviceProf - - - grok: - patterns: - - fieldName: log.panSrcDeviceVendor - pattern: '{{.greedy}}{{.space}}' - - fieldName: log.irrelevant - pattern: '{{.word}}(=)' - source: log.panSrcDeviceVendor - - - grok: - patterns: - - fieldName: log.panSrcEDL - pattern: '{{.greedy}}{{.space}}' - - fieldName: log.irrelevant - pattern: '{{.word}}(=)' - source: log.panSrcEDL - - - grok: - patterns: - - fieldName: log.panSrcHostname - pattern: '{{.greedy}}{{.space}}' - - fieldName: log.irrelevant - pattern: '{{.word}}(=)' - source: log.panSrcHostname - - - grok: - patterns: - - fieldName: log.panSrcMac - pattern: '{{.greedy}}{{.space}}' - - fieldName: log.irrelevant - pattern: '{{.word}}(=)' - source: log.panSrcMac - - - grok: - patterns: - - fieldName: log.panTimeHighRes - pattern: '{{.greedy}}{{.space}}' - - fieldName: log.irrelevant - pattern: '{{.word}}(=)' - source: log.panTimeHighRes - - - grok: - patterns: - - fieldName: log.panXFFIP - pattern: '{{.greedy}}{{.space}}' - - fieldName: log.irrelevant - pattern: '{{.word}}(=)' - source: log.panXFFIP - - - grok: - patterns: - - fieldName: log.proto - pattern: '{{.greedy}}{{.space}}' - - fieldName: log.irrelevant - pattern: '{{.word}}(=)' - source: log.proto - - - grok: - patterns: - - fieldName: log.reason - pattern: '{{.greedy}}{{.space}}' - - fieldName: log.irrelevant - pattern: '{{.word}}(=)' - source: log.reason - - - grok: - patterns: - - fieldName: log.request - pattern: '{{.greedy}}{{.space}}' - - fieldName: log.irrelevant - pattern: '{{.word}}(=)' - source: log.request - - - grok: - patterns: - - fieldName: log.requestContext - pattern: '{{.greedy}}{{.space}}' - - fieldName: log.irrelevant - pattern: '{{.word}}(=)' - source: log.requestContext - - - grok: - patterns: - - fieldName: log.requestMethod - pattern: '{{.greedy}}{{.space}}' - - fieldName: log.irrelevant - pattern: '{{.word}}(=)' - source: log.requestMethod - - - grok: - patterns: - - fieldName: log.rt - pattern: '{{.greedy}}{{.space}}' - - fieldName: log.irrelevant - pattern: '{{.word}}(=)' - source: log.rt - - - grok: - patterns: - - fieldName: log.shost - pattern: '{{.greedy}}{{.space}}' - - fieldName: log.irrelevant - pattern: '{{.word}}(=)' - source: log.shost - - - grok: - patterns: - - fieldName: log.sourceTranslatedAddress - pattern: '{{.greedy}}{{.space}}' - - fieldName: log.irrelevant - pattern: '{{.word}}(=)' - source: log.sourceTranslatedAddress - - - grok: - patterns: - - fieldName: log.sourceTranslatedPort - pattern: '{{.greedy}}{{.space}}' - - fieldName: log.irrelevant - pattern: '{{.word}}(=)' - source: log.sourceTranslatedPort - - - grok: - patterns: - - fieldName: log.spt - pattern: '{{.greedy}}{{.space}}' - - fieldName: log.irrelevant - pattern: '{{.word}}(=)' - source: log.spt - - - grok: - patterns: - - fieldName: log.src - pattern: '{{.greedy}}{{.space}}' - - fieldName: log.irrelevant - pattern: '{{.word}}(=)' - source: log.src - - - grok: - patterns: - - fieldName: log.start - pattern: '{{.greedy}}{{.space}}' - - fieldName: log.irrelevant - pattern: '{{.word}}(=)' - source: log.start - - - grok: - patterns: - - fieldName: log.suid - pattern: '{{.greedy}}{{.space}}' - - fieldName: log.irrelevant - pattern: '{{.word}}(=)' - source: log.suid - - - grok: - patterns: - - fieldName: log.suser - pattern: '{{.greedy}}{{.space}}' - - fieldName: log.irrelevant - pattern: '{{.word}}(=)' - source: log.suser - - #......................................................................# - # Remove issues fields - #......................................................................# - - delete: - fields: - - log.cefOrLeefMsgAll - - log.cefOrLeefMsg - - log.irrelevant - - #......................................................................# - # If CSV formatted log do the parsing of the message - #......................................................................# - - grok: - patterns: - - fieldName: log.priority - pattern: '\<{{.data}}\>' - - fieldName: log.syslogVersion - pattern: '{{.integer}}' - - fieldName: log.deviceTime - pattern: '{{.year}}-{{.monthNumber}}-{{.monthDay}}{{.space}}{{.time}}' - - fieldName: log.futureUse - pattern: '{{.integer}}' - - fieldName: log.csvMsgAll - pattern: '{{.greedy}}' - source: raw - - #......................................................................# - # Cleaning fields - #......................................................................# - - trim: - function: prefix - substring: '<' - fields: - - log.priority - - trim: - function: suffix - substring: '>' - fields: - - log.priority - - #......................................................................# - # Detect if its a TRAFFIC log - #......................................................................# - - csv: - source: log.csvMsgAll - separator: "," - headers: - - log.receive_time - - log.serial - - log.pa_type - - log.pa_subtype - - log.future_use - - log.time_generated - - log.src - - log.dst - - log.natsrc - - log.natdst - - log.rule - - log.srcuser - - log.dstuser - - log.app - - log.vsys - - log.from - - log.to - - log.inbound_if - - log.outbound_if - - log.logset - - log.future_use - - log.sessionid - - log.repeatcnt - - log.spt - - log.dpt - - log.natspt - - log.natdpt - - log.flags - - log.proto - - log.act - - log.bytes - - log.bytes_sent - - log.bytes_received - - log.packets - - log.start - - log.elapsed - - log.category - - log.future_use - - log.seqno - - log.actionflags - - log.srcloc - - log.dstloc - - log.future_use - - log.pkts_sent - - log.pkts_received - - log.session_end_reason - - log.dg_hier_level_1 - - log.dg_hier_level_2 - - log.dg_hier_level_3 - - log.dg_hier_level_4vsys_name - - log.device_name - - log.action_source - - log.src_uuid - - log.dst_uuid - - log.tunnelid_imsi - - log.monitortag_imei - - log.parent_session_id - - log.parent_start_time - - log.tunnel - - log.assoc_id - - log.chunks - - log.chunks_sent - - log.chunks_received - - log.rule_uuid - - log.http2_connection - - log.link_change_count - - log.policy_id - - log.link_switches - - log.sdwan_cluster - - log.sdwan_device_type - - log.sdwan_cluster_type - - log.sdwan_site - - log.dynusergroup_name - - log.xff_ip - - log.src_category - - log.src_profile - - log.src_model - - log.src_vendor - - log.src_osfamily - - log.src_osversion - - log.src_host - - log.src_mac - - log.dst_category - - log.dst_profile - - log.dst_model - - log.dst_vendor - - log.dst_osfamily - - log.dst_osversion - - log.dst_host - - log.dst_mac - - log.container_id - - log.pod_namespace - - log.pod_name - - log.src_edl - - log.dst_edl - - log.hostid - - log.serialnumber - - log.src_dag - - log.dst_dag - - log.session_owner - - log.high_res_timestamp - - log.nsdsai_sst - - log.nsdsai_sd - - log.subcategory_of_app - - log.category_of_app - - log.technology_of_app - - log.risk_of_app - - log.characteristic_of_app - - log.container_of_app - - log.tunneled_app - - log.is_saas_of_app - - log.sanctioned_state_of_app - - log.offloaded - where: regexMatch("log.csvMsgAll", "(.+),(\\s)?(TRAFFIC)(\\s)?,(\\s)?(start|end|drop|deny)(\\s)?,(.+)") - - #......................................................................# - # Detect if its a THREAT log in csvMsgAll - #......................................................................# - - csv: - source: log.csvMsgAll - separator: "," - headers: - - log.receive_time - - log.serial - - log.pa_type - - log.pa_subtype - - log.future_use - - log.time_generated - - log.src - - log.dst - - log.natsrc - - log.natdst - - log.rule - - log.srcuser - - log.dstuser - - log.app - - log.vsys - - log.from - - log.to - - log.inbound_if - - log.outbound_if - - log.logset - - log.future_use - - log.sessionid - - log.repeatcnt - - log.spt - - log.dpt - - log.natspt - - log.natdpt - - log.flags - - log.proto - - log.act - - log.misc - - log.pa_threatid - - log.category - - log.severityLabel - - log.direction - - log.seqno - - log.actionflags - - log.srcloc - - log.dstloc - - log.future_use - - log.contenttype - - log.pcap_id - - log.filedigest - - log.cloud - - log.url_idx - - log.user_agent - - log.filetype - - log.xff - - log.referer - - log.sender - - log.subject - - log.recipient - - log.reportid - - log.dg_hier_level_1 - - log.dg_hier_level_2 - - log.dg_hier_level_3 - - log.dg_hier_level_4 - - log.vsys_name - - log.device_name - - log.future_use - - log.src_uuid - - log.dst_uuid - - log.http_method - - log.tunnelid_imsi - - log.monitortag_imei - - log.parent_session_id - - log.parent_start_time - - log.tunnel - - log.thr_category - - log.contentver - - log.future_use - - log.assoc_id - - log.ppid - - log.http_headers - - log.url_category_list - - log.rule_uuid - - log.http2_connection - - log.dynusergroup_name - - log.xff_ip - - log.src_category - - log.src_profile - - log.src_model - - log.src_vendor - - log.src_osfamily - - log.src_osversion - - log.src_host - - log.src_mac - - log.dst_category - - log.dst_profile - - log.dst_model - - log.dst_vendor - - log.dst_osfamily - - log.dst_osversion - - log.dst_host - - log.dst_mac - - log.container_id - - log.pod_namespace - - log.pod_name - - log.src_edl - - log.dst_edl - - log.hostid - - log.serialnumber - - log.domain_edl - - log.src_dag - - log.dst_dag - - log.partial_hash - - log.high_res_timestamp - - log.reason - - log.justification - - log.nssai_sst - - log.subcategory_of_app - - log.category_of_app - - log.technology_of_app - - log.risk_of_app - - log.characteristic_of_app - - log.container_of_app - - log.tunneled_app - - log.is_saas_of_app - - log.sanctioned_state_of_app - - log.cloud_reportid - where: regexMatch("log.csvMsgAll", "(.+),(\\s)?(THREAT)(\\s)?,(\\s)?(data|DLP|DLP-NON-FILE|FILE|file|flood|packet|scan|spyware|URL|ml-virus|virus|vulnerability|wildfire|wildfire-virus)(\\s)?,(.+)") - - #......................................................................# - # Detect if its a HIP-MATCH log in csvMsgAll - #......................................................................# - - csv: - source: log.csvMsgAll - separator: "," - headers: - - log.receive_time - - log.serial - - log.pa_type - - log.pa_subtype - - log.future_use - - log.time_generated - - log.srcuser - - log.vsys - - log.machinename - - log.os - - log.src - - log.matchname - - log.repeatcnt - - log.matchtype - - log.future_use - - log.future_use - - log.seqno - - log.actionflags - - log.dg_hier_level_1 - - log.dg_hier_level_2 - - log.dg_hier_level_3 - - log.dg_hier_level_4 - - log.vsys_name - - log.device_name - - log.vsys_id - - log.srcipv6 - - log.hostid - - log.serialnumber - - log.mac - - log.high_res_timestamp - where: regexMatch("log.csvMsgAll", "(.+),(\\s)?(HIP-MATCH)(\\s)?,(.+)") - - # ..........................................................................# - # Detect if its a GLOBALPROTECT log - # ..........................................................................# - - csv: - source: log.csvMsgAll - separator: ',' - headers: - - log.receive_time - - log.serial - - log.pa_type - - log.pa_subtype - - log.future_use - - log.time_generated - - log.vsys - - log.eventid - - log.stage - - log.auth_method - - log.tunnel_type - - log.srcuser - - log.srcregion - - log.machinename - - log.public_ip - - log.public_ipv6 - - log.private_ip - - log.private_ipv6 - - log.hostid - - log.serialnumber - - log.client_ver - - log.client_os - - log.client_os_ver - - log.repeatcnt - - log.reason - - log.error - - log.opaque - - log.status - - log.location - - log.PanOSLoginDuration - - log.connect_method - - log.error_code - - log.portal - - log.seqno - - log.actionflags - - log.high_res_timestamp - - log.selection_type - - log.response_time - - log.priority - - log.attempted_gateways - - log.gateway - - log.dg_hier_level_1 - - log.dg_hier_level_2 - - log.dg_hier_level_3 - - log.dg_hier_level_4 - - log.vsys_name - - log.device_name - - log.vsys_id - where: regexMatch("log.csvMsgAll", "(.+),(\\s)?(GLOBALPROTECT)(\\s)?,(\\s)?(data|file|flood|packet|scan|spyware|URL|virus|vulnerability|wildfire|wildfire-virus)(\\s)?,(.+)") - - # ..........................................................................# - # Detect if its a IPTAG log - # ..........................................................................# - - csv: - source: log.csvMsgAll - separator: ',' - headers: - - log.receive_time - - log.serial - - log.pa_type - - log.pa_subtype - - log.future_use - - log.time_generated - - log.vsys - - log.src - - log.tag_name - - log.eventid - - log.repeatcnt - - log.timeout - - log.datasourcename - - log.datasource_type - - log.datasource_subtype - - log.seqno - - log.actionflags - - log.dg_hier_level_1 - - log.dg_hier_level_2 - - log.dg_hier_level_3 - - log.dg_hier_level_4 - - log.vsys_name - - log.device_name - - log.vsys_id - - log.high_res_timestamp - where: regexMatch("log.csvMsgAll", "(.+),(\\s)?(IPTAG)(\\s)?,(.+)") - - # ..........................................................................# - # Detect if its a USERID log - # ..........................................................................# - - csv: - source: log.csvMsgAll - separator: ',' - headers: - - log.receive_time - - log.serial - - log.pa_type - - log.pa_subtype - - log.future_use - - log.time_generated - - log.vsys - - log.src - - log.user - - log.datasourcename - - log.eventid - - log.repeatcnt - - log.timeout - - log.beginport - - log.endport - - log.datasource - - log.datasource_type - - log.seqno - - log.actionflags - - log.dg_hier_level_1 - - log.dg_hier_level_2 - - log.dg_hier_level_3 - - log.dg_hier_level_4 - - log.vsys_name - - log.device_name - - log.vsys_id - - log.factortype - - log.factorcompletiontime - - log.factorno - - log.future_use - - log.future_use - - log.ugflags - - log.userbysource - - log.high_res_timestamp - where: regexMatch("log.csvMsgAll", "(.+),(\\s)?(USERID)(\\s)?,(\\s)?(login|logout|register-tag|unregister-tag)(\\s)?,(.+)") - - # ..........................................................................# - # Detect if its a DECRYPTION log - # ..........................................................................# - - csv: - source: log.csvMsgAll - separator: "," - headers: - - log.receive_time - - log.serial - - log.pa_type - - log.pa_subtype - - log.config_ver - - log.time_generated - - log.src - - log.dst - - log.natsrc - - log.natdst - - log.rule - - log.srcuser - - log.dstuser - - log.app - - log.vsys - - log.from - - log.to - - log.inbound_if - - log.outbound_if - - log.logset - - log.time_received - - log.sessionid - - log.repeatcnt - - log.spt - - log.dpt - - log.natspt - - log.natdpt - - log.flags - - log.proto - - log.act - - log.tunnel - - log.future_use - - log.future_use - - log.src_uuid - - log.dst_uuid - - log.rule_uuid - - log.hs_stage_c2f - - log.hs_stage_f2s - - log.tls_version - - log.tls_keyxchg - - log.tls_enc - - log.tls_auth - - log.policy_name - - log.ec_curve - - log.err_index - - log.root_status - - log.chain_status - - log.proxy_type - - log.cert_serial - - log.fingerprint - - log.notbefore - - log.notafter - - log.cert_ver - - log.cert_size - - log.cn_len - - log.issuer_len - - log.rootcn_len - - log.sni_len - - log.cert_flags - - log.cn - - log.issuer_cn - - log.root_cn - - log.sni - - log.error - - log.container_id - - log.pod_namespace - - log.pod_name - - log.src_edl - - log.dst_edl - - log.src_dag - - log.dst_dag - - log.high_res_timestamp - - log.src_category - - log.src_profile - - log.src_model - - log.src_vendor - - log.src_osfamily - - log.src_osversion - - log.src_host - - log.src_mac - - log.dst_category - - log.dst_profile - - log.dst_model - - log.dst_vendor - - log.dst_osfamily - - log.dst_osversion - - log.dst_host - - log.dst_mac - - log.seqno - - log.actionflags - - log.dg_hier_level_1 - - log.dg_hier_level_2 - - log.dg_hier_level_3 - - log.dg_hier_level_4 - - log.vsys_name - - log.device_name - - log.vsys_id - - log.subcategory_of_app - - log.category_of_app - - log.technology_of_app - - log.risk_of_app - - log.characteristic_of_app - - log.container_of_app - - log.is_saas_of_app - - log.sanctioned_state_of_app - where: regexMatch("log.csvMsgAll", "(.+),(\\s)?(DECRYPTION)(\\s)?,(.+),(\\s)?(allow|deny|drop|drop ICMP|reset both|reset client|reset server)(\\s)?,(.+)") - - # ..........................................................................# - # Detect if its a TUNNEL INSPECTION log - # ..........................................................................# - - csv: - source: log.csvMsgAll - separator: "," - headers: - - log.receive_time - - log.serial - - log.pa_type - - log.pa_subtype - - log.future_use - - log.time_generated - - log.src - - log.dst - - log.natsrc - - log.natdst - - log.rule - - log.srcuser - - log.dstuser - - log.app - - log.vsys - - log.from - - log.to - - log.inbound_if - - log.outbound_if - - log.logset - - log.future_use - - log.sessionid - - log.repeatcnt - - log.spt - - log.dpt - - log.natspt - - log.natdpt - - log.flags - - log.proto - - log.act - - log.severityLabel - - log.seqno - - log.actionflags - - log.srcloc - - log.dstloc - - log.dg_hier_level_1 - - log.dg_hier_level_2 - - log.dg_hier_level_3 - - log.dg_hier_level_4 - - log.vsys_name - - log.device_name - - log.tunnelid - - log.monitortag - - log.parent_session_id - - log.parent_start_time - - log.tunnel - - log.bytes - - log.bytes_sent - - log.bytes_received - - log.packets - - log.pkts_sent - - log.pkts_received - - log.max_encap - - log.unknown_proto - - log.strict_check - - log.tunnel_fragment - - log.sessions_created - - log.sessions_closed - - log.session_end_reason - - log.action_source - - log.start - - log.elapsed - - log.tunnel_insp_rule - - log.remote_user_ip - - log.remote_user_id - - log.rule_uuid - - log.pcap_id - - log.dynusergroup_name - - log.src_edl - - log.dst_edl - - log.high_res_timestamp - - log.nssai_sd - - log.nssai_sd - - log.pdu_session_id - - log.subcategory_of_app - - log.category_of_app - - log.technology_of_app - - log.risk_of_app - - log.characteristic_of_app - - log.container_of_app - - log.is_saas_of_app - - log.sanctioned_state_of_app - where: regexMatch("log.csvMsgAll", "(.+),(\\s)?(START|END)(\\s)?,(\\s)?(start|end|drop|deny)(\\s)?,(.+)") - - # ..........................................................................# - # Detect if its a SCTP log - # ..........................................................................# - - csv: - source: log.csvMsgAll - separator: "," - headers: - - log.receive_time - - log.serial - - log.pa_type - - log.future_use - - log.future_use - - log.time_generated - - log.src - - log.dst - - log.future_use - - log.future_use - - log.rule - - log.future_use - - log.future_use - - log.future_use - - log.vsys - - log.from - - log.to - - log.inbound_if - - log.outbound_if - - log.logset - - log.future_use - - log.sessionid - - log.repeatcnt - - log.spt - - log.dpt - - log.future_use - - log.future_use - - log.future_use - - log.future_use - - log.proto - - log.act - - log.dg_hier_level_1 - - log.dg_hier_level_2 - - log.dg_hier_level_3 - - log.dg_hier_level_4 - - log.vsys_name - - log.device_name - - log.seqno - - log.future_use - - log.assoc_id - - log.ppid - - log.severityLabel - - log.sctp_chunk_type - - log.future_use - - log.verif_tag_1 - - log.verif_tag_2 - - log.sctp_cause_code - - log.diam_app_id - - log.diam_cmd_code - - log.diam_avp_code - - log.stream_id - - log.assoc_end_reason - - log.op_code - - log.sccp_calling_ssn - - log.sccp_calling_gt - - log.sctp_filter - - log.chunks - - log.chunks_sent - - log.chunks_received - - log.packets - - log.pkts_sent - - log.pkts_received - - log.rule_uuid - - log.high_res_timestamp - where: regexMatch("log.csvMsgAll", "(.+),(\\s)?(SCTP)(\\s)?,(.+),(\\s)?(allow|deny)(\\s)?,(.+)") - - #......................................................................# - # Detect if its a CONFIG log - #......................................................................# - - csv: - source: log.csvMsgAll - separator: ',' - headers: - - log.receive_time - - log.serial - - log.pa_type - - log.pa_subtype - - log.future_use - - log.time_generated - - log.host - - log.vsys - - log.cmd - - log.admin - - log.client - - log.result - - log.path - - log.before_change_detail - - log.after_change_detail - - log.seqno - - log.actionflags - - log.dg_hier_level_1 - - log.dg_hier_level_2 - - log.dg_hier_level_3 - - log.dg_hier_level_4 - - log.vsys_name - - log.device_name - - log.dg_id - - log.comment - - log.high_res_timestamp - where: regexMatch("log.csvMsgAll", "(.+),(\\s)?(CONFIG)(\\s)?,(.+),(\\s)?(add|clone|commit|delete|edit|move|rename|set)(\\s)?,(.+)") - - #......................................................................# - # Detect if its a AUTHENTICATION log - #......................................................................# - - csv: - source: log.csvMsgAll - separator: ',' - headers: - - log.receive_time - - log.serial - - log.pa_type - - log.pa_subtype - - log.future_use - - log.time_generated - - log.vsys - - log.src - - log.user - - log.normalize_user - - log.object - - log.authpolicy - - log.repeatcnt - - log.authid - - log.vendor - - log.logset - - log.serverprofile - - log.desc - - log.clienttype - - log.event - - log.factorno - - log.seqno - - log.actionflags - - log.dg_hier_level_1 - - log.dg_hier_level_2 - - log.dg_hier_level_3 - - log.dg_hier_level_4 - - log.vsys_name - - log.device_name - - log.vsys_id - - log.authproto - - log.rule_uuid - - log.high_res_timestamp - - log.src_category - - log.src_profile - - log.src_model - - log.src_vendor - - log.src_osfamily - - log.src_osversion - - log.src_host - - log.src_mac - - log.region - - log.user_agent - - log.sessionid - where: regexMatch("log.csvMsgAll", "(.+),(\\s)?(AUTHENTICATION)(\\s)?,(\\s)?(crypto|dhcp|dnsproxy|dos|general|global-protect|ha|hw|nat|ntpd|pbf|port|pppoe|ras|routing|satd|sslmgr|sslvpn|userid|url-filtering|vpn)(\\s)?,(.+)") - - #......................................................................# - # Detect if its a SYSTEM log - #......................................................................# - - csv: - source: log.csvMsgAll - separator: ',' - headers: - - log.receive_time - - log.serial - - log.pa_type - - log.pa_subtype - - log.future_use - - log.time_generated - - log.vsys - - log.eventid - - log.object - - log.future_use - - log.future_use - - log.module - - log.severityLabel - - log.opaque - - log.seqno - - log.actionflags - - log.dg_hier_level_1 - - log.dg_hier_level_2 - - log.dg_hier_level_3 - - log.dg_hier_level_4 - - log.vsys_name - - log.device_name - - log.future_use - - log.future_use - - log.high_res_timestamp - where: regexMatch("log.csvMsgAll", "(.+),(\\s)?(SYSTEM)(\\s)?,(\\s)?(crypto|dhcp|dnsproxy|dos|general|global-protect|ha|hw|nat|ntpd|pbf|port|pppoe|ras|routing|satd|sslmgr|sslvpn|userid|url-filtering|vpn)(\\s)?,(.+)") - - #......................................................................# - # Detect if its a CORRELATED EVENTS log - #......................................................................# - - csv: - source: log.csvMsgAll - separator: "," - headers: - - log.receive_time - - log.serial - - log.pa_type - - log.pa_subtype - - log.future_use - - log.time_generated - - log.src - - log.srcuser - - log.vsys - - log.category - - log.severityLabel - - log.dg_hier_level_1 - - log.dg_hier_level_2 - - log.dg_hier_level_3 - - log.dg_hier_level_4 - - log.vsys_name - - log.device_name - - log.vsys_id - - log.objectname - - log.object_id - - log.evidence - where: regexMatch("log.csvMsgAll", "(.+),(\\s)?(CORRELATION)(\\s)?,(\\s)?(crypto|dhcp|dnsproxy|dos|general|global-protect|ha|hw|nat|ntpd|pbf|port|pppoe|ras|routing|satd|sslmgr|sslvpn|userid|url-filtering|vpn)(\\s)?,(.+)") - - #......................................................................# - # Detect if its a GTP log - #......................................................................# - - csv: - source: log.csvMsgAll - separator: "," - headers: - - log.receive_time - - log.serial - - log.pa_type - - log.pa_subtype - - log.future_use - - log.time_generated - - log.src - - log.dst - - log.future_use - - log.future_use - - log.rule - - log.future_use - - log.future_use - - log.app - - log.vsys - - log.from - - log.to - - log.inbound_if - - log.outbound_if - - log.logset - - log.future_use - - log.sessionid - - log.repeatcnt - - log.spt - - log.dpt - - log.future_use - - log.future_use - - log.proto - - log.act - - log.event_type - - log.msisdn - - log.apn - - log.rat - - log.msg_type - - log.end_ip_adr - - log.teid1 - - log.teid2 - - log.gtp_interface - - log.cause_code - - log.severityLabel - - log.mcc - - log.mnc - - log.area_code - - log.cell_id - - log.event_code - - log.future_use - - log.future_use - - log.srcloc - - log.dstloc - - log.future_use - - log.future_use - - log.future_use - - log.future_use - - log.imsi - - log.imei - - log.future_use - - log.future_use - - log.future_use - - log.future_use - - log.future_use - - log.future_use - - log.high_res_timestamp - where: regexMatch("log.csvMsgAll", "(.+),(\\s)?(GTP)(\\s)?,(\\s)?(start|end|drop|deny)(\\s)?,(.+)") - - # ................................................# - # Rename fields - # ................................................# - - rename: - from: - - log.src - to: origin.ip - - - rename: - from: - - log.dst - to: target.ip - - - rename: - from: - - log.dpt - to: target.port - - - rename: - from: - - log.spt - to: origin.port - - - rename: - from: - - log.srcuser - to: origin.user - - - rename: - from: - - log.dstuser - to: target.user - - - rename: - from: - - log.proto - to: protocol - - - rename: - from: - - log.act - to: action - - - rename: - from: - - log.bytessent - to: target.bytesSent - - - rename: - from: - - log.bytesreceived - to: target.bytesReceived - - - rename: - from: - - log.pktssent - to: target.packagesSent - - - rename: - from: - - log.pktsreceived - to: target.packagesReceived - - - rename: - from: - - log.srchost - to: origin.host - - - rename: - from: - - log.srcmac - to: origin.mac - - - rename: - from: - - log.dsthost - to: target.host - - - rename: - from: - - log.dstmac - to: target.mac - - # ................................................# - # Adding action result - # ................................................# - - add: - function: string - params: - key: actionResult - value: "allow" - where: '!exists("log.status") && equalsIgnoreCase("action", "allow")' - - - add: - function: string - params: - key: actionResult - value: "denied" - where: '!exists("log.status") && oneOf("action", ["deny", "Deny"])' - - - add: - function: string - params: - key: actionResult - value: "blocked" - where: '!exists("log.status") && oneOf("action", ["drop", "Drop", "reset-client", "reset-server", "reset-both", "block-url", "block-ip", "random-drop", "sinkhole"])' - - - add: - function: string - params: - key: actionResult - value: "Succeeded" - where: '!exists("log.status") && oneOf("log.result", ["Succeeded", "Submitted"])' - - - add: - function: string - params: - key: actionResult - value: "failed" - where: '!exists("log.status") && oneOf("log.result", ["Failed", "Unauthorized"])' - - - add: - function: string - params: - key: actionResult - value: "success" - where: 'equals("log.status", "success")' - - - add: - function: string - params: - key: actionResult - value: "failed" - where: 'equals("log.status", "failure")' - - # ................................................# - # Fileds conversions - # ................................................# - - cast: - fields: - - target.bytesSent - - target.bytesReceived - to: float - - - cast: - fields: - - target.packagesSent - - target.packagesReceived - to: int - - - cast: - fields: - - target.port - - origin.port - to: int - - # Adding geolocation to origin.ip - - dynamic: - plugin: com.utmstack.geolocation - params: - source: origin.ip - destination: origin.geolocation - where: exists("origin.ip") - - # Adding geolocation to target.ip - - dynamic: - plugin: com.utmstack.geolocation - params: - source: target.ip - destination: target.geolocation - where: exists("target.ip") - - # ..........................................................................# - # Remove issues fileds - # ..........................................................................# - - delete: - fields: - - log.csvMsgAll +- dataTypes: + - firewall-paloalto + steps: + - delete: + fields: + - log.correlationCandidate.paloalto + - log.paScope + - log.paVsys + - log.paURLLayout + - log.paConfigLayout + - log.paDirection + - log.paFormat + - log.paPayload + - log.paCefExtensions + - log.paCefSignature + - log.pa_type + - log.pa_subtype + - grok: + source: raw + patterns: + - fieldName: log.paEnvelope + pattern: '^<[0-9]{1,3}>[A-Z][a-z]{2} +[0-9]{1,2} [0-9]{2}:[0-9]{2}:[0-9]{2} [^ ]+ ' + - fieldName: log.paPayload + pattern: (?:[0-9]*,[0-9]{4}/[0-9]{2}/[0-9]{2} [0-9]{2}:[0-9]{2}:[0-9]{2},[^,]*,[A-Z][A-Z0-9-]*,|(?:CEF|LEEF):[0-9]+\|Palo + Alto Networks\|PAN-OS\|).*$ + where: '!exists("log.paPayload")' + - grok: + source: raw + patterns: + - fieldName: log.paEnvelope + pattern: '^<[0-9]{1,3}>[1-9][0-9]* [^ ]+ [^ ]+ [^ ]+ [^ ]+ [^ ]+ (?:-|\[(?:\\.|[^\]\\])*\](?:\[(?:\\.|[^\]\\])*\])*) ' + - fieldName: log.paPayload + pattern: (?:[0-9]*,[0-9]{4}/[0-9]{2}/[0-9]{2} [0-9]{2}:[0-9]{2}:[0-9]{2},[^,]*,[A-Z][A-Z0-9-]*,|(?:CEF|LEEF):[0-9]+\|Palo + Alto Networks\|PAN-OS\|).*$ + where: '!exists("log.paPayload")' + - grok: + source: raw + patterns: + - fieldName: log.paEnvelope + pattern: ^(?:<[0-9]{1,3}>)? + - fieldName: log.paPayload + pattern: (?:[0-9]*,[0-9]{4}/[0-9]{2}/[0-9]{2} [0-9]{2}:[0-9]{2}:[0-9]{2},[^,]*,[A-Z][A-Z0-9-]*,|(?:CEF|LEEF):[0-9]+\|Palo + Alto Networks\|PAN-OS\|).*$ + where: '!exists("log.paPayload")' + - add: + function: string + params: + key: log.paFormat + value: CSV + where: regexMatch("log.paPayload", "^[0-9]*,[0-9]{4}/[0-9]{2}/[0-9]{2} ") + - add: + function: string + params: + key: log.paFormat + value: CEF + where: regexMatch("log.paPayload", "^CEF:[0-9]+\\|Palo Alto Networks\\|PAN-OS\\|") + - add: + function: string + params: + key: log.paFormat + value: LEEF-legacy + where: regexMatch("log.paPayload", "^LEEF:[0-9]+\\|Palo Alto Networks\\|PAN-OS\\|") + - grok: + source: log.paPayload + patterns: + - fieldName: log.paCefPrefix + pattern: ^(?:CEF|LEEF):[0-9]+\|Palo Alto Networks\|PAN-OS\| + - fieldName: log.paSenderSwVersion + pattern: (?:\\.|[^|\\])* + - fieldName: log.paSep1 + pattern: \| + - fieldName: log.paCefSignature + pattern: (?:\\.|[^|\\])* + - fieldName: log.paSep2 + pattern: \| + - fieldName: log.pa_type + pattern: '[A-Z][A-Z0-9-]*' + - fieldName: log.paSep3 + pattern: \| + - fieldName: log.severityLabel + pattern: '[^|]*' + - fieldName: log.paSep4 + pattern: \| + - fieldName: log.paCefExtensions + pattern: .*$ + where: oneOf("log.paFormat", ["CEF", "LEEF-legacy"]) + - grok: + source: log.paCefExtensions + patterns: + - fieldName: log.paIgnored + pattern: ^(?:[A-Za-z][A-Za-z0-9_]*=(?:\\.|[^=\\])*?[ \t]+)*?DNSSICategory= + - fieldName: log.DNSSICategory + pattern: (?:\\.|[^=\\])*? + - fieldName: log.paSuffix + pattern: (?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) + where: oneOf("log.paFormat", ["CEF", "LEEF-legacy"]) + - grok: + source: log.paCefExtensions + patterns: + - fieldName: log.paIgnored + pattern: ^(?:[A-Za-z][A-Za-z0-9_]*=(?:\\.|[^=\\])*?[ \t]+)*?ModuleflexString2= + - fieldName: log.ModuleflexString2 + pattern: (?:\\.|[^=\\])*? + - fieldName: log.paSuffix + pattern: (?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) + where: oneOf("log.paFormat", ["CEF", "LEEF-legacy"]) + - grok: + source: log.paCefExtensions + patterns: + - fieldName: log.paIgnored + pattern: ^(?:[A-Za-z][A-Za-z0-9_]*=(?:\\.|[^=\\])*?[ \t]+)*?PanASServiceDiff= + - fieldName: log.PanASServiceDiff + pattern: (?:\\.|[^=\\])*? + - fieldName: log.paSuffix + pattern: (?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) + where: oneOf("log.paFormat", ["CEF", "LEEF-legacy"]) + - grok: + source: log.paCefExtensions + patterns: + - fieldName: log.paIgnored + pattern: ^(?:[A-Za-z][A-Za-z0-9_]*=(?:\\.|[^=\\])*?[ \t]+)*?PanASServiceType= + - fieldName: log.PanASServiceType + pattern: (?:\\.|[^=\\])*? + - fieldName: log.paSuffix + pattern: (?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) + where: oneOf("log.paFormat", ["CEF", "LEEF-legacy"]) + - grok: + source: log.paCefExtensions + patterns: + - fieldName: log.paIgnored + pattern: ^(?:[A-Za-z][A-Za-z0-9_]*=(?:\\.|[^=\\])*?[ \t]+)*?PanContainerName= + - fieldName: log.PanContainerName + pattern: (?:\\.|[^=\\])*? + - fieldName: log.paSuffix + pattern: (?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) + where: oneOf("log.paFormat", ["CEF", "LEEF-legacy"]) + - grok: + source: log.paCefExtensions + patterns: + - fieldName: log.paIgnored + pattern: ^(?:[A-Za-z][A-Za-z0-9_]*=(?:\\.|[^=\\])*?[ \t]+)*?PanDomainEDL= + - fieldName: log.PanDomainEDL + pattern: (?:\\.|[^=\\])*? + - fieldName: log.paSuffix + pattern: (?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) + where: oneOf("log.paFormat", ["CEF", "LEEF-legacy"]) + - grok: + source: log.paCefExtensions + patterns: + - fieldName: log.paIgnored + pattern: ^(?:[A-Za-z][A-Za-z0-9_]*=(?:\\.|[^=\\])*?[ \t]+)*?PanDstDAG= + - fieldName: log.PanDstDAG + pattern: (?:\\.|[^=\\])*? + - fieldName: log.paSuffix + pattern: (?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) + where: oneOf("log.paFormat", ["CEF", "LEEF-legacy"]) + - grok: + source: log.paCefExtensions + patterns: + - fieldName: log.paIgnored + pattern: ^(?:[A-Za-z][A-Za-z0-9_]*=(?:\\.|[^=\\])*?[ \t]+)*?PanDstDeviceCat= + - fieldName: log.PanDstDeviceCat + pattern: (?:\\.|[^=\\])*? + - fieldName: log.paSuffix + pattern: (?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) + where: oneOf("log.paFormat", ["CEF", "LEEF-legacy"]) + - grok: + source: log.paCefExtensions + patterns: + - fieldName: log.paIgnored + pattern: ^(?:[A-Za-z][A-Za-z0-9_]*=(?:\\.|[^=\\])*?[ \t]+)*?PanDstDeviceModel= + - fieldName: log.PanDstDeviceModel + pattern: (?:\\.|[^=\\])*? + - fieldName: log.paSuffix + pattern: (?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) + where: oneOf("log.paFormat", ["CEF", "LEEF-legacy"]) + - grok: + source: log.paCefExtensions + patterns: + - fieldName: log.paIgnored + pattern: ^(?:[A-Za-z][A-Za-z0-9_]*=(?:\\.|[^=\\])*?[ \t]+)*?PanDstDeviceOS= + - fieldName: log.PanDstDeviceOS + pattern: (?:\\.|[^=\\])*? + - fieldName: log.paSuffix + pattern: (?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) + where: oneOf("log.paFormat", ["CEF", "LEEF-legacy"]) + - grok: + source: log.paCefExtensions + patterns: + - fieldName: log.paIgnored + pattern: ^(?:[A-Za-z][A-Za-z0-9_]*=(?:\\.|[^=\\])*?[ \t]+)*?PanDstDeviceOSv= + - fieldName: log.PanDstDeviceOSv + pattern: (?:\\.|[^=\\])*? + - fieldName: log.paSuffix + pattern: (?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) + where: oneOf("log.paFormat", ["CEF", "LEEF-legacy"]) + - grok: + source: log.paCefExtensions + patterns: + - fieldName: log.paIgnored + pattern: ^(?:[A-Za-z][A-Za-z0-9_]*=(?:\\.|[^=\\])*?[ \t]+)*?PanDstDeviceProf= + - fieldName: log.PanDstDeviceProf + pattern: (?:\\.|[^=\\])*? + - fieldName: log.paSuffix + pattern: (?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) + where: oneOf("log.paFormat", ["CEF", "LEEF-legacy"]) + - grok: + source: log.paCefExtensions + patterns: + - fieldName: log.paIgnored + pattern: ^(?:[A-Za-z][A-Za-z0-9_]*=(?:\\.|[^=\\])*?[ \t]+)*?PanDstDeviceVendor= + - fieldName: log.PanDstDeviceVendor + pattern: (?:\\.|[^=\\])*? + - fieldName: log.paSuffix + pattern: (?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) + where: oneOf("log.paFormat", ["CEF", "LEEF-legacy"]) + - grok: + source: log.paCefExtensions + patterns: + - fieldName: log.paIgnored + pattern: ^(?:[A-Za-z][A-Za-z0-9_]*=(?:\\.|[^=\\])*?[ \t]+)*?PanDstEDL= + - fieldName: log.PanDstEDL + pattern: (?:\\.|[^=\\])*? + - fieldName: log.paSuffix + pattern: (?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) + where: oneOf("log.paFormat", ["CEF", "LEEF-legacy"]) + - grok: + source: log.paCefExtensions + patterns: + - fieldName: log.paIgnored + pattern: ^(?:[A-Za-z][A-Za-z0-9_]*=(?:\\.|[^=\\])*?[ \t]+)*?PanDstHostname= + - fieldName: log.PanDstHostname + pattern: (?:\\.|[^=\\])*? + - fieldName: log.paSuffix + pattern: (?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) + where: oneOf("log.paFormat", ["CEF", "LEEF-legacy"]) + - grok: + source: log.paCefExtensions + patterns: + - fieldName: log.paIgnored + pattern: ^(?:[A-Za-z][A-Za-z0-9_]*=(?:\\.|[^=\\])*?[ \t]+)*?PanDstMac= + - fieldName: log.PanDstMac + pattern: (?:\\.|[^=\\])*? + - fieldName: log.paSuffix + pattern: (?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) + where: oneOf("log.paFormat", ["CEF", "LEEF-legacy"]) + - grok: + source: log.paCefExtensions + patterns: + - fieldName: log.paIgnored + pattern: ^(?:[A-Za-z][A-Za-z0-9_]*=(?:\\.|[^=\\])*?[ \t]+)*?PanDynamicUsrgrp= + - fieldName: log.PanDynamicUsrgrp + pattern: (?:\\.|[^=\\])*? + - fieldName: log.paSuffix + pattern: (?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) + where: oneOf("log.paFormat", ["CEF", "LEEF-legacy"]) + - grok: + source: log.paCefExtensions + patterns: + - fieldName: log.paIgnored + pattern: ^(?:[A-Za-z][A-Za-z0-9_]*=(?:\\.|[^=\\])*?[ \t]+)*?PanEPSerial= + - fieldName: log.PanEPSerial + pattern: (?:\\.|[^=\\])*? + - fieldName: log.paSuffix + pattern: (?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) + where: oneOf("log.paFormat", ["CEF", "LEEF-legacy"]) + - grok: + source: log.paCefExtensions + patterns: + - fieldName: log.paIgnored + pattern: ^(?:[A-Za-z][A-Za-z0-9_]*=(?:\\.|[^=\\])*?[ \t]+)*?PanGPHostID= + - fieldName: log.PanGPHostID + pattern: (?:\\.|[^=\\])*? + - fieldName: log.paSuffix + pattern: (?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) + where: oneOf("log.paFormat", ["CEF", "LEEF-legacy"]) + - grok: + source: log.paCefExtensions + patterns: + - fieldName: log.paIgnored + pattern: ^(?:[A-Za-z][A-Za-z0-9_]*=(?:\\.|[^=\\])*?[ \t]+)*?PanHASessionOwner= + - fieldName: log.PanHASessionOwner + pattern: (?:\\.|[^=\\])*? + - fieldName: log.paSuffix + pattern: (?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) + where: oneOf("log.paFormat", ["CEF", "LEEF-legacy"]) + - grok: + source: log.paCefExtensions + patterns: + - fieldName: log.paIgnored + pattern: ^(?:[A-Za-z][A-Za-z0-9_]*=(?:\\.|[^=\\])*?[ \t]+)*?PanJustification= + - fieldName: log.PanJustification + pattern: (?:\\.|[^=\\])*? + - fieldName: log.paSuffix + pattern: (?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) + where: oneOf("log.paFormat", ["CEF", "LEEF-legacy"]) + - grok: + source: log.paCefExtensions + patterns: + - fieldName: log.paIgnored + pattern: ^(?:[A-Za-z][A-Za-z0-9_]*=(?:\\.|[^=\\])*?[ \t]+)*?PanLinkChange= + - fieldName: log.PanLinkChange + pattern: (?:\\.|[^=\\])*? + - fieldName: log.paSuffix + pattern: (?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) + where: oneOf("log.paFormat", ["CEF", "LEEF-legacy"]) + - grok: + source: log.paCefExtensions + patterns: + - fieldName: log.paIgnored + pattern: ^(?:[A-Za-z][A-Za-z0-9_]*=(?:\\.|[^=\\])*?[ \t]+)*?PanLinkDetail= + - fieldName: log.PanLinkDetail + pattern: (?:\\.|[^=\\])*? + - fieldName: log.paSuffix + pattern: (?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) + where: oneOf("log.paFormat", ["CEF", "LEEF-legacy"]) + - grok: + source: log.paCefExtensions + patterns: + - fieldName: log.paIgnored + pattern: ^(?:[A-Za-z][A-Za-z0-9_]*=(?:\\.|[^=\\])*?[ \t]+)*?PanOSAPName= + - fieldName: log.PanOSAPName + pattern: (?:\\.|[^=\\])*? + - fieldName: log.paSuffix + pattern: (?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) + where: oneOf("log.paFormat", ["CEF", "LEEF-legacy"]) + - grok: + source: log.paCefExtensions + patterns: + - fieldName: log.paIgnored + pattern: ^(?:[A-Za-z][A-Za-z0-9_]*=(?:\\.|[^=\\])*?[ \t]+)*?PanOSActionFlags= + - fieldName: log.PanOSActionFlags + pattern: (?:\\.|[^=\\])*? + - fieldName: log.paSuffix + pattern: (?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) + where: oneOf("log.paFormat", ["CEF", "LEEF-legacy"]) + - grok: + source: log.paCefExtensions + patterns: + - fieldName: log.paIgnored + pattern: ^(?:[A-Za-z][A-Za-z0-9_]*=(?:\\.|[^=\\])*?[ \t]+)*?PanOSAreaCode= + - fieldName: log.PanOSAreaCode + pattern: (?:\\.|[^=\\])*? + - fieldName: log.paSuffix + pattern: (?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) + where: oneOf("log.paFormat", ["CEF", "LEEF-legacy"]) + - grok: + source: log.paCefExtensions + patterns: + - fieldName: log.paIgnored + pattern: ^(?:[A-Za-z][A-Za-z0-9_]*=(?:\\.|[^=\\])*?[ \t]+)*?PanOSAssocID= + - fieldName: log.PanOSAssocID + pattern: (?:\\.|[^=\\])*? + - fieldName: log.paSuffix + pattern: (?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) + where: oneOf("log.paFormat", ["CEF", "LEEF-legacy"]) + - grok: + source: log.paCefExtensions + patterns: + - fieldName: log.paIgnored + pattern: ^(?:[A-Za-z][A-Za-z0-9_]*=(?:\\.|[^=\\])*?[ \t]+)*?PanOSAttemptedGateways= + - fieldName: log.PanOSAttemptedGateways + pattern: (?:\\.|[^=\\])*? + - fieldName: log.paSuffix + pattern: (?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) + where: oneOf("log.paFormat", ["CEF", "LEEF-legacy"]) + - grok: + source: log.paCefExtensions + patterns: + - fieldName: log.paIgnored + pattern: ^(?:[A-Za-z][A-Za-z0-9_]*=(?:\\.|[^=\\])*?[ \t]+)*?PanOSAuthMethod= + - fieldName: log.PanOSAuthMethod + pattern: (?:\\.|[^=\\])*? + - fieldName: log.paSuffix + pattern: (?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) + where: oneOf("log.paFormat", ["CEF", "LEEF-legacy"]) + - grok: + source: log.paCefExtensions + patterns: + - fieldName: log.paIgnored + pattern: ^(?:[A-Za-z][A-Za-z0-9_]*=(?:\\.|[^=\\])*?[ \t]+)*?PanOSCellID= + - fieldName: log.PanOSCellID + pattern: (?:\\.|[^=\\])*? + - fieldName: log.paSuffix + pattern: (?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) + where: oneOf("log.paFormat", ["CEF", "LEEF-legacy"]) + - grok: + source: log.paCefExtensions + patterns: + - fieldName: log.paIgnored + pattern: ^(?:[A-Za-z][A-Za-z0-9_]*=(?:\\.|[^=\\])*?[ \t]+)*?PanOSCertificateFlags= + - fieldName: log.PanOSCertificateFlags + pattern: (?:\\.|[^=\\])*? + - fieldName: log.paSuffix + pattern: (?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) + where: oneOf("log.paFormat", ["CEF", "LEEF-legacy"]) + - grok: + source: log.paCefExtensions + patterns: + - fieldName: log.paIgnored + pattern: ^(?:[A-Za-z][A-Za-z0-9_]*=(?:\\.|[^=\\])*?[ \t]+)*?PanOSCertificateSerial= + - fieldName: log.PanOSCertificateSerial + pattern: (?:\\.|[^=\\])*? + - fieldName: log.paSuffix + pattern: (?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) + where: oneOf("log.paFormat", ["CEF", "LEEF-legacy"]) + - grok: + source: log.paCefExtensions + patterns: + - fieldName: log.paIgnored + pattern: ^(?:[A-Za-z][A-Za-z0-9_]*=(?:\\.|[^=\\])*?[ \t]+)*?PanOSCertificateSize= + - fieldName: log.PanOSCertificateSize + pattern: (?:\\.|[^=\\])*? + - fieldName: log.paSuffix + pattern: (?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) + where: oneOf("log.paFormat", ["CEF", "LEEF-legacy"]) + - grok: + source: log.paCefExtensions + patterns: + - fieldName: log.paIgnored + pattern: ^(?:[A-Za-z][A-Za-z0-9_]*=(?:\\.|[^=\\])*?[ \t]+)*?PanOSCertificateVersion= + - fieldName: log.PanOSCertificateVersion + pattern: (?:\\.|[^=\\])*? + - fieldName: log.paSuffix + pattern: (?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) + where: oneOf("log.paFormat", ["CEF", "LEEF-legacy"]) + - grok: + source: log.paCefExtensions + patterns: + - fieldName: log.paIgnored + pattern: ^(?:[A-Za-z][A-Za-z0-9_]*=(?:\\.|[^=\\])*?[ \t]+)*?PanOSChainStatus= + - fieldName: log.PanOSChainStatus + pattern: (?:\\.|[^=\\])*? + - fieldName: log.paSuffix + pattern: (?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) + where: oneOf("log.paFormat", ["CEF", "LEEF-legacy"]) + - grok: + source: log.paCefExtensions + patterns: + - fieldName: log.paIgnored + pattern: ^(?:[A-Za-z][A-Za-z0-9_]*=(?:\\.|[^=\\])*?[ \t]+)*?PanOSChunkType= + - fieldName: log.PanOSChunkType + pattern: (?:\\.|[^=\\])*? + - fieldName: log.paSuffix + pattern: (?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) + where: oneOf("log.paFormat", ["CEF", "LEEF-legacy"]) + - grok: + source: log.paCefExtensions + patterns: + - fieldName: log.paIgnored + pattern: ^(?:[A-Za-z][A-Za-z0-9_]*=(?:\\.|[^=\\])*?[ \t]+)*?PanOSClientToFirewall= + - fieldName: log.PanOSClientToFirewall + pattern: (?:\\.|[^=\\])*? + - fieldName: log.paSuffix + pattern: (?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) + where: oneOf("log.paFormat", ["CEF", "LEEF-legacy"]) + - grok: + source: log.paCefExtensions + patterns: + - fieldName: log.paIgnored + pattern: ^(?:[A-Za-z][A-Za-z0-9_]*=(?:\\.|[^=\\])*?[ \t]+)*?PanOSCommonName= + - fieldName: log.PanOSCommonName + pattern: (?:\\.|[^=\\])*? + - fieldName: log.paSuffix + pattern: (?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) + where: oneOf("log.paFormat", ["CEF", "LEEF-legacy"]) + - grok: + source: log.paCefExtensions + patterns: + - fieldName: log.paIgnored + pattern: ^(?:[A-Za-z][A-Za-z0-9_]*=(?:\\.|[^=\\])*?[ \t]+)*?PanOSCommonNameLength= + - fieldName: log.PanOSCommonNameLength + pattern: (?:\\.|[^=\\])*? + - fieldName: log.paSuffix + pattern: (?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) + where: oneOf("log.paFormat", ["CEF", "LEEF-legacy"]) + - grok: + source: log.paCefExtensions + patterns: + - fieldName: log.paIgnored + pattern: ^(?:[A-Za-z][A-Za-z0-9_]*=(?:\\.|[^=\\])*?[ \t]+)*?PanOSConfigVersion= + - fieldName: log.PanOSConfigVersion + pattern: (?:\\.|[^=\\])*? + - fieldName: log.paSuffix + pattern: (?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) + where: oneOf("log.paFormat", ["CEF", "LEEF-legacy"]) + - grok: + source: log.paCefExtensions + patterns: + - fieldName: log.paIgnored + pattern: ^(?:[A-Za-z][A-Za-z0-9_]*=(?:\\.|[^=\\])*?[ \t]+)*?PanOSConnectionError= + - fieldName: log.PanOSConnectionError + pattern: (?:\\.|[^=\\])*? + - fieldName: log.paSuffix + pattern: (?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) + where: oneOf("log.paFormat", ["CEF", "LEEF-legacy"]) + - grok: + source: log.paCefExtensions + patterns: + - fieldName: log.paIgnored + pattern: ^(?:[A-Za-z][A-Za-z0-9_]*=(?:\\.|[^=\\])*?[ \t]+)*?PanOSConnectionErrorID= + - fieldName: log.PanOSConnectionErrorID + pattern: (?:\\.|[^=\\])*? + - fieldName: log.paSuffix + pattern: (?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) + where: oneOf("log.paFormat", ["CEF", "LEEF-legacy"]) + - grok: + source: log.paCefExtensions + patterns: + - fieldName: log.paIgnored + pattern: ^(?:[A-Za-z][A-Za-z0-9_]*=(?:\\.|[^=\\])*?[ \t]+)*?PanOSConnectionMethod= + - fieldName: log.PanOSConnectionMethod + pattern: (?:\\.|[^=\\])*? + - fieldName: log.paSuffix + pattern: (?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) + where: oneOf("log.paFormat", ["CEF", "LEEF-legacy"]) + - grok: + source: log.paCefExtensions + patterns: + - fieldName: log.paIgnored + pattern: ^(?:[A-Za-z][A-Za-z0-9_]*=(?:\\.|[^=\\])*?[ \t]+)*?PanOSContainerID= + - fieldName: log.PanOSContainerID + pattern: (?:\\.|[^=\\])*? + - fieldName: log.paSuffix + pattern: (?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) + where: oneOf("log.paFormat", ["CEF", "LEEF-legacy"]) + - grok: + source: log.paCefExtensions + patterns: + - fieldName: log.paIgnored + pattern: ^(?:[A-Za-z][A-Za-z0-9_]*=(?:\\.|[^=\\])*?[ \t]+)*?PanOSContainerName= + - fieldName: log.PanOSContainerName + pattern: (?:\\.|[^=\\])*? + - fieldName: log.paSuffix + pattern: (?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) + where: oneOf("log.paFormat", ["CEF", "LEEF-legacy"]) + - grok: + source: log.paCefExtensions + patterns: + - fieldName: log.paIgnored + pattern: ^(?:[A-Za-z][A-Za-z0-9_]*=(?:\\.|[^=\\])*?[ \t]+)*?PanOSContainerNameSpace= + - fieldName: log.PanOSContainerNameSpace + pattern: (?:\\.|[^=\\])*? + - fieldName: log.paSuffix + pattern: (?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) + where: oneOf("log.paFormat", ["CEF", "LEEF-legacy"]) + - grok: + source: log.paCefExtensions + patterns: + - fieldName: log.paIgnored + pattern: ^(?:[A-Za-z][A-Za-z0-9_]*=(?:\\.|[^=\\])*?[ \t]+)*?PanOSContentVer= + - fieldName: log.PanOSContentVer + pattern: (?:\\.|[^=\\])*? + - fieldName: log.paSuffix + pattern: (?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) + where: oneOf("log.paFormat", ["CEF", "LEEF-legacy"]) + - grok: + source: log.paCefExtensions + patterns: + - fieldName: log.paIgnored + pattern: ^(?:[A-Za-z][A-Za-z0-9_]*=(?:\\.|[^=\\])*?[ \t]+)*?PanOSCountOfRepeats= + - fieldName: log.PanOSCountOfRepeats + pattern: (?:\\.|[^=\\])*? + - fieldName: log.paSuffix + pattern: (?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) + where: oneOf("log.paFormat", ["CEF", "LEEF-legacy"]) + - grok: + source: log.paCefExtensions + patterns: + - fieldName: log.paIgnored + pattern: ^(?:[A-Za-z][A-Za-z0-9_]*=(?:\\.|[^=\\])*?[ \t]+)*?PanOSDGl1= + - fieldName: log.PanOSDGl1 + pattern: (?:\\.|[^=\\])*? + - fieldName: log.paSuffix + pattern: (?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) + where: oneOf("log.paFormat", ["CEF", "LEEF-legacy"]) + - grok: + source: log.paCefExtensions + patterns: + - fieldName: log.paIgnored + pattern: ^(?:[A-Za-z][A-Za-z0-9_]*=(?:\\.|[^=\\])*?[ \t]+)*?PanOSDGl2= + - fieldName: log.PanOSDGl2 + pattern: (?:\\.|[^=\\])*? + - fieldName: log.paSuffix + pattern: (?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) + where: oneOf("log.paFormat", ["CEF", "LEEF-legacy"]) + - grok: + source: log.paCefExtensions + patterns: + - fieldName: log.paIgnored + pattern: ^(?:[A-Za-z][A-Za-z0-9_]*=(?:\\.|[^=\\])*?[ \t]+)*?PanOSDGl3= + - fieldName: log.PanOSDGl3 + pattern: (?:\\.|[^=\\])*? + - fieldName: log.paSuffix + pattern: (?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) + where: oneOf("log.paFormat", ["CEF", "LEEF-legacy"]) + - grok: + source: log.paCefExtensions + patterns: + - fieldName: log.paIgnored + pattern: ^(?:[A-Za-z][A-Za-z0-9_]*=(?:\\.|[^=\\])*?[ \t]+)*?PanOSDGl4= + - fieldName: log.PanOSDGl4 + pattern: (?:\\.|[^=\\])*? + - fieldName: log.paSuffix + pattern: (?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) + where: oneOf("log.paFormat", ["CEF", "LEEF-legacy"]) + - grok: + source: log.paCefExtensions + patterns: + - fieldName: log.paIgnored + pattern: ^(?:[A-Za-z][A-Za-z0-9_]*=(?:\\.|[^=\\])*?[ \t]+)*?PanOSDataSourceName= + - fieldName: log.PanOSDataSourceName + pattern: (?:\\.|[^=\\])*? + - fieldName: log.paSuffix + pattern: (?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) + where: oneOf("log.paFormat", ["CEF", "LEEF-legacy"]) + - grok: + source: log.paCefExtensions + patterns: + - fieldName: log.paIgnored + pattern: ^(?:[A-Za-z][A-Za-z0-9_]*=(?:\\.|[^=\\])*?[ \t]+)*?PanOSDataSourceSubType= + - fieldName: log.PanOSDataSourceSubType + pattern: (?:\\.|[^=\\])*? + - fieldName: log.paSuffix + pattern: (?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) + where: oneOf("log.paFormat", ["CEF", "LEEF-legacy"]) + - grok: + source: log.paCefExtensions + patterns: + - fieldName: log.paIgnored + pattern: ^(?:[A-Za-z][A-Za-z0-9_]*=(?:\\.|[^=\\])*?[ \t]+)*?PanOSDataSourceType= + - fieldName: log.PanOSDataSourceType + pattern: (?:\\.|[^=\\])*? + - fieldName: log.paSuffix + pattern: (?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) + where: oneOf("log.paFormat", ["CEF", "LEEF-legacy"]) + - grok: + source: log.paCefExtensions + patterns: + - fieldName: log.paIgnored + pattern: ^(?:[A-Za-z][A-Za-z0-9_]*=(?:\\.|[^=\\])*?[ \t]+)*?PanOSDesc= + - fieldName: log.PanOSDesc + pattern: (?:\\.|[^=\\])*? + - fieldName: log.paSuffix + pattern: (?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) + where: oneOf("log.paFormat", ["CEF", "LEEF-legacy"]) + - grok: + source: log.paCefExtensions + patterns: + - fieldName: log.paIgnored + pattern: ^(?:[A-Za-z][A-Za-z0-9_]*=(?:\\.|[^=\\])*?[ \t]+)*?PanOSDescription= + - fieldName: log.PanOSDescription + pattern: (?:\\.|[^=\\])*? + - fieldName: log.paSuffix + pattern: (?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) + where: oneOf("log.paFormat", ["CEF", "LEEF-legacy"]) + - grok: + source: log.paCefExtensions + patterns: + - fieldName: log.paIgnored + pattern: ^(?:[A-Za-z][A-Za-z0-9_]*=(?:\\.|[^=\\])*?[ \t]+)*?PanOSDestinationDeviceCategory= + - fieldName: log.PanOSDestinationDeviceCategory + pattern: (?:\\.|[^=\\])*? + - fieldName: log.paSuffix + pattern: (?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) + where: oneOf("log.paFormat", ["CEF", "LEEF-legacy"]) + - grok: + source: log.paCefExtensions + patterns: + - fieldName: log.paIgnored + pattern: ^(?:[A-Za-z][A-Za-z0-9_]*=(?:\\.|[^=\\])*?[ \t]+)*?PanOSDestinationDeviceHost= + - fieldName: log.PanOSDestinationDeviceHost + pattern: (?:\\.|[^=\\])*? + - fieldName: log.paSuffix + pattern: (?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) + where: oneOf("log.paFormat", ["CEF", "LEEF-legacy"]) + - grok: + source: log.paCefExtensions + patterns: + - fieldName: log.paIgnored + pattern: ^(?:[A-Za-z][A-Za-z0-9_]*=(?:\\.|[^=\\])*?[ \t]+)*?PanOSDestinationDeviceMac= + - fieldName: log.PanOSDestinationDeviceMac + pattern: (?:\\.|[^=\\])*? + - fieldName: log.paSuffix + pattern: (?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) + where: oneOf("log.paFormat", ["CEF", "LEEF-legacy"]) + - grok: + source: log.paCefExtensions + patterns: + - fieldName: log.paIgnored + pattern: ^(?:[A-Za-z][A-Za-z0-9_]*=(?:\\.|[^=\\])*?[ \t]+)*?PanOSDestinationDeviceModel= + - fieldName: log.PanOSDestinationDeviceModel + pattern: (?:\\.|[^=\\])*? + - fieldName: log.paSuffix + pattern: (?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) + where: oneOf("log.paFormat", ["CEF", "LEEF-legacy"]) + - grok: + source: log.paCefExtensions + patterns: + - fieldName: log.paIgnored + pattern: ^(?:[A-Za-z][A-Za-z0-9_]*=(?:\\.|[^=\\])*?[ \t]+)*?PanOSDestinationDeviceOSFamily= + - fieldName: log.PanOSDestinationDeviceOSFamily + pattern: (?:\\.|[^=\\])*? + - fieldName: log.paSuffix + pattern: (?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) + where: oneOf("log.paFormat", ["CEF", "LEEF-legacy"]) + - grok: + source: log.paCefExtensions + patterns: + - fieldName: log.paIgnored + pattern: ^(?:[A-Za-z][A-Za-z0-9_]*=(?:\\.|[^=\\])*?[ \t]+)*?PanOSDestinationDeviceOSVersion= + - fieldName: log.PanOSDestinationDeviceOSVersion + pattern: (?:\\.|[^=\\])*? + - fieldName: log.paSuffix + pattern: (?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) + where: oneOf("log.paFormat", ["CEF", "LEEF-legacy"]) + - grok: + source: log.paCefExtensions + patterns: + - fieldName: log.paIgnored + pattern: ^(?:[A-Za-z][A-Za-z0-9_]*=(?:\\.|[^=\\])*?[ \t]+)*?PanOSDestinationDeviceProfile= + - fieldName: log.PanOSDestinationDeviceProfile + pattern: (?:\\.|[^=\\])*? + - fieldName: log.paSuffix + pattern: (?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) + where: oneOf("log.paFormat", ["CEF", "LEEF-legacy"]) + - grok: + source: log.paCefExtensions + patterns: + - fieldName: log.paIgnored + pattern: ^(?:[A-Za-z][A-Za-z0-9_]*=(?:\\.|[^=\\])*?[ \t]+)*?PanOSDestinationDeviceVendor= + - fieldName: log.PanOSDestinationDeviceVendor + pattern: (?:\\.|[^=\\])*? + - fieldName: log.paSuffix + pattern: (?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) + where: oneOf("log.paFormat", ["CEF", "LEEF-legacy"]) + - grok: + source: log.paCefExtensions + patterns: + - fieldName: log.paIgnored + pattern: ^(?:[A-Za-z][A-Za-z0-9_]*=(?:\\.|[^=\\])*?[ \t]+)*?PanOSDestinationDynamicAddressGroup= + - fieldName: log.PanOSDestinationDynamicAddressGroup + pattern: (?:\\.|[^=\\])*? + - fieldName: log.paSuffix + pattern: (?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) + where: oneOf("log.paFormat", ["CEF", "LEEF-legacy"]) + - grok: + source: log.paCefExtensions + patterns: + - fieldName: log.paIgnored + pattern: ^(?:[A-Za-z][A-Za-z0-9_]*=(?:\\.|[^=\\])*?[ \t]+)*?PanOSDestinationEDL= + - fieldName: log.PanOSDestinationEDL + pattern: (?:\\.|[^=\\])*? + - fieldName: log.paSuffix + pattern: (?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) + where: oneOf("log.paFormat", ["CEF", "LEEF-legacy"]) + - grok: + source: log.paCefExtensions + patterns: + - fieldName: log.paIgnored + pattern: ^(?:[A-Za-z][A-Za-z0-9_]*=(?:\\.|[^=\\])*?[ \t]+)*?PanOSDestinationUUID= + - fieldName: log.PanOSDestinationUUID + pattern: (?:\\.|[^=\\])*? + - fieldName: log.paSuffix + pattern: (?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) + where: oneOf("log.paFormat", ["CEF", "LEEF-legacy"]) + - grok: + source: log.paCefExtensions + patterns: + - fieldName: log.paIgnored + pattern: ^(?:[A-Za-z][A-Za-z0-9_]*=(?:\\.|[^=\\])*?[ \t]+)*?PanOSDeviceSN= + - fieldName: log.PanOSDeviceSN + pattern: (?:\\.|[^=\\])*? + - fieldName: log.paSuffix + pattern: (?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) + where: oneOf("log.paFormat", ["CEF", "LEEF-legacy"]) + - grok: + source: log.paCefExtensions + patterns: + - fieldName: log.paIgnored + pattern: ^(?:[A-Za-z][A-Za-z0-9_]*=(?:\\.|[^=\\])*?[ \t]+)*?PanOSDiameterAVPCode= + - fieldName: log.PanOSDiameterAVPCode + pattern: (?:\\.|[^=\\])*? + - fieldName: log.paSuffix + pattern: (?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) + where: oneOf("log.paFormat", ["CEF", "LEEF-legacy"]) + - grok: + source: log.paCefExtensions + patterns: + - fieldName: log.paIgnored + pattern: ^(?:[A-Za-z][A-Za-z0-9_]*=(?:\\.|[^=\\])*?[ \t]+)*?PanOSDiameterApp= + - fieldName: log.PanOSDiameterApp + pattern: (?:\\.|[^=\\])*? + - fieldName: log.paSuffix + pattern: (?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) + where: oneOf("log.paFormat", ["CEF", "LEEF-legacy"]) + - grok: + source: log.paCefExtensions + patterns: + - fieldName: log.paIgnored + pattern: ^(?:[A-Za-z][A-Za-z0-9_]*=(?:\\.|[^=\\])*?[ \t]+)*?PanOSDiameterCmdCode= + - fieldName: log.PanOSDiameterCmdCode + pattern: (?:\\.|[^=\\])*? + - fieldName: log.paSuffix + pattern: (?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) + where: oneOf("log.paFormat", ["CEF", "LEEF-legacy"]) + - grok: + source: log.paCefExtensions + patterns: + - fieldName: log.paIgnored + pattern: ^(?:[A-Za-z][A-Za-z0-9_]*=(?:\\.|[^=\\])*?[ \t]+)*?PanOSDstUUID= + - fieldName: log.PanOSDstUUID + pattern: (?:\\.|[^=\\])*? + - fieldName: log.paSuffix + pattern: (?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) + where: oneOf("log.paFormat", ["CEF", "LEEF-legacy"]) + - grok: + source: log.paCefExtensions + patterns: + - fieldName: log.paIgnored + pattern: ^(?:[A-Za-z][A-Za-z0-9_]*=(?:\\.|[^=\\])*?[ \t]+)*?PanOSEllipticCurve= + - fieldName: log.PanOSEllipticCurve + pattern: (?:\\.|[^=\\])*? + - fieldName: log.paSuffix + pattern: (?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) + where: oneOf("log.paFormat", ["CEF", "LEEF-legacy"]) + - grok: + source: log.paCefExtensions + patterns: + - fieldName: log.paIgnored + pattern: ^(?:[A-Za-z][A-Za-z0-9_]*=(?:\\.|[^=\\])*?[ \t]+)*?PanOSEndUserIP= + - fieldName: log.PanOSEndUserIP + pattern: (?:\\.|[^=\\])*? + - fieldName: log.paSuffix + pattern: (?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) + where: oneOf("log.paFormat", ["CEF", "LEEF-legacy"]) + - grok: + source: log.paCefExtensions + patterns: + - fieldName: log.paIgnored + pattern: ^(?:[A-Za-z][A-Za-z0-9_]*=(?:\\.|[^=\\])*?[ \t]+)*?PanOSEndpointDeviceName= + - fieldName: log.PanOSEndpointDeviceName + pattern: (?:\\.|[^=\\])*? + - fieldName: log.paSuffix + pattern: (?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) + where: oneOf("log.paFormat", ["CEF", "LEEF-legacy"]) + - grok: + source: log.paCefExtensions + patterns: + - fieldName: log.paIgnored + pattern: ^(?:[A-Za-z][A-Za-z0-9_]*=(?:\\.|[^=\\])*?[ \t]+)*?PanOSEndpointMac= + - fieldName: log.PanOSEndpointMac + pattern: (?:\\.|[^=\\])*? + - fieldName: log.paSuffix + pattern: (?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) + where: oneOf("log.paFormat", ["CEF", "LEEF-legacy"]) + - grok: + source: log.paCefExtensions + patterns: + - fieldName: log.paIgnored + pattern: ^(?:[A-Za-z][A-Za-z0-9_]*=(?:\\.|[^=\\])*?[ \t]+)*?PanOSEndpointOSType= + - fieldName: log.PanOSEndpointOSType + pattern: (?:\\.|[^=\\])*? + - fieldName: log.paSuffix + pattern: (?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) + where: oneOf("log.paFormat", ["CEF", "LEEF-legacy"]) + - grok: + source: log.paCefExtensions + patterns: + - fieldName: log.paIgnored + pattern: ^(?:[A-Za-z][A-Za-z0-9_]*=(?:\\.|[^=\\])*?[ \t]+)*?PanOSEndpointOSVersion= + - fieldName: log.PanOSEndpointOSVersion + pattern: (?:\\.|[^=\\])*? + - fieldName: log.paSuffix + pattern: (?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) + where: oneOf("log.paFormat", ["CEF", "LEEF-legacy"]) + - grok: + source: log.paCefExtensions + patterns: + - fieldName: log.paIgnored + pattern: ^(?:[A-Za-z][A-Za-z0-9_]*=(?:\\.|[^=\\])*?[ \t]+)*?PanOSEndpointSerialNumber= + - fieldName: log.PanOSEndpointSerialNumber + pattern: (?:\\.|[^=\\])*? + - fieldName: log.paSuffix + pattern: (?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) + where: oneOf("log.paFormat", ["CEF", "LEEF-legacy"]) + - grok: + source: log.paCefExtensions + patterns: + - fieldName: log.paIgnored + pattern: ^(?:[A-Za-z][A-Za-z0-9_]*=(?:\\.|[^=\\])*?[ \t]+)*?PanOSErrorIndex= + - fieldName: log.PanOSErrorIndex + pattern: (?:\\.|[^=\\])*? + - fieldName: log.paSuffix + pattern: (?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) + where: oneOf("log.paFormat", ["CEF", "LEEF-legacy"]) + - grok: + source: log.paCefExtensions + patterns: + - fieldName: log.paIgnored + pattern: ^(?:[A-Za-z][A-Za-z0-9_]*=(?:\\.|[^=\\])*?[ \t]+)*?PanOSErrorMessage= + - fieldName: log.PanOSErrorMessage + pattern: (?:\\.|[^=\\])*? + - fieldName: log.paSuffix + pattern: (?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) + where: oneOf("log.paFormat", ["CEF", "LEEF-legacy"]) + - grok: + source: log.paCefExtensions + patterns: + - fieldName: log.paIgnored + pattern: ^(?:[A-Za-z][A-Za-z0-9_]*=(?:\\.|[^=\\])*?[ \t]+)*?PanOSEventID= + - fieldName: log.PanOSEventID + pattern: (?:\\.|[^=\\])*? + - fieldName: log.paSuffix + pattern: (?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) + where: oneOf("log.paFormat", ["CEF", "LEEF-legacy"]) + - grok: + source: log.paCefExtensions + patterns: + - fieldName: log.paIgnored + pattern: ^(?:[A-Za-z][A-Za-z0-9_]*=(?:\\.|[^=\\])*?[ \t]+)*?PanOSEventStatus= + - fieldName: log.PanOSEventStatus + pattern: (?:\\.|[^=\\])*? + - fieldName: log.paSuffix + pattern: (?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) + where: oneOf("log.paFormat", ["CEF", "LEEF-legacy"]) + - grok: + source: log.paCefExtensions + patterns: + - fieldName: log.paIgnored + pattern: ^(?:[A-Za-z][A-Za-z0-9_]*=(?:\\.|[^=\\])*?[ \t]+)*?PanOSFWDeviceGroup= + - fieldName: log.PanOSFWDeviceGroup + pattern: (?:\\.|[^=\\])*? + - fieldName: log.paSuffix + pattern: (?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) + where: oneOf("log.paFormat", ["CEF", "LEEF-legacy"]) + - grok: + source: log.paCefExtensions + patterns: + - fieldName: log.paIgnored + pattern: ^(?:[A-Za-z][A-Za-z0-9_]*=(?:\\.|[^=\\])*?[ \t]+)*?PanOSFingerprint= + - fieldName: log.PanOSFingerprint + pattern: (?:\\.|[^=\\])*? + - fieldName: log.paSuffix + pattern: (?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) + where: oneOf("log.paFormat", ["CEF", "LEEF-legacy"]) + - grok: + source: log.paCefExtensions + patterns: + - fieldName: log.paIgnored + pattern: ^(?:[A-Za-z][A-Za-z0-9_]*=(?:\\.|[^=\\])*?[ \t]+)*?PanOSFirewallToServer= + - fieldName: log.PanOSFirewallToServer + pattern: (?:\\.|[^=\\])*? + - fieldName: log.paSuffix + pattern: (?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) + where: oneOf("log.paFormat", ["CEF", "LEEF-legacy"]) + - grok: + source: log.paCefExtensions + patterns: + - fieldName: log.paIgnored + pattern: ^(?:[A-Za-z][A-Za-z0-9_]*=(?:\\.|[^=\\])*?[ \t]+)*?PanOSGPGatewayLocation= + - fieldName: log.PanOSGPGatewayLocation + pattern: (?:\\.|[^=\\])*? + - fieldName: log.paSuffix + pattern: (?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) + where: oneOf("log.paFormat", ["CEF", "LEEF-legacy"]) + - grok: + source: log.paCefExtensions + patterns: + - fieldName: log.paIgnored + pattern: ^(?:[A-Za-z][A-Za-z0-9_]*=(?:\\.|[^=\\])*?[ \t]+)*?PanOSGTPCause= + - fieldName: log.PanOSGTPCause + pattern: (?:\\.|[^=\\])*? + - fieldName: log.paSuffix + pattern: (?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) + where: oneOf("log.paFormat", ["CEF", "LEEF-legacy"]) + - grok: + source: log.paCefExtensions + patterns: + - fieldName: log.paIgnored + pattern: ^(?:[A-Za-z][A-Za-z0-9_]*=(?:\\.|[^=\\])*?[ \t]+)*?PanOSGTPEventCode= + - fieldName: log.PanOSGTPEventCode + pattern: (?:\\.|[^=\\])*? + - fieldName: log.paSuffix + pattern: (?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) + where: oneOf("log.paFormat", ["CEF", "LEEF-legacy"]) + - grok: + source: log.paCefExtensions + patterns: + - fieldName: log.paIgnored + pattern: ^(?:[A-Za-z][A-Za-z0-9_]*=(?:\\.|[^=\\])*?[ \t]+)*?PanOSGTPEventType= + - fieldName: log.PanOSGTPEventType + pattern: (?:\\.|[^=\\])*? + - fieldName: log.paSuffix + pattern: (?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) + where: oneOf("log.paFormat", ["CEF", "LEEF-legacy"]) + - grok: + source: log.paCefExtensions + patterns: + - fieldName: log.paIgnored + pattern: ^(?:[A-Za-z][A-Za-z0-9_]*=(?:\\.|[^=\\])*?[ \t]+)*?PanOSGTPInterface= + - fieldName: log.PanOSGTPInterface + pattern: (?:\\.|[^=\\])*? + - fieldName: log.paSuffix + pattern: (?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) + where: oneOf("log.paFormat", ["CEF", "LEEF-legacy"]) + - grok: + source: log.paCefExtensions + patterns: + - fieldName: log.paIgnored + pattern: ^(?:[A-Za-z][A-Za-z0-9_]*=(?:\\.|[^=\\])*?[ \t]+)*?PanOSGTPMsgType= + - fieldName: log.PanOSGTPMsgType + pattern: (?:\\.|[^=\\])*? + - fieldName: log.paSuffix + pattern: (?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) + where: oneOf("log.paFormat", ["CEF", "LEEF-legacy"]) + - grok: + source: log.paCefExtensions + patterns: + - fieldName: log.paIgnored + pattern: ^(?:[A-Za-z][A-Za-z0-9_]*=(?:\\.|[^=\\])*?[ \t]+)*?PanOSGateway= + - fieldName: log.PanOSGateway + pattern: (?:\\.|[^=\\])*? + - fieldName: log.paSuffix + pattern: (?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) + where: oneOf("log.paFormat", ["CEF", "LEEF-legacy"]) + - grok: + source: log.paCefExtensions + patterns: + - fieldName: log.paIgnored + pattern: ^(?:[A-Za-z][A-Za-z0-9_]*=(?:\\.|[^=\\])*?[ \t]+)*?PanOSGatewayPriority= + - fieldName: log.PanOSGatewayPriority + pattern: (?:\\.|[^=\\])*? + - fieldName: log.paSuffix + pattern: (?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) + where: oneOf("log.paFormat", ["CEF", "LEEF-legacy"]) + - grok: + source: log.paCefExtensions + patterns: + - fieldName: log.paIgnored + pattern: ^(?:[A-Za-z][A-Za-z0-9_]*=(?:\\.|[^=\\])*?[ \t]+)*?PanOSGatewaySelectionType= + - fieldName: log.PanOSGatewaySelectionType + pattern: (?:\\.|[^=\\])*? + - fieldName: log.paSuffix + pattern: (?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) + where: oneOf("log.paFormat", ["CEF", "LEEF-legacy"]) + - grok: + source: log.paCefExtensions + patterns: + - fieldName: log.paIgnored + pattern: ^(?:[A-Za-z][A-Za-z0-9_]*=(?:\\.|[^=\\])*?[ \t]+)*?PanOSGlobalProtectClientVersion= + - fieldName: log.PanOSGlobalProtectClientVersion + pattern: (?:\\.|[^=\\])*? + - fieldName: log.paSuffix + pattern: (?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) + where: oneOf("log.paFormat", ["CEF", "LEEF-legacy"]) + - grok: + source: log.paCefExtensions + patterns: + - fieldName: log.paIgnored + pattern: ^(?:[A-Za-z][A-Za-z0-9_]*=(?:\\.|[^=\\])*?[ \t]+)*?PanOSHTTP2Con= + - fieldName: log.PanOSHTTP2Con + pattern: (?:\\.|[^=\\])*? + - fieldName: log.paSuffix + pattern: (?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) + where: oneOf("log.paFormat", ["CEF", "LEEF-legacy"]) + - grok: + source: log.paCefExtensions + patterns: + - fieldName: log.paIgnored + pattern: ^(?:[A-Za-z][A-Za-z0-9_]*=(?:\\.|[^=\\])*?[ \t]+)*?PanOSHTTPHeader= + - fieldName: log.PanOSHTTPHeader + pattern: (?:\\.|[^=\\])*? + - fieldName: log.paSuffix + pattern: (?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) + where: oneOf("log.paFormat", ["CEF", "LEEF-legacy"]) + - grok: + source: log.paCefExtensions + patterns: + - fieldName: log.paIgnored + pattern: ^(?:[A-Za-z][A-Za-z0-9_]*=(?:\\.|[^=\\])*?[ \t]+)*?PanOSHTTPUserAgent= + - fieldName: log.PanOSHTTPUserAgent + pattern: (?:\\.|[^=\\])*? + - fieldName: log.paSuffix + pattern: (?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) + where: oneOf("log.paFormat", ["CEF", "LEEF-legacy"]) + - grok: + source: log.paCefExtensions + patterns: + - fieldName: log.paIgnored + pattern: ^(?:[A-Za-z][A-Za-z0-9_]*=(?:\\.|[^=\\])*?[ \t]+)*?PanOSHostID= + - fieldName: log.PanOSHostID + pattern: (?:\\.|[^=\\])*? + - fieldName: log.paSuffix + pattern: (?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) + where: oneOf("log.paFormat", ["CEF", "LEEF-legacy"]) + - grok: + source: log.paCefExtensions + patterns: + - fieldName: log.paIgnored + pattern: ^(?:[A-Za-z][A-Za-z0-9_]*=(?:\\.|[^=\\])*?[ \t]+)*?PanOSIssuerCommonName= + - fieldName: log.PanOSIssuerCommonName + pattern: (?:\\.|[^=\\])*? + - fieldName: log.paSuffix + pattern: (?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) + where: oneOf("log.paFormat", ["CEF", "LEEF-legacy"]) + - grok: + source: log.paCefExtensions + patterns: + - fieldName: log.paIgnored + pattern: ^(?:[A-Za-z][A-Za-z0-9_]*=(?:\\.|[^=\\])*?[ \t]+)*?PanOSIssuerNameLength= + - fieldName: log.PanOSIssuerNameLength + pattern: (?:\\.|[^=\\])*? + - fieldName: log.paSuffix + pattern: (?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) + where: oneOf("log.paFormat", ["CEF", "LEEF-legacy"]) + - grok: + source: log.paCefExtensions + patterns: + - fieldName: log.paIgnored + pattern: ^(?:[A-Za-z][A-Za-z0-9_]*=(?:\\.|[^=\\])*?[ \t]+)*?PanOSLogTimeStamp= + - fieldName: log.PanOSLogTimeStamp + pattern: (?:\\.|[^=\\])*? + - fieldName: log.paSuffix + pattern: (?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) + where: oneOf("log.paFormat", ["CEF", "LEEF-legacy"]) + - grok: + source: log.paCefExtensions + patterns: + - fieldName: log.paIgnored + pattern: ^(?:[A-Za-z][A-Za-z0-9_]*=(?:\\.|[^=\\])*?[ \t]+)*?PanOSLogTypeSeqNo= + - fieldName: log.PanOSLogTypeSeqNo + pattern: (?:\\.|[^=\\])*? + - fieldName: log.paSuffix + pattern: (?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) + where: oneOf("log.paFormat", ["CEF", "LEEF-legacy"]) + - grok: + source: log.paCefExtensions + patterns: + - fieldName: log.paIgnored + pattern: ^(?:[A-Za-z][A-Za-z0-9_]*=(?:\\.|[^=\\])*?[ \t]+)*?PanOSLoginDuration= + - fieldName: log.PanOSLoginDuration + pattern: (?:\\.|[^=\\])*? + - fieldName: log.paSuffix + pattern: (?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) + where: oneOf("log.paFormat", ["CEF", "LEEF-legacy"]) + - grok: + source: log.paCefExtensions + patterns: + - fieldName: log.paIgnored + pattern: ^(?:[A-Za-z][A-Za-z0-9_]*=(?:\\.|[^=\\])*?[ \t]+)*?PanOSMSISDN= + - fieldName: log.PanOSMSISDN + pattern: (?:\\.|[^=\\])*? + - fieldName: log.paSuffix + pattern: (?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) + where: oneOf("log.paFormat", ["CEF", "LEEF-legacy"]) + - grok: + source: log.paCefExtensions + patterns: + - fieldName: log.paIgnored + pattern: ^(?:[A-Za-z][A-Za-z0-9_]*=(?:\\.|[^=\\])*?[ \t]+)*?PanOSMonitorTag= + - fieldName: log.PanOSMonitorTag + pattern: (?:\\.|[^=\\])*? + - fieldName: log.paSuffix + pattern: (?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) + where: oneOf("log.paFormat", ["CEF", "LEEF-legacy"]) + - grok: + source: log.paCefExtensions + patterns: + - fieldName: log.paIgnored + pattern: ^(?:[A-Za-z][A-Za-z0-9_]*=(?:\\.|[^=\\])*?[ \t]+)*?PanOSOpCode= + - fieldName: log.PanOSOpCode + pattern: (?:\\.|[^=\\])*? + - fieldName: log.paSuffix + pattern: (?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) + where: oneOf("log.paFormat", ["CEF", "LEEF-legacy"]) + - grok: + source: log.paCefExtensions + patterns: + - fieldName: log.paIgnored + pattern: ^(?:[A-Za-z][A-Za-z0-9_]*=(?:\\.|[^=\\])*?[ \t]+)*?PanOSPPID= + - fieldName: log.PanOSPPID + pattern: (?:\\.|[^=\\])*? + - fieldName: log.paSuffix + pattern: (?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) + where: oneOf("log.paFormat", ["CEF", "LEEF-legacy"]) + - grok: + source: log.paCefExtensions + patterns: + - fieldName: log.paIgnored + pattern: ^(?:[A-Za-z][A-Za-z0-9_]*=(?:\\.|[^=\\])*?[ \t]+)*?PanOSPacketsReceived= + - fieldName: log.PanOSPacketsReceived + pattern: (?:\\.|[^=\\])*? + - fieldName: log.paSuffix + pattern: (?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) + where: oneOf("log.paFormat", ["CEF", "LEEF-legacy"]) + - grok: + source: log.paCefExtensions + patterns: + - fieldName: log.paIgnored + pattern: ^(?:[A-Za-z][A-Za-z0-9_]*=(?:\\.|[^=\\])*?[ \t]+)*?PanOSPacketsSent= + - fieldName: log.PanOSPacketsSent + pattern: (?:\\.|[^=\\])*? + - fieldName: log.paSuffix + pattern: (?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) + where: oneOf("log.paFormat", ["CEF", "LEEF-legacy"]) + - grok: + source: log.paCefExtensions + patterns: + - fieldName: log.paIgnored + pattern: ^(?:[A-Za-z][A-Za-z0-9_]*=(?:\\.|[^=\\])*?[ \t]+)*?PanOSParentSessionID= + - fieldName: log.PanOSParentSessionID + pattern: (?:\\.|[^=\\])*? + - fieldName: log.paSuffix + pattern: (?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) + where: oneOf("log.paFormat", ["CEF", "LEEF-legacy"]) + - grok: + source: log.paCefExtensions + patterns: + - fieldName: log.paIgnored + pattern: ^(?:[A-Za-z][A-Za-z0-9_]*=(?:\\.|[^=\\])*?[ \t]+)*?PanOSParentStartTime= + - fieldName: log.PanOSParentStartTime + pattern: (?:\\.|[^=\\])*? + - fieldName: log.paSuffix + pattern: (?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) + where: oneOf("log.paFormat", ["CEF", "LEEF-legacy"]) + - grok: + source: log.paCefExtensions + patterns: + - fieldName: log.paIgnored + pattern: ^(?:[A-Za-z][A-Za-z0-9_]*=(?:\\.|[^=\\])*?[ \t]+)*?PanOSPayloadProtID= + - fieldName: log.PanOSPayloadProtID + pattern: (?:\\.|[^=\\])*? + - fieldName: log.paSuffix + pattern: (?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) + where: oneOf("log.paFormat", ["CEF", "LEEF-legacy"]) + - grok: + source: log.paCefExtensions + patterns: + - fieldName: log.paIgnored + pattern: ^(?:[A-Za-z][A-Za-z0-9_]*=(?:\\.|[^=\\])*?[ \t]+)*?PanOSPcapID= + - fieldName: log.PanOSPcapID + pattern: (?:\\.|[^=\\])*? + - fieldName: log.paSuffix + pattern: (?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) + where: oneOf("log.paFormat", ["CEF", "LEEF-legacy"]) + - grok: + source: log.paCefExtensions + patterns: + - fieldName: log.paIgnored + pattern: ^(?:[A-Za-z][A-Za-z0-9_]*=(?:\\.|[^=\\])*?[ \t]+)*?PanOSPolicyAuditComment= + - fieldName: log.PanOSPolicyAuditComment + pattern: (?:\\.|[^=\\])*? + - fieldName: log.paSuffix + pattern: (?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) + where: oneOf("log.paFormat", ["CEF", "LEEF-legacy"]) + - grok: + source: log.paCefExtensions + patterns: + - fieldName: log.paIgnored + pattern: ^(?:[A-Za-z][A-Za-z0-9_]*=(?:\\.|[^=\\])*?[ \t]+)*?PanOSPolicyName= + - fieldName: log.PanOSPolicyName + pattern: (?:\\.|[^=\\])*? + - fieldName: log.paSuffix + pattern: (?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) + where: oneOf("log.paFormat", ["CEF", "LEEF-legacy"]) + - grok: + source: log.paCefExtensions + patterns: + - fieldName: log.paIgnored + pattern: ^(?:[A-Za-z][A-Za-z0-9_]*=(?:\\.|[^=\\])*?[ \t]+)*?PanOSPortal= + - fieldName: log.PanOSPortal + pattern: (?:\\.|[^=\\])*? + - fieldName: log.paSuffix + pattern: (?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) + where: oneOf("log.paFormat", ["CEF", "LEEF-legacy"]) + - grok: + source: log.paCefExtensions + patterns: + - fieldName: log.paIgnored + pattern: ^(?:[A-Za-z][A-Za-z0-9_]*=(?:\\.|[^=\\])*?[ \t]+)*?PanOSPrivateIPv4= + - fieldName: log.PanOSPrivateIPv4 + pattern: (?:\\.|[^=\\])*? + - fieldName: log.paSuffix + pattern: (?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) + where: oneOf("log.paFormat", ["CEF", "LEEF-legacy"]) + - grok: + source: log.paCefExtensions + patterns: + - fieldName: log.paIgnored + pattern: ^(?:[A-Za-z][A-Za-z0-9_]*=(?:\\.|[^=\\])*?[ \t]+)*?PanOSPrivateIPv6= + - fieldName: log.PanOSPrivateIPv6 + pattern: (?:\\.|[^=\\])*? + - fieldName: log.paSuffix + pattern: (?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) + where: oneOf("log.paFormat", ["CEF", "LEEF-legacy"]) + - grok: + source: log.paCefExtensions + patterns: + - fieldName: log.paIgnored + pattern: ^(?:[A-Za-z][A-Za-z0-9_]*=(?:\\.|[^=\\])*?[ \t]+)*?PanOSProxyType= + - fieldName: log.PanOSProxyType + pattern: (?:\\.|[^=\\])*? + - fieldName: log.paSuffix + pattern: (?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) + where: oneOf("log.paFormat", ["CEF", "LEEF-legacy"]) + - grok: + source: log.paCefExtensions + patterns: + - fieldName: log.paIgnored + pattern: ^(?:[A-Za-z][A-Za-z0-9_]*=(?:\\.|[^=\\])*?[ \t]+)*?PanOSPublicIPv4= + - fieldName: log.PanOSPublicIPv4 + pattern: (?:\\.|[^=\\])*? + - fieldName: log.paSuffix + pattern: (?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) + where: oneOf("log.paFormat", ["CEF", "LEEF-legacy"]) + - grok: + source: log.paCefExtensions + patterns: + - fieldName: log.paIgnored + pattern: ^(?:[A-Za-z][A-Za-z0-9_]*=(?:\\.|[^=\\])*?[ \t]+)*?PanOSPublicIPv6= + - fieldName: log.PanOSPublicIPv6 + pattern: (?:\\.|[^=\\])*? + - fieldName: log.paSuffix + pattern: (?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) + where: oneOf("log.paFormat", ["CEF", "LEEF-legacy"]) + - grok: + source: log.paCefExtensions + patterns: + - fieldName: log.paIgnored + pattern: ^(?:[A-Za-z][A-Za-z0-9_]*=(?:\\.|[^=\\])*?[ \t]+)*?PanOSQuarantineReason= + - fieldName: log.PanOSQuarantineReason + pattern: (?:\\.|[^=\\])*? + - fieldName: log.paSuffix + pattern: (?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) + where: oneOf("log.paFormat", ["CEF", "LEEF-legacy"]) + - grok: + source: log.paCefExtensions + patterns: + - fieldName: log.paIgnored + pattern: ^(?:[A-Za-z][A-Za-z0-9_]*=(?:\\.|[^=\\])*?[ \t]+)*?PanOSRadioTech= + - fieldName: log.PanOSRadioTech + pattern: (?:\\.|[^=\\])*? + - fieldName: log.paSuffix + pattern: (?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) + where: oneOf("log.paFormat", ["CEF", "LEEF-legacy"]) + - grok: + source: log.paCefExtensions + patterns: + - fieldName: log.paIgnored + pattern: ^(?:[A-Za-z][A-Za-z0-9_]*=(?:\\.|[^=\\])*?[ \t]+)*?PanOSReferer= + - fieldName: log.PanOSReferer + pattern: (?:\\.|[^=\\])*? + - fieldName: log.paSuffix + pattern: (?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) + where: oneOf("log.paFormat", ["CEF", "LEEF-legacy"]) + - grok: + source: log.paCefExtensions + patterns: + - fieldName: log.paIgnored + pattern: ^(?:[A-Za-z][A-Za-z0-9_]*=(?:\\.|[^=\\])*?[ \t]+)*?PanOSRmtUserID= + - fieldName: log.PanOSRmtUserID + pattern: (?:\\.|[^=\\])*? + - fieldName: log.paSuffix + pattern: (?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) + where: oneOf("log.paFormat", ["CEF", "LEEF-legacy"]) + - grok: + source: log.paCefExtensions + patterns: + - fieldName: log.paIgnored + pattern: ^(?:[A-Za-z][A-Za-z0-9_]*=(?:\\.|[^=\\])*?[ \t]+)*?PanOSRmtUserIP= + - fieldName: log.PanOSRmtUserIP + pattern: (?:\\.|[^=\\])*? + - fieldName: log.paSuffix + pattern: (?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) + where: oneOf("log.paFormat", ["CEF", "LEEF-legacy"]) + - grok: + source: log.paCefExtensions + patterns: + - fieldName: log.paIgnored + pattern: ^(?:[A-Za-z][A-Za-z0-9_]*=(?:\\.|[^=\\])*?[ \t]+)*?PanOSRootCNLength= + - fieldName: log.PanOSRootCNLength + pattern: (?:\\.|[^=\\])*? + - fieldName: log.paSuffix + pattern: (?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) + where: oneOf("log.paFormat", ["CEF", "LEEF-legacy"]) + - grok: + source: log.paCefExtensions + patterns: + - fieldName: log.paIgnored + pattern: ^(?:[A-Za-z][A-Za-z0-9_]*=(?:\\.|[^=\\])*?[ \t]+)*?PanOSRootCommonName= + - fieldName: log.PanOSRootCommonName + pattern: (?:\\.|[^=\\])*? + - fieldName: log.paSuffix + pattern: (?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) + where: oneOf("log.paFormat", ["CEF", "LEEF-legacy"]) + - grok: + source: log.paCefExtensions + patterns: + - fieldName: log.paIgnored + pattern: ^(?:[A-Za-z][A-Za-z0-9_]*=(?:\\.|[^=\\])*?[ \t]+)*?PanOSRootStatus= + - fieldName: log.PanOSRootStatus + pattern: (?:\\.|[^=\\])*? + - fieldName: log.paSuffix + pattern: (?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) + where: oneOf("log.paFormat", ["CEF", "LEEF-legacy"]) + - grok: + source: log.paCefExtensions + patterns: + - fieldName: log.paIgnored + pattern: ^(?:[A-Za-z][A-Za-z0-9_]*=(?:\\.|[^=\\])*?[ \t]+)*?PanOSRuleUUID= + - fieldName: log.PanOSRuleUUID + pattern: (?:\\.|[^=\\])*? + - fieldName: log.paSuffix + pattern: (?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) + where: oneOf("log.paFormat", ["CEF", "LEEF-legacy"]) + - grok: + source: log.paCefExtensions + patterns: + - fieldName: log.paIgnored + pattern: ^(?:[A-Za-z][A-Za-z0-9_]*=(?:\\.|[^=\\])*?[ \t]+)*?PanOSSCCPCallingGT= + - fieldName: log.PanOSSCCPCallingGT + pattern: (?:\\.|[^=\\])*? + - fieldName: log.paSuffix + pattern: (?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) + where: oneOf("log.paFormat", ["CEF", "LEEF-legacy"]) + - grok: + source: log.paCefExtensions + patterns: + - fieldName: log.paIgnored + pattern: ^(?:[A-Za-z][A-Za-z0-9_]*=(?:\\.|[^=\\])*?[ \t]+)*?PanOSSCCPCallingPartySSN= + - fieldName: log.PanOSSCCPCallingPartySSN + pattern: (?:\\.|[^=\\])*? + - fieldName: log.paSuffix + pattern: (?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) + where: oneOf("log.paFormat", ["CEF", "LEEF-legacy"]) + - grok: + source: log.paCefExtensions + patterns: + - fieldName: log.paIgnored + pattern: ^(?:[A-Za-z][A-Za-z0-9_]*=(?:\\.|[^=\\])*?[ \t]+)*?PanOSSCTPAssocEndReason= + - fieldName: log.PanOSSCTPAssocEndReason + pattern: (?:\\.|[^=\\])*? + - fieldName: log.paSuffix + pattern: (?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) + where: oneOf("log.paFormat", ["CEF", "LEEF-legacy"]) + - grok: + source: log.paCefExtensions + patterns: + - fieldName: log.paIgnored + pattern: ^(?:[A-Za-z][A-Za-z0-9_]*=(?:\\.|[^=\\])*?[ \t]+)*?PanOSSCTPAssocID= + - fieldName: log.PanOSSCTPAssocID + pattern: (?:\\.|[^=\\])*? + - fieldName: log.paSuffix + pattern: (?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) + where: oneOf("log.paFormat", ["CEF", "LEEF-legacy"]) + - grok: + source: log.paCefExtensions + patterns: + - fieldName: log.paIgnored + pattern: ^(?:[A-Za-z][A-Za-z0-9_]*=(?:\\.|[^=\\])*?[ \t]+)*?PanOSSCTPCauseCode= + - fieldName: log.PanOSSCTPCauseCode + pattern: (?:\\.|[^=\\])*? + - fieldName: log.paSuffix + pattern: (?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) + where: oneOf("log.paFormat", ["CEF", "LEEF-legacy"]) + - grok: + source: log.paCefExtensions + patterns: + - fieldName: log.paIgnored + pattern: ^(?:[A-Za-z][A-Za-z0-9_]*=(?:\\.|[^=\\])*?[ \t]+)*?PanOSSCTPChunkRcv= + - fieldName: log.PanOSSCTPChunkRcv + pattern: (?:\\.|[^=\\])*? + - fieldName: log.paSuffix + pattern: (?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) + where: oneOf("log.paFormat", ["CEF", "LEEF-legacy"]) + - grok: + source: log.paCefExtensions + patterns: + - fieldName: log.paIgnored + pattern: ^(?:[A-Za-z][A-Za-z0-9_]*=(?:\\.|[^=\\])*?[ \t]+)*?PanOSSCTPChunkSent= + - fieldName: log.PanOSSCTPChunkSent + pattern: (?:\\.|[^=\\])*? + - fieldName: log.paSuffix + pattern: (?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) + where: oneOf("log.paFormat", ["CEF", "LEEF-legacy"]) + - grok: + source: log.paCefExtensions + patterns: + - fieldName: log.paIgnored + pattern: ^(?:[A-Za-z][A-Za-z0-9_]*=(?:\\.|[^=\\])*?[ \t]+)*?PanOSSCTPChunks= + - fieldName: log.PanOSSCTPChunks + pattern: (?:\\.|[^=\\])*? + - fieldName: log.paSuffix + pattern: (?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) + where: oneOf("log.paFormat", ["CEF", "LEEF-legacy"]) + - grok: + source: log.paCefExtensions + patterns: + - fieldName: log.paIgnored + pattern: ^(?:[A-Za-z][A-Za-z0-9_]*=(?:\\.|[^=\\])*?[ \t]+)*?PanOSSCTPChunksRcv= + - fieldName: log.PanOSSCTPChunksRcv + pattern: (?:\\.|[^=\\])*? + - fieldName: log.paSuffix + pattern: (?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) + where: oneOf("log.paFormat", ["CEF", "LEEF-legacy"]) + - grok: + source: log.paCefExtensions + patterns: + - fieldName: log.paIgnored + pattern: ^(?:[A-Za-z][A-Za-z0-9_]*=(?:\\.|[^=\\])*?[ \t]+)*?PanOSSCTPFilter= + - fieldName: log.PanOSSCTPFilter + pattern: (?:\\.|[^=\\])*? + - fieldName: log.paSuffix + pattern: (?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) + where: oneOf("log.paFormat", ["CEF", "LEEF-legacy"]) + - grok: + source: log.paCefExtensions + patterns: + - fieldName: log.paIgnored + pattern: ^(?:[A-Za-z][A-Za-z0-9_]*=(?:\\.|[^=\\])*?[ \t]+)*?PanOSSCTPStreamID= + - fieldName: log.PanOSSCTPStreamID + pattern: (?:\\.|[^=\\])*? + - fieldName: log.paSuffix + pattern: (?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) + where: oneOf("log.paFormat", ["CEF", "LEEF-legacy"]) + - grok: + source: log.paCefExtensions + patterns: + - fieldName: log.paIgnored + pattern: ^(?:[A-Za-z][A-Za-z0-9_]*=(?:\\.|[^=\\])*?[ \t]+)*?PanOSSCTPVerTag1= + - fieldName: log.PanOSSCTPVerTag1 + pattern: (?:\\.|[^=\\])*? + - fieldName: log.paSuffix + pattern: (?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) + where: oneOf("log.paFormat", ["CEF", "LEEF-legacy"]) + - grok: + source: log.paCefExtensions + patterns: + - fieldName: log.paIgnored + pattern: ^(?:[A-Za-z][A-Za-z0-9_]*=(?:\\.|[^=\\])*?[ \t]+)*?PanOSSCTPVerTag2= + - fieldName: log.PanOSSCTPVerTag2 + pattern: (?:\\.|[^=\\])*? + - fieldName: log.paSuffix + pattern: (?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) + where: oneOf("log.paFormat", ["CEF", "LEEF-legacy"]) + - grok: + source: log.paCefExtensions + patterns: + - fieldName: log.paIgnored + pattern: ^(?:[A-Za-z][A-Za-z0-9_]*=(?:\\.|[^=\\])*?[ \t]+)*?PanOSSNILength= + - fieldName: log.PanOSSNILength + pattern: (?:\\.|[^=\\])*? + - fieldName: log.paSuffix + pattern: (?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) + where: oneOf("log.paFormat", ["CEF", "LEEF-legacy"]) + - grok: + source: log.paCefExtensions + patterns: + - fieldName: log.paIgnored + pattern: ^(?:[A-Za-z][A-Za-z0-9_]*=(?:\\.|[^=\\])*?[ \t]+)*?PanOSSSLResponseTime= + - fieldName: log.PanOSSSLResponseTime + pattern: (?:\\.|[^=\\])*? + - fieldName: log.paSuffix + pattern: (?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) + where: oneOf("log.paFormat", ["CEF", "LEEF-legacy"]) + - grok: + source: log.paCefExtensions + patterns: + - fieldName: log.paIgnored + pattern: ^(?:[A-Za-z][A-Za-z0-9_]*=(?:\\.|[^=\\])*?[ \t]+)*?PanOSSequenceNo= + - fieldName: log.PanOSSequenceNo + pattern: (?:\\.|[^=\\])*? + - fieldName: log.paSuffix + pattern: (?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) + where: oneOf("log.paFormat", ["CEF", "LEEF-legacy"]) + - grok: + source: log.paCefExtensions + patterns: + - fieldName: log.paIgnored + pattern: ^(?:[A-Za-z][A-Za-z0-9_]*=(?:\\.|[^=\\])*?[ \t]+)*?PanOSServerNameIndication= + - fieldName: log.PanOSServerNameIndication + pattern: (?:\\.|[^=\\])*? + - fieldName: log.paSuffix + pattern: (?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) + where: oneOf("log.paFormat", ["CEF", "LEEF-legacy"]) + - grok: + source: log.paCefExtensions + patterns: + - fieldName: log.paIgnored + pattern: ^(?:[A-Za-z][A-Za-z0-9_]*=(?:\\.|[^=\\])*?[ \t]+)*?PanOSServingCntryMCC= + - fieldName: log.PanOSServingCntryMCC + pattern: (?:\\.|[^=\\])*? + - fieldName: log.paSuffix + pattern: (?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) + where: oneOf("log.paFormat", ["CEF", "LEEF-legacy"]) + - grok: + source: log.paCefExtensions + patterns: + - fieldName: log.paIgnored + pattern: ^(?:[A-Za-z][A-Za-z0-9_]*=(?:\\.|[^=\\])*?[ \t]+)*?PanOSServingNetMNC= + - fieldName: log.PanOSServingNetMNC + pattern: (?:\\.|[^=\\])*? + - fieldName: log.paSuffix + pattern: (?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) + where: oneOf("log.paFormat", ["CEF", "LEEF-legacy"]) + - grok: + source: log.paCefExtensions + patterns: + - fieldName: log.paIgnored + pattern: ^(?:[A-Za-z][A-Za-z0-9_]*=(?:\\.|[^=\\])*?[ \t]+)*?PanOSSeverity= + - fieldName: log.PanOSSeverity + pattern: (?:\\.|[^=\\])*? + - fieldName: log.paSuffix + pattern: (?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) + where: oneOf("log.paFormat", ["CEF", "LEEF-legacy"]) + - grok: + source: log.paCefExtensions + patterns: + - fieldName: log.paIgnored + pattern: ^(?:[A-Za-z][A-Za-z0-9_]*=(?:\\.|[^=\\])*?[ \t]+)*?PanOSSourceDeviceCategory= + - fieldName: log.PanOSSourceDeviceCategory + pattern: (?:\\.|[^=\\])*? + - fieldName: log.paSuffix + pattern: (?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) + where: oneOf("log.paFormat", ["CEF", "LEEF-legacy"]) + - grok: + source: log.paCefExtensions + patterns: + - fieldName: log.paIgnored + pattern: ^(?:[A-Za-z][A-Za-z0-9_]*=(?:\\.|[^=\\])*?[ \t]+)*?PanOSSourceDeviceHost= + - fieldName: log.PanOSSourceDeviceHost + pattern: (?:\\.|[^=\\])*? + - fieldName: log.paSuffix + pattern: (?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) + where: oneOf("log.paFormat", ["CEF", "LEEF-legacy"]) + - grok: + source: log.paCefExtensions + patterns: + - fieldName: log.paIgnored + pattern: ^(?:[A-Za-z][A-Za-z0-9_]*=(?:\\.|[^=\\])*?[ \t]+)*?PanOSSourceDeviceMac= + - fieldName: log.PanOSSourceDeviceMac + pattern: (?:\\.|[^=\\])*? + - fieldName: log.paSuffix + pattern: (?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) + where: oneOf("log.paFormat", ["CEF", "LEEF-legacy"]) + - grok: + source: log.paCefExtensions + patterns: + - fieldName: log.paIgnored + pattern: ^(?:[A-Za-z][A-Za-z0-9_]*=(?:\\.|[^=\\])*?[ \t]+)*?PanOSSourceDeviceModel= + - fieldName: log.PanOSSourceDeviceModel + pattern: (?:\\.|[^=\\])*? + - fieldName: log.paSuffix + pattern: (?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) + where: oneOf("log.paFormat", ["CEF", "LEEF-legacy"]) + - grok: + source: log.paCefExtensions + patterns: + - fieldName: log.paIgnored + pattern: ^(?:[A-Za-z][A-Za-z0-9_]*=(?:\\.|[^=\\])*?[ \t]+)*?PanOSSourceDeviceOSFamily= + - fieldName: log.PanOSSourceDeviceOSFamily + pattern: (?:\\.|[^=\\])*? + - fieldName: log.paSuffix + pattern: (?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) + where: oneOf("log.paFormat", ["CEF", "LEEF-legacy"]) + - grok: + source: log.paCefExtensions + patterns: + - fieldName: log.paIgnored + pattern: ^(?:[A-Za-z][A-Za-z0-9_]*=(?:\\.|[^=\\])*?[ \t]+)*?PanOSSourceDeviceOSVersion= + - fieldName: log.PanOSSourceDeviceOSVersion + pattern: (?:\\.|[^=\\])*? + - fieldName: log.paSuffix + pattern: (?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) + where: oneOf("log.paFormat", ["CEF", "LEEF-legacy"]) + - grok: + source: log.paCefExtensions + patterns: + - fieldName: log.paIgnored + pattern: ^(?:[A-Za-z][A-Za-z0-9_]*=(?:\\.|[^=\\])*?[ \t]+)*?PanOSSourceDeviceProfile= + - fieldName: log.PanOSSourceDeviceProfile + pattern: (?:\\.|[^=\\])*? + - fieldName: log.paSuffix + pattern: (?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) + where: oneOf("log.paFormat", ["CEF", "LEEF-legacy"]) + - grok: + source: log.paCefExtensions + patterns: + - fieldName: log.paIgnored + pattern: ^(?:[A-Za-z][A-Za-z0-9_]*=(?:\\.|[^=\\])*?[ \t]+)*?PanOSSourceDeviceVendor= + - fieldName: log.PanOSSourceDeviceVendor + pattern: (?:\\.|[^=\\])*? + - fieldName: log.paSuffix + pattern: (?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) + where: oneOf("log.paFormat", ["CEF", "LEEF-legacy"]) + - grok: + source: log.paCefExtensions + patterns: + - fieldName: log.paIgnored + pattern: ^(?:[A-Za-z][A-Za-z0-9_]*=(?:\\.|[^=\\])*?[ \t]+)*?PanOSSourceDynamicAddressGroup= + - fieldName: log.PanOSSourceDynamicAddressGroup + pattern: (?:\\.|[^=\\])*? + - fieldName: log.paSuffix + pattern: (?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) + where: oneOf("log.paFormat", ["CEF", "LEEF-legacy"]) + - grok: + source: log.paCefExtensions + patterns: + - fieldName: log.paIgnored + pattern: ^(?:[A-Za-z][A-Za-z0-9_]*=(?:\\.|[^=\\])*?[ \t]+)*?PanOSSourceEDL= + - fieldName: log.PanOSSourceEDL + pattern: (?:\\.|[^=\\])*? + - fieldName: log.paSuffix + pattern: (?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) + where: oneOf("log.paFormat", ["CEF", "LEEF-legacy"]) + - grok: + source: log.paCefExtensions + patterns: + - fieldName: log.paIgnored + pattern: ^(?:[A-Za-z][A-Za-z0-9_]*=(?:\\.|[^=\\])*?[ \t]+)*?PanOSSourceHostname= + - fieldName: log.PanOSSourceHostname + pattern: (?:\\.|[^=\\])*? + - fieldName: log.paSuffix + pattern: (?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) + where: oneOf("log.paFormat", ["CEF", "LEEF-legacy"]) + - grok: + source: log.paCefExtensions + patterns: + - fieldName: log.paIgnored + pattern: ^(?:[A-Za-z][A-Za-z0-9_]*=(?:\\.|[^=\\])*?[ \t]+)*?PanOSSourceMac= + - fieldName: log.PanOSSourceMac + pattern: (?:\\.|[^=\\])*? + - fieldName: log.paSuffix + pattern: (?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) + where: oneOf("log.paFormat", ["CEF", "LEEF-legacy"]) + - grok: + source: log.paCefExtensions + patterns: + - fieldName: log.paIgnored + pattern: ^(?:[A-Za-z][A-Za-z0-9_]*=(?:\\.|[^=\\])*?[ \t]+)*?PanOSSourceRegion= + - fieldName: log.PanOSSourceRegion + pattern: (?:\\.|[^=\\])*? + - fieldName: log.paSuffix + pattern: (?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) + where: oneOf("log.paFormat", ["CEF", "LEEF-legacy"]) + - grok: + source: log.paCefExtensions + patterns: + - fieldName: log.paIgnored + pattern: ^(?:[A-Za-z][A-Za-z0-9_]*=(?:\\.|[^=\\])*?[ \t]+)*?PanOSSourceUUID= + - fieldName: log.PanOSSourceUUID + pattern: (?:\\.|[^=\\])*? + - fieldName: log.paSuffix + pattern: (?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) + where: oneOf("log.paFormat", ["CEF", "LEEF-legacy"]) + - grok: + source: log.paCefExtensions + patterns: + - fieldName: log.paIgnored + pattern: ^(?:[A-Za-z][A-Za-z0-9_]*=(?:\\.|[^=\\])*?[ \t]+)*?PanOSSourceUserName= + - fieldName: log.PanOSSourceUserName + pattern: (?:\\.|[^=\\])*? + - fieldName: log.paSuffix + pattern: (?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) + where: oneOf("log.paFormat", ["CEF", "LEEF-legacy"]) + - grok: + source: log.paCefExtensions + patterns: + - fieldName: log.paIgnored + pattern: ^(?:[A-Za-z][A-Za-z0-9_]*=(?:\\.|[^=\\])*?[ \t]+)*?PanOSSrcUUID= + - fieldName: log.PanOSSrcUUID + pattern: (?:\\.|[^=\\])*? + - fieldName: log.paSuffix + pattern: (?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) + where: oneOf("log.paFormat", ["CEF", "LEEF-legacy"]) + - grok: + source: log.paCefExtensions + patterns: + - fieldName: log.paIgnored + pattern: ^(?:[A-Za-z][A-Za-z0-9_]*=(?:\\.|[^=\\])*?[ \t]+)*?PanOSStage= + - fieldName: log.PanOSStage + pattern: (?:\\.|[^=\\])*? + - fieldName: log.paSuffix + pattern: (?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) + where: oneOf("log.paFormat", ["CEF", "LEEF-legacy"]) + - grok: + source: log.paCefExtensions + patterns: + - fieldName: log.paIgnored + pattern: ^(?:[A-Za-z][A-Za-z0-9_]*=(?:\\.|[^=\\])*?[ \t]+)*?PanOSTLSAuth= + - fieldName: log.PanOSTLSAuth + pattern: (?:\\.|[^=\\])*? + - fieldName: log.paSuffix + pattern: (?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) + where: oneOf("log.paFormat", ["CEF", "LEEF-legacy"]) + - grok: + source: log.paCefExtensions + patterns: + - fieldName: log.paIgnored + pattern: ^(?:[A-Za-z][A-Za-z0-9_]*=(?:\\.|[^=\\])*?[ \t]+)*?PanOSTLSEncryptionAlgorithm= + - fieldName: log.PanOSTLSEncryptionAlgorithm + pattern: (?:\\.|[^=\\])*? + - fieldName: log.paSuffix + pattern: (?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) + where: oneOf("log.paFormat", ["CEF", "LEEF-legacy"]) + - grok: + source: log.paCefExtensions + patterns: + - fieldName: log.paIgnored + pattern: ^(?:[A-Za-z][A-Za-z0-9_]*=(?:\\.|[^=\\])*?[ \t]+)*?PanOSTLSKeyExchange= + - fieldName: log.PanOSTLSKeyExchange + pattern: (?:\\.|[^=\\])*? + - fieldName: log.paSuffix + pattern: (?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) + where: oneOf("log.paFormat", ["CEF", "LEEF-legacy"]) + - grok: + source: log.paCefExtensions + patterns: + - fieldName: log.paIgnored + pattern: ^(?:[A-Za-z][A-Za-z0-9_]*=(?:\\.|[^=\\])*?[ \t]+)*?PanOSTLSVersion= + - fieldName: log.PanOSTLSVersion + pattern: (?:\\.|[^=\\])*? + - fieldName: log.paSuffix + pattern: (?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) + where: oneOf("log.paFormat", ["CEF", "LEEF-legacy"]) + - grok: + source: log.paCefExtensions + patterns: + - fieldName: log.paIgnored + pattern: ^(?:[A-Za-z][A-Za-z0-9_]*=(?:\\.|[^=\\])*?[ \t]+)*?PanOSTagName= + - fieldName: log.PanOSTagName + pattern: (?:\\.|[^=\\])*? + - fieldName: log.paSuffix + pattern: (?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) + where: oneOf("log.paFormat", ["CEF", "LEEF-legacy"]) + - grok: + source: log.paCefExtensions + patterns: + - fieldName: log.paIgnored + pattern: ^(?:[A-Za-z][A-Za-z0-9_]*=(?:\\.|[^=\\])*?[ \t]+)*?PanOSThreatCategory= + - fieldName: log.PanOSThreatCategory + pattern: (?:\\.|[^=\\])*? + - fieldName: log.paSuffix + pattern: (?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) + where: oneOf("log.paFormat", ["CEF", "LEEF-legacy"]) + - grok: + source: log.paCefExtensions + patterns: + - fieldName: log.paIgnored + pattern: ^(?:[A-Za-z][A-Za-z0-9_]*=(?:\\.|[^=\\])*?[ \t]+)*?PanOSTimeGeneratedHighResolution= + - fieldName: log.PanOSTimeGeneratedHighResolution + pattern: (?:\\.|[^=\\])*? + - fieldName: log.paSuffix + pattern: (?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) + where: oneOf("log.paFormat", ["CEF", "LEEF-legacy"]) + - grok: + source: log.paCefExtensions + patterns: + - fieldName: log.paIgnored + pattern: ^(?:[A-Za-z][A-Za-z0-9_]*=(?:\\.|[^=\\])*?[ \t]+)*?PanOSTimeNotAfter= + - fieldName: log.PanOSTimeNotAfter + pattern: (?:\\.|[^=\\])*? + - fieldName: log.paSuffix + pattern: (?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) + where: oneOf("log.paFormat", ["CEF", "LEEF-legacy"]) + - grok: + source: log.paCefExtensions + patterns: + - fieldName: log.paIgnored + pattern: ^(?:[A-Za-z][A-Za-z0-9_]*=(?:\\.|[^=\\])*?[ \t]+)*?PanOSTimeNotBefore= + - fieldName: log.PanOSTimeNotBefore + pattern: (?:\\.|[^=\\])*? + - fieldName: log.paSuffix + pattern: (?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) + where: oneOf("log.paFormat", ["CEF", "LEEF-legacy"]) + - grok: + source: log.paCefExtensions + patterns: + - fieldName: log.paIgnored + pattern: ^(?:[A-Za-z][A-Za-z0-9_]*=(?:\\.|[^=\\])*?[ \t]+)*?PanOSTimeReceivedManagementPlane= + - fieldName: log.PanOSTimeReceivedManagementPlane + pattern: (?:\\.|[^=\\])*? + - fieldName: log.paSuffix + pattern: (?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) + where: oneOf("log.paFormat", ["CEF", "LEEF-legacy"]) + - grok: + source: log.paCefExtensions + patterns: + - fieldName: log.paIgnored + pattern: ^(?:[A-Za-z][A-Za-z0-9_]*=(?:\\.|[^=\\])*?[ \t]+)*?PanOSTimeout= + - fieldName: log.PanOSTimeout + pattern: (?:\\.|[^=\\])*? + - fieldName: log.paSuffix + pattern: (?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) + where: oneOf("log.paFormat", ["CEF", "LEEF-legacy"]) + - grok: + source: log.paCefExtensions + patterns: + - fieldName: log.paIgnored + pattern: ^(?:[A-Za-z][A-Za-z0-9_]*=(?:\\.|[^=\\])*?[ \t]+)*?PanOSTrafficOriginRegion= + - fieldName: log.PanOSTrafficOriginRegion + pattern: (?:\\.|[^=\\])*? + - fieldName: log.paSuffix + pattern: (?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) + where: oneOf("log.paFormat", ["CEF", "LEEF-legacy"]) + - grok: + source: log.paCefExtensions + patterns: + - fieldName: log.paIgnored + pattern: ^(?:[A-Za-z][A-Za-z0-9_]*=(?:\\.|[^=\\])*?[ \t]+)*?PanOSTrafficSessionID= + - fieldName: log.PanOSTrafficSessionID + pattern: (?:\\.|[^=\\])*? + - fieldName: log.paSuffix + pattern: (?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) + where: oneOf("log.paFormat", ["CEF", "LEEF-legacy"]) + - grok: + source: log.paCefExtensions + patterns: + - fieldName: log.paIgnored + pattern: ^(?:[A-Za-z][A-Za-z0-9_]*=(?:\\.|[^=\\])*?[ \t]+)*?PanOSTunneInspectionRule= + - fieldName: log.PanOSTunneInspectionRule + pattern: (?:\\.|[^=\\])*? + - fieldName: log.paSuffix + pattern: (?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) + where: oneOf("log.paFormat", ["CEF", "LEEF-legacy"]) + - grok: + source: log.paCefExtensions + patterns: + - fieldName: log.paIgnored + pattern: ^(?:[A-Za-z][A-Za-z0-9_]*=(?:\\.|[^=\\])*?[ \t]+)*?PanOSTunnel= + - fieldName: log.PanOSTunnel + pattern: (?:\\.|[^=\\])*? + - fieldName: log.paSuffix + pattern: (?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) + where: oneOf("log.paFormat", ["CEF", "LEEF-legacy"]) + - grok: + source: log.paCefExtensions + patterns: + - fieldName: log.paIgnored + pattern: ^(?:[A-Za-z][A-Za-z0-9_]*=(?:\\.|[^=\\])*?[ \t]+)*?PanOSTunnelEndptID1= + - fieldName: log.PanOSTunnelEndptID1 + pattern: (?:\\.|[^=\\])*? + - fieldName: log.paSuffix + pattern: (?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) + where: oneOf("log.paFormat", ["CEF", "LEEF-legacy"]) + - grok: + source: log.paCefExtensions + patterns: + - fieldName: log.paIgnored + pattern: ^(?:[A-Za-z][A-Za-z0-9_]*=(?:\\.|[^=\\])*?[ \t]+)*?PanOSTunnelEndptID2= + - fieldName: log.PanOSTunnelEndptID2 + pattern: (?:\\.|[^=\\])*? + - fieldName: log.paSuffix + pattern: (?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) + where: oneOf("log.paFormat", ["CEF", "LEEF-legacy"]) + - grok: + source: log.paCefExtensions + patterns: + - fieldName: log.paIgnored + pattern: ^(?:[A-Za-z][A-Za-z0-9_]*=(?:\\.|[^=\\])*?[ \t]+)*?PanOSTunnelFragment= + - fieldName: log.PanOSTunnelFragment + pattern: (?:\\.|[^=\\])*? + - fieldName: log.paSuffix + pattern: (?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) + where: oneOf("log.paFormat", ["CEF", "LEEF-legacy"]) + - grok: + source: log.paCefExtensions + patterns: + - fieldName: log.paIgnored + pattern: ^(?:[A-Za-z][A-Za-z0-9_]*=(?:\\.|[^=\\])*?[ \t]+)*?PanOSTunnelID= + - fieldName: log.PanOSTunnelID + pattern: (?:\\.|[^=\\])*? + - fieldName: log.paSuffix + pattern: (?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) + where: oneOf("log.paFormat", ["CEF", "LEEF-legacy"]) + - grok: + source: log.paCefExtensions + patterns: + - fieldName: log.paIgnored + pattern: ^(?:[A-Za-z][A-Za-z0-9_]*=(?:\\.|[^=\\])*?[ \t]+)*?PanOSTunnelInspectionRule= + - fieldName: log.PanOSTunnelInspectionRule + pattern: (?:\\.|[^=\\])*? + - fieldName: log.paSuffix + pattern: (?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) + where: oneOf("log.paFormat", ["CEF", "LEEF-legacy"]) + - grok: + source: log.paCefExtensions + patterns: + - fieldName: log.paIgnored + pattern: ^(?:[A-Za-z][A-Za-z0-9_]*=(?:\\.|[^=\\])*?[ \t]+)*?PanOSTunnelType= + - fieldName: log.PanOSTunnelType + pattern: (?:\\.|[^=\\])*? + - fieldName: log.paSuffix + pattern: (?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) + where: oneOf("log.paFormat", ["CEF", "LEEF-legacy"]) + - grok: + source: log.paCefExtensions + patterns: + - fieldName: log.paIgnored + pattern: ^(?:[A-Za-z][A-Za-z0-9_]*=(?:\\.|[^=\\])*?[ \t]+)*?PanOSUGFlags= + - fieldName: log.PanOSUGFlags + pattern: (?:\\.|[^=\\])*? + - fieldName: log.paSuffix + pattern: (?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) + where: oneOf("log.paFormat", ["CEF", "LEEF-legacy"]) + - grok: + source: log.paCefExtensions + patterns: + - fieldName: log.paIgnored + pattern: ^(?:[A-Za-z][A-Za-z0-9_]*=(?:\\.|[^=\\])*?[ \t]+)*?PanOSURLCatList= + - fieldName: log.PanOSURLCatList + pattern: (?:\\.|[^=\\])*? + - fieldName: log.paSuffix + pattern: (?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) + where: oneOf("log.paFormat", ["CEF", "LEEF-legacy"]) + - grok: + source: log.paCefExtensions + patterns: + - fieldName: log.paIgnored + pattern: ^(?:[A-Za-z][A-Za-z0-9_]*=(?:\\.|[^=\\])*?[ \t]+)*?PanOSUserBySource= + - fieldName: log.PanOSUserBySource + pattern: (?:\\.|[^=\\])*? + - fieldName: log.paSuffix + pattern: (?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) + where: oneOf("log.paFormat", ["CEF", "LEEF-legacy"]) + - grok: + source: log.paCefExtensions + patterns: + - fieldName: log.paIgnored + pattern: ^(?:[A-Za-z][A-Za-z0-9_]*=(?:\\.|[^=\\])*?[ \t]+)*?PanOSVirtualSystem= + - fieldName: log.PanOSVirtualSystem + pattern: (?:\\.|[^=\\])*? + - fieldName: log.paSuffix + pattern: (?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) + where: oneOf("log.paFormat", ["CEF", "LEEF-legacy"]) + - grok: + source: log.paCefExtensions + patterns: + - fieldName: log.paIgnored + pattern: ^(?:[A-Za-z][A-Za-z0-9_]*=(?:\\.|[^=\\])*?[ \t]+)*?PanOSVsysName= + - fieldName: log.PanOSVsysName + pattern: (?:\\.|[^=\\])*? + - fieldName: log.paSuffix + pattern: (?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) + where: oneOf("log.paFormat", ["CEF", "LEEF-legacy"]) + - grok: + source: log.paCefExtensions + patterns: + - fieldName: log.paIgnored + pattern: ^(?:[A-Za-z][A-Za-z0-9_]*=(?:\\.|[^=\\])*?[ \t]+)*?PanOSXForwarderfor= + - fieldName: log.PanOSXForwarderfor + pattern: (?:\\.|[^=\\])*? + - fieldName: log.paSuffix + pattern: (?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) + where: oneOf("log.paFormat", ["CEF", "LEEF-legacy"]) + - grok: + source: log.paCefExtensions + patterns: + - fieldName: log.paIgnored + pattern: ^(?:[A-Za-z][A-Za-z0-9_]*=(?:\\.|[^=\\])*?[ \t]+)*?PanOsVsysName= + - fieldName: log.PanOsVsysName + pattern: (?:\\.|[^=\\])*? + - fieldName: log.paSuffix + pattern: (?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) + where: oneOf("log.paFormat", ["CEF", "LEEF-legacy"]) + - grok: + source: log.paCefExtensions + patterns: + - fieldName: log.paIgnored + pattern: ^(?:[A-Za-z][A-Za-z0-9_]*=(?:\\.|[^=\\])*?[ \t]+)*?PanPODName= + - fieldName: log.PanPODName + pattern: (?:\\.|[^=\\])*? + - fieldName: log.paSuffix + pattern: (?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) + where: oneOf("log.paFormat", ["CEF", "LEEF-legacy"]) + - grok: + source: log.paCefExtensions + patterns: + - fieldName: log.paIgnored + pattern: ^(?:[A-Za-z][A-Za-z0-9_]*=(?:\\.|[^=\\])*?[ \t]+)*?PanPODNamespace= + - fieldName: log.PanPODNamespace + pattern: (?:\\.|[^=\\])*? + - fieldName: log.paSuffix + pattern: (?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) + where: oneOf("log.paFormat", ["CEF", "LEEF-legacy"]) + - grok: + source: log.paCefExtensions + patterns: + - fieldName: log.paIgnored + pattern: ^(?:[A-Za-z][A-Za-z0-9_]*=(?:\\.|[^=\\])*?[ \t]+)*?PanPartialHash= + - fieldName: log.PanPartialHash + pattern: (?:\\.|[^=\\])*? + - fieldName: log.paSuffix + pattern: (?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) + where: oneOf("log.paFormat", ["CEF", "LEEF-legacy"]) + - grok: + source: log.paCefExtensions + patterns: + - fieldName: log.paIgnored + pattern: ^(?:[A-Za-z][A-Za-z0-9_]*=(?:\\.|[^=\\])*?[ \t]+)*?PanPolicyID= + - fieldName: log.PanPolicyID + pattern: (?:\\.|[^=\\])*? + - fieldName: log.paSuffix + pattern: (?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) + where: oneOf("log.paFormat", ["CEF", "LEEF-legacy"]) + - grok: + source: log.paCefExtensions + patterns: + - fieldName: log.paIgnored + pattern: ^(?:[A-Za-z][A-Za-z0-9_]*=(?:\\.|[^=\\])*?[ \t]+)*?PanReasonFilteringAction= + - fieldName: log.PanReasonFilteringAction + pattern: (?:\\.|[^=\\])*? + - fieldName: log.paSuffix + pattern: (?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) + where: oneOf("log.paFormat", ["CEF", "LEEF-legacy"]) + - grok: + source: log.paCefExtensions + patterns: + - fieldName: log.paIgnored + pattern: ^(?:[A-Za-z][A-Za-z0-9_]*=(?:\\.|[^=\\])*?[ \t]+)*?PanSDWANCluster= + - fieldName: log.PanSDWANCluster + pattern: (?:\\.|[^=\\])*? + - fieldName: log.paSuffix + pattern: (?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) + where: oneOf("log.paFormat", ["CEF", "LEEF-legacy"]) + - grok: + source: log.paCefExtensions + patterns: + - fieldName: log.paIgnored + pattern: ^(?:[A-Za-z][A-Za-z0-9_]*=(?:\\.|[^=\\])*?[ \t]+)*?PanSDWANClustype= + - fieldName: log.PanSDWANClustype + pattern: (?:\\.|[^=\\])*? + - fieldName: log.paSuffix + pattern: (?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) + where: oneOf("log.paFormat", ["CEF", "LEEF-legacy"]) + - grok: + source: log.paCefExtensions + patterns: + - fieldName: log.paIgnored + pattern: ^(?:[A-Za-z][A-Za-z0-9_]*=(?:\\.|[^=\\])*?[ \t]+)*?PanSDWANDevice= + - fieldName: log.PanSDWANDevice + pattern: (?:\\.|[^=\\])*? + - fieldName: log.paSuffix + pattern: (?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) + where: oneOf("log.paFormat", ["CEF", "LEEF-legacy"]) + - grok: + source: log.paCefExtensions + patterns: + - fieldName: log.paIgnored + pattern: ^(?:[A-Za-z][A-Za-z0-9_]*=(?:\\.|[^=\\])*?[ \t]+)*?PanSDWANSite= + - fieldName: log.PanSDWANSite + pattern: (?:\\.|[^=\\])*? + - fieldName: log.paSuffix + pattern: (?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) + where: oneOf("log.paFormat", ["CEF", "LEEF-legacy"]) + - grok: + source: log.paCefExtensions + patterns: + - fieldName: log.paIgnored + pattern: ^(?:[A-Za-z][A-Za-z0-9_]*=(?:\\.|[^=\\])*?[ \t]+)*?PanSrcDAG= + - fieldName: log.PanSrcDAG + pattern: (?:\\.|[^=\\])*? + - fieldName: log.paSuffix + pattern: (?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) + where: oneOf("log.paFormat", ["CEF", "LEEF-legacy"]) + - grok: + source: log.paCefExtensions + patterns: + - fieldName: log.paIgnored + pattern: ^(?:[A-Za-z][A-Za-z0-9_]*=(?:\\.|[^=\\])*?[ \t]+)*?PanSrcDeviceCat= + - fieldName: log.PanSrcDeviceCat + pattern: (?:\\.|[^=\\])*? + - fieldName: log.paSuffix + pattern: (?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) + where: oneOf("log.paFormat", ["CEF", "LEEF-legacy"]) + - grok: + source: log.paCefExtensions + patterns: + - fieldName: log.paIgnored + pattern: ^(?:[A-Za-z][A-Za-z0-9_]*=(?:\\.|[^=\\])*?[ \t]+)*?PanSrcDeviceModel= + - fieldName: log.PanSrcDeviceModel + pattern: (?:\\.|[^=\\])*? + - fieldName: log.paSuffix + pattern: (?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) + where: oneOf("log.paFormat", ["CEF", "LEEF-legacy"]) + - grok: + source: log.paCefExtensions + patterns: + - fieldName: log.paIgnored + pattern: ^(?:[A-Za-z][A-Za-z0-9_]*=(?:\\.|[^=\\])*?[ \t]+)*?PanSrcDeviceOS= + - fieldName: log.PanSrcDeviceOS + pattern: (?:\\.|[^=\\])*? + - fieldName: log.paSuffix + pattern: (?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) + where: oneOf("log.paFormat", ["CEF", "LEEF-legacy"]) + - grok: + source: log.paCefExtensions + patterns: + - fieldName: log.paIgnored + pattern: ^(?:[A-Za-z][A-Za-z0-9_]*=(?:\\.|[^=\\])*?[ \t]+)*?PanSrcDeviceOSv= + - fieldName: log.PanSrcDeviceOSv + pattern: (?:\\.|[^=\\])*? + - fieldName: log.paSuffix + pattern: (?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) + where: oneOf("log.paFormat", ["CEF", "LEEF-legacy"]) + - grok: + source: log.paCefExtensions + patterns: + - fieldName: log.paIgnored + pattern: ^(?:[A-Za-z][A-Za-z0-9_]*=(?:\\.|[^=\\])*?[ \t]+)*?PanSrcDeviceProf= + - fieldName: log.PanSrcDeviceProf + pattern: (?:\\.|[^=\\])*? + - fieldName: log.paSuffix + pattern: (?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) + where: oneOf("log.paFormat", ["CEF", "LEEF-legacy"]) + - grok: + source: log.paCefExtensions + patterns: + - fieldName: log.paIgnored + pattern: ^(?:[A-Za-z][A-Za-z0-9_]*=(?:\\.|[^=\\])*?[ \t]+)*?PanSrcDeviceVendor= + - fieldName: log.PanSrcDeviceVendor + pattern: (?:\\.|[^=\\])*? + - fieldName: log.paSuffix + pattern: (?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) + where: oneOf("log.paFormat", ["CEF", "LEEF-legacy"]) + - grok: + source: log.paCefExtensions + patterns: + - fieldName: log.paIgnored + pattern: ^(?:[A-Za-z][A-Za-z0-9_]*=(?:\\.|[^=\\])*?[ \t]+)*?PanSrcEDL= + - fieldName: log.PanSrcEDL + pattern: (?:\\.|[^=\\])*? + - fieldName: log.paSuffix + pattern: (?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) + where: oneOf("log.paFormat", ["CEF", "LEEF-legacy"]) + - grok: + source: log.paCefExtensions + patterns: + - fieldName: log.paIgnored + pattern: ^(?:[A-Za-z][A-Za-z0-9_]*=(?:\\.|[^=\\])*?[ \t]+)*?PanSrcHostname= + - fieldName: log.PanSrcHostname + pattern: (?:\\.|[^=\\])*? + - fieldName: log.paSuffix + pattern: (?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) + where: oneOf("log.paFormat", ["CEF", "LEEF-legacy"]) + - grok: + source: log.paCefExtensions + patterns: + - fieldName: log.paIgnored + pattern: ^(?:[A-Za-z][A-Za-z0-9_]*=(?:\\.|[^=\\])*?[ \t]+)*?PanSrcMac= + - fieldName: log.PanSrcMac + pattern: (?:\\.|[^=\\])*? + - fieldName: log.paSuffix + pattern: (?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) + where: oneOf("log.paFormat", ["CEF", "LEEF-legacy"]) + - grok: + source: log.paCefExtensions + patterns: + - fieldName: log.paIgnored + pattern: ^(?:[A-Za-z][A-Za-z0-9_]*=(?:\\.|[^=\\])*?[ \t]+)*?PanTimeHighRes= + - fieldName: log.PanTimeHighRes + pattern: (?:\\.|[^=\\])*? + - fieldName: log.paSuffix + pattern: (?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) + where: oneOf("log.paFormat", ["CEF", "LEEF-legacy"]) + - grok: + source: log.paCefExtensions + patterns: + - fieldName: log.paIgnored + pattern: ^(?:[A-Za-z][A-Za-z0-9_]*=(?:\\.|[^=\\])*?[ \t]+)*?PanXFFIP= + - fieldName: log.PanXFFIP + pattern: (?:\\.|[^=\\])*? + - fieldName: log.paSuffix + pattern: (?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) + where: oneOf("log.paFormat", ["CEF", "LEEF-legacy"]) + - grok: + source: log.paCefExtensions + patterns: + - fieldName: log.paIgnored + pattern: ^(?:[A-Za-z][A-Za-z0-9_]*=(?:\\.|[^=\\])*?[ \t]+)*?SessionIDcn1= + - fieldName: log.SessionIDcn1 + pattern: (?:\\.|[^=\\])*? + - fieldName: log.paSuffix + pattern: (?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) + where: oneOf("log.paFormat", ["CEF", "LEEF-legacy"]) + - grok: + source: log.paCefExtensions + patterns: + - fieldName: log.paIgnored + pattern: ^(?:[A-Za-z][A-Za-z0-9_]*=(?:\\.|[^=\\])*?[ \t]+)*?Typecs5= + - fieldName: log.Typecs5 + pattern: (?:\\.|[^=\\])*? + - fieldName: log.paSuffix + pattern: (?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) + where: oneOf("log.paFormat", ["CEF", "LEEF-legacy"]) + - grok: + source: log.paCefExtensions + patterns: + - fieldName: log.paIgnored + pattern: ^(?:[A-Za-z][A-Za-z0-9_]*=(?:\\.|[^=\\])*?[ \t]+)*?Typecs6= + - fieldName: log.Typecs6 + pattern: (?:\\.|[^=\\])*? + - fieldName: log.paSuffix + pattern: (?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) + where: oneOf("log.paFormat", ["CEF", "LEEF-legacy"]) + - grok: + source: log.paCefExtensions + patterns: + - fieldName: log.paIgnored + pattern: ^(?:[A-Za-z][A-Za-z0-9_]*=(?:\\.|[^=\\])*?[ \t]+)*?VendorflexString2= + - fieldName: log.VendorflexString2 + pattern: (?:\\.|[^=\\])*? + - fieldName: log.paSuffix + pattern: (?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) + where: oneOf("log.paFormat", ["CEF", "LEEF-legacy"]) + - grok: + source: log.paCefExtensions + patterns: + - fieldName: log.paIgnored + pattern: ^(?:[A-Za-z][A-Za-z0-9_]*=(?:\\.|[^=\\])*?[ \t]+)*?act= + - fieldName: log.act + pattern: (?:\\.|[^=\\])*? + - fieldName: log.paSuffix + pattern: (?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) + where: oneOf("log.paFormat", ["CEF", "LEEF-legacy"]) + - grok: + source: log.paCefExtensions + patterns: + - fieldName: log.paIgnored + pattern: ^(?:[A-Za-z][A-Za-z0-9_]*=(?:\\.|[^=\\])*?[ \t]+)*?actionflagsPanOSTimeGeneratedHighResolution= + - fieldName: log.actionflagsPanOSTimeGeneratedHighResolution + pattern: (?:\\.|[^=\\])*? + - fieldName: log.paSuffix + pattern: (?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) + where: oneOf("log.paFormat", ["CEF", "LEEF-legacy"]) + - grok: + source: log.paCefExtensions + patterns: + - fieldName: log.paIgnored + pattern: ^(?:[A-Za-z][A-Za-z0-9_]*=(?:\\.|[^=\\])*?[ \t]+)*?actionflagsanOSTimeGeneratedHighResolution= + - fieldName: log.actionflagsanOSTimeGeneratedHighResolution + pattern: (?:\\.|[^=\\])*? + - fieldName: log.paSuffix + pattern: (?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) + where: oneOf("log.paFormat", ["CEF", "LEEF-legacy"]) + - grok: + source: log.paCefExtensions + patterns: + - fieldName: log.paIgnored + pattern: ^(?:[A-Za-z][A-Za-z0-9_]*=(?:\\.|[^=\\])*?[ \t]+)*?actionrequest= + - fieldName: log.actionrequest + pattern: (?:\\.|[^=\\])*? + - fieldName: log.paSuffix + pattern: (?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) + where: oneOf("log.paFormat", ["CEF", "LEEF-legacy"]) + - grok: + source: log.paCefExtensions + patterns: + - fieldName: log.paIgnored + pattern: ^(?:[A-Za-z][A-Za-z0-9_]*=(?:\\.|[^=\\])*?[ \t]+)*?admindestinationServiceName= + - fieldName: log.admindestinationServiceName + pattern: (?:\\.|[^=\\])*? + - fieldName: log.paSuffix + pattern: (?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) + where: oneOf("log.paFormat", ["CEF", "LEEF-legacy"]) + - grok: + source: log.paCefExtensions + patterns: + - fieldName: log.paIgnored + pattern: ^(?:[A-Za-z][A-Za-z0-9_]*=(?:\\.|[^=\\])*?[ \t]+)*?anOSTimeGeneratedHighResolution= + - fieldName: log.anOSTimeGeneratedHighResolution + pattern: (?:\\.|[^=\\])*? + - fieldName: log.paSuffix + pattern: (?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) + where: oneOf("log.paFormat", ["CEF", "LEEF-legacy"]) + - grok: + source: log.paCefExtensions + patterns: + - fieldName: log.paIgnored + pattern: ^(?:[A-Za-z][A-Za-z0-9_]*=(?:\\.|[^=\\])*?[ \t]+)*?app= + - fieldName: log.app + pattern: (?:\\.|[^=\\])*? + - fieldName: log.paSuffix + pattern: (?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) + where: oneOf("log.paFormat", ["CEF", "LEEF-legacy"]) + - grok: + source: log.paCefExtensions + patterns: + - fieldName: log.paIgnored + pattern: ^(?:[A-Za-z][A-Za-z0-9_]*=(?:\\.|[^=\\])*?[ \t]+)*?c6a2= + - fieldName: log.c6a2 + pattern: (?:\\.|[^=\\])*? + - fieldName: log.paSuffix + pattern: (?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) + where: oneOf("log.paFormat", ["CEF", "LEEF-legacy"]) + - grok: + source: log.paCefExtensions + patterns: + - fieldName: log.paIgnored + pattern: ^(?:[A-Za-z][A-Za-z0-9_]*=(?:\\.|[^=\\])*?[ \t]+)*?c6a2Label= + - fieldName: log.c6a2Label + pattern: (?:\\.|[^=\\])*? + - fieldName: log.paSuffix + pattern: (?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) + where: oneOf("log.paFormat", ["CEF", "LEEF-legacy"]) + - grok: + source: log.paCefExtensions + patterns: + - fieldName: log.paIgnored + pattern: ^(?:[A-Za-z][A-Za-z0-9_]*=(?:\\.|[^=\\])*?[ \t]+)*?cat= + - fieldName: log.cat + pattern: (?:\\.|[^=\\])*? + - fieldName: log.paSuffix + pattern: (?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) + where: oneOf("log.paFormat", ["CEF", "LEEF-legacy"]) + - grok: + source: log.paCefExtensions + patterns: + - fieldName: log.paIgnored + pattern: ^(?:[A-Za-z][A-Za-z0-9_]*=(?:\\.|[^=\\])*?[ \t]+)*?cert_sizePanOSCommonNameLength= + - fieldName: log.cert_sizePanOSCommonNameLength + pattern: (?:\\.|[^=\\])*? + - fieldName: log.paSuffix + pattern: (?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) + where: oneOf("log.paFormat", ["CEF", "LEEF-legacy"]) + - grok: + source: log.paCefExtensions + patterns: + - fieldName: log.paIgnored + pattern: ^(?:[A-Za-z][A-Za-z0-9_]*=(?:\\.|[^=\\])*?[ \t]+)*?cfp1= + - fieldName: log.cfp1 + pattern: (?:\\.|[^=\\])*? + - fieldName: log.paSuffix + pattern: (?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) + where: oneOf("log.paFormat", ["CEF", "LEEF-legacy"]) + - grok: + source: log.paCefExtensions + patterns: + - fieldName: log.paIgnored + pattern: ^(?:[A-Za-z][A-Za-z0-9_]*=(?:\\.|[^=\\])*?[ \t]+)*?cfp1Label= + - fieldName: log.cfp1Label + pattern: (?:\\.|[^=\\])*? + - fieldName: log.paSuffix + pattern: (?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) + where: oneOf("log.paFormat", ["CEF", "LEEF-legacy"]) + - grok: + source: log.paCefExtensions + patterns: + - fieldName: log.paIgnored + pattern: ^(?:[A-Za-z][A-Za-z0-9_]*=(?:\\.|[^=\\])*?[ \t]+)*?cfp2= + - fieldName: log.cfp2 + pattern: (?:\\.|[^=\\])*? + - fieldName: log.paSuffix + pattern: (?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) + where: oneOf("log.paFormat", ["CEF", "LEEF-legacy"]) + - grok: + source: log.paCefExtensions + patterns: + - fieldName: log.paIgnored + pattern: ^(?:[A-Za-z][A-Za-z0-9_]*=(?:\\.|[^=\\])*?[ \t]+)*?cfp2Label= + - fieldName: log.cfp2Label + pattern: (?:\\.|[^=\\])*? + - fieldName: log.paSuffix + pattern: (?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) + where: oneOf("log.paFormat", ["CEF", "LEEF-legacy"]) + - grok: + source: log.paCefExtensions + patterns: + - fieldName: log.paIgnored + pattern: ^(?:[A-Za-z][A-Za-z0-9_]*=(?:\\.|[^=\\])*?[ \t]+)*?cfp3= + - fieldName: log.cfp3 + pattern: (?:\\.|[^=\\])*? + - fieldName: log.paSuffix + pattern: (?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) + where: oneOf("log.paFormat", ["CEF", "LEEF-legacy"]) + - grok: + source: log.paCefExtensions + patterns: + - fieldName: log.paIgnored + pattern: ^(?:[A-Za-z][A-Za-z0-9_]*=(?:\\.|[^=\\])*?[ \t]+)*?cfp3Label= + - fieldName: log.cfp3Label + pattern: (?:\\.|[^=\\])*? + - fieldName: log.paSuffix + pattern: (?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) + where: oneOf("log.paFormat", ["CEF", "LEEF-legacy"]) + - grok: + source: log.paCefExtensions + patterns: + - fieldName: log.paIgnored + pattern: ^(?:[A-Za-z][A-Za-z0-9_]*=(?:\\.|[^=\\])*?[ \t]+)*?cfp4= + - fieldName: log.cfp4 + pattern: (?:\\.|[^=\\])*? + - fieldName: log.paSuffix + pattern: (?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) + where: oneOf("log.paFormat", ["CEF", "LEEF-legacy"]) + - grok: + source: log.paCefExtensions + patterns: + - fieldName: log.paIgnored + pattern: ^(?:[A-Za-z][A-Za-z0-9_]*=(?:\\.|[^=\\])*?[ \t]+)*?cfp4Label= + - fieldName: log.cfp4Label + pattern: (?:\\.|[^=\\])*? + - fieldName: log.paSuffix + pattern: (?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) + where: oneOf("log.paFormat", ["CEF", "LEEF-legacy"]) + - grok: + source: log.paCefExtensions + patterns: + - fieldName: log.paIgnored + pattern: ^(?:[A-Za-z][A-Za-z0-9_]*=(?:\\.|[^=\\])*?[ \t]+)*?client_osPanOSEndpointOSVersion= + - fieldName: log.client_osPanOSEndpointOSVersion + pattern: (?:\\.|[^=\\])*? + - fieldName: log.paSuffix + pattern: (?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) + where: oneOf("log.paFormat", ["CEF", "LEEF-legacy"]) + - grok: + source: log.paCefExtensions + patterns: + - fieldName: log.paIgnored + pattern: ^(?:[A-Za-z][A-Za-z0-9_]*=(?:\\.|[^=\\])*?[ \t]+)*?cn1= + - fieldName: log.cn1 + pattern: (?:\\.|[^=\\])*? + - fieldName: log.paSuffix + pattern: (?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) + where: oneOf("log.paFormat", ["CEF", "LEEF-legacy"]) + - grok: + source: log.paCefExtensions + patterns: + - fieldName: log.paIgnored + pattern: ^(?:[A-Za-z][A-Za-z0-9_]*=(?:\\.|[^=\\])*?[ \t]+)*?cn1Label= + - fieldName: log.cn1Label + pattern: (?:\\.|[^=\\])*? + - fieldName: log.paSuffix + pattern: (?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) + where: oneOf("log.paFormat", ["CEF", "LEEF-legacy"]) + - grok: + source: log.paCefExtensions + patterns: + - fieldName: log.paIgnored + pattern: ^(?:[A-Za-z][A-Za-z0-9_]*=(?:\\.|[^=\\])*?[ \t]+)*?cn2= + - fieldName: log.cn2 + pattern: (?:\\.|[^=\\])*? + - fieldName: log.paSuffix + pattern: (?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) + where: oneOf("log.paFormat", ["CEF", "LEEF-legacy"]) + - grok: + source: log.paCefExtensions + patterns: + - fieldName: log.paIgnored + pattern: ^(?:[A-Za-z][A-Za-z0-9_]*=(?:\\.|[^=\\])*?[ \t]+)*?cn2Label= + - fieldName: log.cn2Label + pattern: (?:\\.|[^=\\])*? + - fieldName: log.paSuffix + pattern: (?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) + where: oneOf("log.paFormat", ["CEF", "LEEF-legacy"]) + - grok: + source: log.paCefExtensions + patterns: + - fieldName: log.paIgnored + pattern: ^(?:[A-Za-z][A-Za-z0-9_]*=(?:\\.|[^=\\])*?[ \t]+)*?cn3= + - fieldName: log.cn3 + pattern: (?:\\.|[^=\\])*? + - fieldName: log.paSuffix + pattern: (?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) + where: oneOf("log.paFormat", ["CEF", "LEEF-legacy"]) + - grok: + source: log.paCefExtensions + patterns: + - fieldName: log.paIgnored + pattern: ^(?:[A-Za-z][A-Za-z0-9_]*=(?:\\.|[^=\\])*?[ \t]+)*?cn3Label= + - fieldName: log.cn3Label + pattern: (?:\\.|[^=\\])*? + - fieldName: log.paSuffix + pattern: (?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) + where: oneOf("log.paFormat", ["CEF", "LEEF-legacy"]) + - grok: + source: log.paCefExtensions + patterns: + - fieldName: log.paIgnored + pattern: ^(?:[A-Za-z][A-Za-z0-9_]*=(?:\\.|[^=\\])*?[ \t]+)*?cn4= + - fieldName: log.cn4 + pattern: (?:\\.|[^=\\])*? + - fieldName: log.paSuffix + pattern: (?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) + where: oneOf("log.paFormat", ["CEF", "LEEF-legacy"]) + - grok: + source: log.paCefExtensions + patterns: + - fieldName: log.paIgnored + pattern: ^(?:[A-Za-z][A-Za-z0-9_]*=(?:\\.|[^=\\])*?[ \t]+)*?cn4Label= + - fieldName: log.cn4Label + pattern: (?:\\.|[^=\\])*? + - fieldName: log.paSuffix + pattern: (?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) + where: oneOf("log.paFormat", ["CEF", "LEEF-legacy"]) + - grok: + source: log.paCefExtensions + patterns: + - fieldName: log.paIgnored + pattern: ^(?:[A-Za-z][A-Za-z0-9_]*=(?:\\.|[^=\\])*?[ \t]+)*?cn5= + - fieldName: log.cn5 + pattern: (?:\\.|[^=\\])*? + - fieldName: log.paSuffix + pattern: (?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) + where: oneOf("log.paFormat", ["CEF", "LEEF-legacy"]) + - grok: + source: log.paCefExtensions + patterns: + - fieldName: log.paIgnored + pattern: ^(?:[A-Za-z][A-Za-z0-9_]*=(?:\\.|[^=\\])*?[ \t]+)*?cn5Label= + - fieldName: log.cn5Label + pattern: (?:\\.|[^=\\])*? + - fieldName: log.paSuffix + pattern: (?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) + where: oneOf("log.paFormat", ["CEF", "LEEF-legacy"]) + - grok: + source: log.paCefExtensions + patterns: + - fieldName: log.paIgnored + pattern: ^(?:[A-Za-z][A-Za-z0-9_]*=(?:\\.|[^=\\])*?[ \t]+)*?cn6= + - fieldName: log.cn6 + pattern: (?:\\.|[^=\\])*? + - fieldName: log.paSuffix + pattern: (?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) + where: oneOf("log.paFormat", ["CEF", "LEEF-legacy"]) + - grok: + source: log.paCefExtensions + patterns: + - fieldName: log.paIgnored + pattern: ^(?:[A-Za-z][A-Za-z0-9_]*=(?:\\.|[^=\\])*?[ \t]+)*?cn6Label= + - fieldName: log.cn6Label + pattern: (?:\\.|[^=\\])*? + - fieldName: log.paSuffix + pattern: (?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) + where: oneOf("log.paFormat", ["CEF", "LEEF-legacy"]) + - grok: + source: log.paCefExtensions + patterns: + - fieldName: log.paIgnored + pattern: ^(?:[A-Za-z][A-Za-z0-9_]*=(?:\\.|[^=\\])*?[ \t]+)*?cnPanOSIssuerCommonName= + - fieldName: log.cnPanOSIssuerCommonName + pattern: (?:\\.|[^=\\])*? + - fieldName: log.paSuffix + pattern: (?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) + where: oneOf("log.paFormat", ["CEF", "LEEF-legacy"]) + - grok: + source: log.paCefExtensions + patterns: + - fieldName: log.paIgnored + pattern: ^(?:[A-Za-z][A-Za-z0-9_]*=(?:\\.|[^=\\])*?[ \t]+)*?cnt= + - fieldName: log.cnt + pattern: (?:\\.|[^=\\])*? + - fieldName: log.paSuffix + pattern: (?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) + where: oneOf("log.paFormat", ["CEF", "LEEF-legacy"]) + - grok: + source: log.paCefExtensions + patterns: + - fieldName: log.paIgnored + pattern: ^(?:[A-Za-z][A-Za-z0-9_]*=(?:\\.|[^=\\])*?[ \t]+)*?connect_methodPanOSConnectionErrorID= + - fieldName: log.connect_methodPanOSConnectionErrorID + pattern: (?:\\.|[^=\\])*? + - fieldName: log.paSuffix + pattern: (?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) + where: oneOf("log.paFormat", ["CEF", "LEEF-legacy"]) + - grok: + source: log.paCefExtensions + patterns: + - fieldName: log.paIgnored + pattern: ^(?:[A-Za-z][A-Za-z0-9_]*=(?:\\.|[^=\\])*?[ \t]+)*?cs1= + - fieldName: log.cs1 + pattern: (?:\\.|[^=\\])*? + - fieldName: log.paSuffix + pattern: (?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) + where: oneOf("log.paFormat", ["CEF", "LEEF-legacy"]) + - grok: + source: log.paCefExtensions + patterns: + - fieldName: log.paIgnored + pattern: ^(?:[A-Za-z][A-Za-z0-9_]*=(?:\\.|[^=\\])*?[ \t]+)*?cs1Label= + - fieldName: log.cs1Label + pattern: (?:\\.|[^=\\])*? + - fieldName: log.paSuffix + pattern: (?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) + where: oneOf("log.paFormat", ["CEF", "LEEF-legacy"]) + - grok: + source: log.paCefExtensions + patterns: + - fieldName: log.paIgnored + pattern: ^(?:[A-Za-z][A-Za-z0-9_]*=(?:\\.|[^=\\])*?[ \t]+)*?cs2= + - fieldName: log.cs2 + pattern: (?:\\.|[^=\\])*? + - fieldName: log.paSuffix + pattern: (?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) + where: oneOf("log.paFormat", ["CEF", "LEEF-legacy"]) + - grok: + source: log.paCefExtensions + patterns: + - fieldName: log.paIgnored + pattern: ^(?:[A-Za-z][A-Za-z0-9_]*=(?:\\.|[^=\\])*?[ \t]+)*?cs2Label= + - fieldName: log.cs2Label + pattern: (?:\\.|[^=\\])*? + - fieldName: log.paSuffix + pattern: (?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) + where: oneOf("log.paFormat", ["CEF", "LEEF-legacy"]) + - grok: + source: log.paCefExtensions + patterns: + - fieldName: log.paIgnored + pattern: ^(?:[A-Za-z][A-Za-z0-9_]*=(?:\\.|[^=\\])*?[ \t]+)*?cs3= + - fieldName: log.cs3 + pattern: (?:\\.|[^=\\])*? + - fieldName: log.paSuffix + pattern: (?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) + where: oneOf("log.paFormat", ["CEF", "LEEF-legacy"]) + - grok: + source: log.paCefExtensions + patterns: + - fieldName: log.paIgnored + pattern: ^(?:[A-Za-z][A-Za-z0-9_]*=(?:\\.|[^=\\])*?[ \t]+)*?cs3Label= + - fieldName: log.cs3Label + pattern: (?:\\.|[^=\\])*? + - fieldName: log.paSuffix + pattern: (?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) + where: oneOf("log.paFormat", ["CEF", "LEEF-legacy"]) + - grok: + source: log.paCefExtensions + patterns: + - fieldName: log.paIgnored + pattern: ^(?:[A-Za-z][A-Za-z0-9_]*=(?:\\.|[^=\\])*?[ \t]+)*?cs4= + - fieldName: log.cs4 + pattern: (?:\\.|[^=\\])*? + - fieldName: log.paSuffix + pattern: (?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) + where: oneOf("log.paFormat", ["CEF", "LEEF-legacy"]) + - grok: + source: log.paCefExtensions + patterns: + - fieldName: log.paIgnored + pattern: ^(?:[A-Za-z][A-Za-z0-9_]*=(?:\\.|[^=\\])*?[ \t]+)*?cs4Label= + - fieldName: log.cs4Label + pattern: (?:\\.|[^=\\])*? + - fieldName: log.paSuffix + pattern: (?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) + where: oneOf("log.paFormat", ["CEF", "LEEF-legacy"]) + - grok: + source: log.paCefExtensions + patterns: + - fieldName: log.paIgnored + pattern: ^(?:[A-Za-z][A-Za-z0-9_]*=(?:\\.|[^=\\])*?[ \t]+)*?cs5= + - fieldName: log.cs5 + pattern: (?:\\.|[^=\\])*? + - fieldName: log.paSuffix + pattern: (?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) + where: oneOf("log.paFormat", ["CEF", "LEEF-legacy"]) + - grok: + source: log.paCefExtensions + patterns: + - fieldName: log.paIgnored + pattern: ^(?:[A-Za-z][A-Za-z0-9_]*=(?:\\.|[^=\\])*?[ \t]+)*?cs5Label= + - fieldName: log.cs5Label + pattern: (?:\\.|[^=\\])*? + - fieldName: log.paSuffix + pattern: (?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) + where: oneOf("log.paFormat", ["CEF", "LEEF-legacy"]) + - grok: + source: log.paCefExtensions + patterns: + - fieldName: log.paIgnored + pattern: ^(?:[A-Za-z][A-Za-z0-9_]*=(?:\\.|[^=\\])*?[ \t]+)*?cs6= + - fieldName: log.cs6 + pattern: (?:\\.|[^=\\])*? + - fieldName: log.paSuffix + pattern: (?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) + where: oneOf("log.paFormat", ["CEF", "LEEF-legacy"]) + - grok: + source: log.paCefExtensions + patterns: + - fieldName: log.paIgnored + pattern: ^(?:[A-Za-z][A-Za-z0-9_]*=(?:\\.|[^=\\])*?[ \t]+)*?cs6Label= + - fieldName: log.cs6Label + pattern: (?:\\.|[^=\\])*? + - fieldName: log.paSuffix + pattern: (?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) + where: oneOf("log.paFormat", ["CEF", "LEEF-legacy"]) + - grok: + source: log.paCefExtensions + patterns: + - fieldName: log.paIgnored + pattern: ^(?:[A-Za-z][A-Za-z0-9_]*=(?:\\.|[^=\\])*?[ \t]+)*?datasourcenamePanOSDataSourceType= + - fieldName: log.datasourcenamePanOSDataSourceType + pattern: (?:\\.|[^=\\])*? + - fieldName: log.paSuffix + pattern: (?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) + where: oneOf("log.paFormat", ["CEF", "LEEF-legacy"]) + - grok: + source: log.paCefExtensions + patterns: + - fieldName: log.paIgnored + pattern: ^(?:[A-Za-z][A-Za-z0-9_]*=(?:\\.|[^=\\])*?[ \t]+)*?destinationServiceName= + - fieldName: log.destinationServiceName + pattern: (?:\\.|[^=\\])*? + - fieldName: log.paSuffix + pattern: (?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) + where: oneOf("log.paFormat", ["CEF", "LEEF-legacy"]) + - grok: + source: log.paCefExtensions + patterns: + - fieldName: log.paIgnored + pattern: ^(?:[A-Za-z][A-Za-z0-9_]*=(?:\\.|[^=\\])*?[ \t]+)*?destinationTranslatedAddress= + - fieldName: log.destinationTranslatedAddress + pattern: (?:\\.|[^=\\])*? + - fieldName: log.paSuffix + pattern: (?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) + where: oneOf("log.paFormat", ["CEF", "LEEF-legacy"]) + - grok: + source: log.paCefExtensions + patterns: + - fieldName: log.paIgnored + pattern: ^(?:[A-Za-z][A-Za-z0-9_]*=(?:\\.|[^=\\])*?[ \t]+)*?destinationTranslatedPort= + - fieldName: log.destinationTranslatedPort + pattern: (?:\\.|[^=\\])*? + - fieldName: log.paSuffix + pattern: (?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) + where: oneOf("log.paFormat", ["CEF", "LEEF-legacy"]) + - grok: + source: log.paCefExtensions + patterns: + - fieldName: log.paIgnored + pattern: ^(?:[A-Za-z][A-Za-z0-9_]*=(?:\\.|[^=\\])*?[ \t]+)*?detailPanOSFWDeviceGroup= + - fieldName: log.detailPanOSFWDeviceGroup + pattern: (?:\\.|[^=\\])*? + - fieldName: log.paSuffix + pattern: (?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) + where: oneOf("log.paFormat", ["CEF", "LEEF-legacy"]) + - grok: + source: log.paCefExtensions + patterns: + - fieldName: log.paIgnored + pattern: ^(?:[A-Za-z][A-Za-z0-9_]*=(?:\\.|[^=\\])*?[ \t]+)*?deviceExternalId= + - fieldName: log.deviceExternalId + pattern: (?:\\.|[^=\\])*? + - fieldName: log.paSuffix + pattern: (?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) + where: oneOf("log.paFormat", ["CEF", "LEEF-legacy"]) + - grok: + source: log.paCefExtensions + patterns: + - fieldName: log.paIgnored + pattern: ^(?:[A-Za-z][A-Za-z0-9_]*=(?:\\.|[^=\\])*?[ \t]+)*?deviceInboundInterface= + - fieldName: log.deviceInboundInterface + pattern: (?:\\.|[^=\\])*? + - fieldName: log.paSuffix + pattern: (?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) + where: oneOf("log.paFormat", ["CEF", "LEEF-legacy"]) + - grok: + source: log.paCefExtensions + patterns: + - fieldName: log.paIgnored + pattern: ^(?:[A-Za-z][A-Za-z0-9_]*=(?:\\.|[^=\\])*?[ \t]+)*?deviceOutboundInterface= + - fieldName: log.deviceOutboundInterface + pattern: (?:\\.|[^=\\])*? + - fieldName: log.paSuffix + pattern: (?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) + where: oneOf("log.paFormat", ["CEF", "LEEF-legacy"]) + - grok: + source: log.paCefExtensions + patterns: + - fieldName: log.paIgnored + pattern: ^(?:[A-Za-z][A-Za-z0-9_]*=(?:\\.|[^=\\])*?[ \t]+)*?device_namePanOSActionFlags= + - fieldName: log.device_namePanOSActionFlags + pattern: (?:\\.|[^=\\])*? + - fieldName: log.paSuffix + pattern: (?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) + where: oneOf("log.paFormat", ["CEF", "LEEF-legacy"]) + - grok: + source: log.paCefExtensions + patterns: + - fieldName: log.paIgnored + pattern: ^(?:[A-Za-z][A-Za-z0-9_]*=(?:\\.|[^=\\])*?[ \t]+)*?dg_hier_level_1PanOSDGl2= + - fieldName: log.dg_hier_level_1PanOSDGl2 + pattern: (?:\\.|[^=\\])*? + - fieldName: log.paSuffix + pattern: (?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) + where: oneOf("log.paFormat", ["CEF", "LEEF-legacy"]) + - grok: + source: log.paCefExtensions + patterns: + - fieldName: log.paIgnored + pattern: ^(?:[A-Za-z][A-Za-z0-9_]*=(?:\\.|[^=\\])*?[ \t]+)*?dg_hier_level_2PanOSDGl3= + - fieldName: log.dg_hier_level_2PanOSDGl3 + pattern: (?:\\.|[^=\\])*? + - fieldName: log.paSuffix + pattern: (?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) + where: oneOf("log.paFormat", ["CEF", "LEEF-legacy"]) + - grok: + source: log.paCefExtensions + patterns: + - fieldName: log.paIgnored + pattern: ^(?:[A-Za-z][A-Za-z0-9_]*=(?:\\.|[^=\\])*?[ \t]+)*?dg_hier_level_3PanOSDGl4= + - fieldName: log.dg_hier_level_3PanOSDGl4 + pattern: (?:\\.|[^=\\])*? + - fieldName: log.paSuffix + pattern: (?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) + where: oneOf("log.paFormat", ["CEF", "LEEF-legacy"]) + - grok: + source: log.paCefExtensions + patterns: + - fieldName: log.paIgnored + pattern: ^(?:[A-Za-z][A-Za-z0-9_]*=(?:\\.|[^=\\])*?[ \t]+)*?dg_hier_level_4PanOSVsysName= + - fieldName: log.dg_hier_level_4PanOSVsysName + pattern: (?:\\.|[^=\\])*? + - fieldName: log.paSuffix + pattern: (?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) + where: oneOf("log.paFormat", ["CEF", "LEEF-legacy"]) + - grok: + source: log.paCefExtensions + patterns: + - fieldName: log.paIgnored + pattern: ^(?:[A-Za-z][A-Za-z0-9_]*=(?:\\.|[^=\\])*?[ \t]+)*?directionPanOSActionFlags= + - fieldName: log.directionPanOSActionFlags + pattern: (?:\\.|[^=\\])*? + - fieldName: log.paSuffix + pattern: (?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) + where: oneOf("log.paFormat", ["CEF", "LEEF-legacy"]) + - grok: + source: log.paCefExtensions + patterns: + - fieldName: log.paIgnored + pattern: ^(?:[A-Za-z][A-Za-z0-9_]*=(?:\\.|[^=\\])*?[ \t]+)*?dpt= + - fieldName: log.dpt + pattern: (?:\\.|[^=\\])*? + - fieldName: log.paSuffix + pattern: (?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) + where: oneOf("log.paFormat", ["CEF", "LEEF-legacy"]) + - grok: + source: log.paCefExtensions + patterns: + - fieldName: log.paIgnored + pattern: ^(?:[A-Za-z][A-Za-z0-9_]*=(?:\\.|[^=\\])*?[ \t]+)*?dst= + - fieldName: log.dst + pattern: (?:\\.|[^=\\])*? + - fieldName: log.paSuffix + pattern: (?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) + where: oneOf("log.paFormat", ["CEF", "LEEF-legacy"]) + - grok: + source: log.paCefExtensions + patterns: + - fieldName: log.paIgnored + pattern: ^(?:[A-Za-z][A-Za-z0-9_]*=(?:\\.|[^=\\])*?[ \t]+)*?dst_categoryPanOSDestinationDeviceProfile= + - fieldName: log.dst_categoryPanOSDestinationDeviceProfile + pattern: (?:\\.|[^=\\])*? + - fieldName: log.paSuffix + pattern: (?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) + where: oneOf("log.paFormat", ["CEF", "LEEF-legacy"]) + - grok: + source: log.paCefExtensions + patterns: + - fieldName: log.paIgnored + pattern: ^(?:[A-Za-z][A-Za-z0-9_]*=(?:\\.|[^=\\])*?[ \t]+)*?dst_dagPanOSTimeGeneratedHighResolution= + - fieldName: log.dst_dagPanOSTimeGeneratedHighResolution + pattern: (?:\\.|[^=\\])*? + - fieldName: log.paSuffix + pattern: (?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) + where: oneOf("log.paFormat", ["CEF", "LEEF-legacy"]) + - grok: + source: log.paCefExtensions + patterns: + - fieldName: log.paIgnored + pattern: ^(?:[A-Za-z][A-Za-z0-9_]*=(?:\\.|[^=\\])*?[ \t]+)*?dst_edlPanOSSourceDynamicAddressGroup= + - fieldName: log.dst_edlPanOSSourceDynamicAddressGroup + pattern: (?:\\.|[^=\\])*? + - fieldName: log.paSuffix + pattern: (?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) + where: oneOf("log.paFormat", ["CEF", "LEEF-legacy"]) + - grok: + source: log.paCefExtensions + patterns: + - fieldName: log.paIgnored + pattern: ^(?:[A-Za-z][A-Za-z0-9_]*=(?:\\.|[^=\\])*?[ \t]+)*?dst_hostPanOSDestinationDeviceMac= + - fieldName: log.dst_hostPanOSDestinationDeviceMac + pattern: (?:\\.|[^=\\])*? + - fieldName: log.paSuffix + pattern: (?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) + where: oneOf("log.paFormat", ["CEF", "LEEF-legacy"]) + - grok: + source: log.paCefExtensions + patterns: + - fieldName: log.paIgnored + pattern: ^(?:[A-Za-z][A-Za-z0-9_]*=(?:\\.|[^=\\])*?[ \t]+)*?dst_macPanContainerName= + - fieldName: log.dst_macPanContainerName + pattern: (?:\\.|[^=\\])*? + - fieldName: log.paSuffix + pattern: (?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) + where: oneOf("log.paFormat", ["CEF", "LEEF-legacy"]) + - grok: + source: log.paCefExtensions + patterns: + - fieldName: log.paIgnored + pattern: ^(?:[A-Za-z][A-Za-z0-9_]*=(?:\\.|[^=\\])*?[ \t]+)*?dst_modelPanOSDestinationDeviceVendor= + - fieldName: log.dst_modelPanOSDestinationDeviceVendor + pattern: (?:\\.|[^=\\])*? + - fieldName: log.paSuffix + pattern: (?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) + where: oneOf("log.paFormat", ["CEF", "LEEF-legacy"]) + - grok: + source: log.paCefExtensions + patterns: + - fieldName: log.paIgnored + pattern: ^(?:[A-Za-z][A-Za-z0-9_]*=(?:\\.|[^=\\])*?[ \t]+)*?dst_osfamilyPanDstDeviceOSv= + - fieldName: log.dst_osfamilyPanDstDeviceOSv + pattern: (?:\\.|[^=\\])*? + - fieldName: log.paSuffix + pattern: (?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) + where: oneOf("log.paFormat", ["CEF", "LEEF-legacy"]) + - grok: + source: log.paCefExtensions + patterns: + - fieldName: log.paIgnored + pattern: ^(?:[A-Za-z][A-Za-z0-9_]*=(?:\\.|[^=\\])*?[ \t]+)*?dst_osfamilyPanOSDestinationDeviceOSVersion= + - fieldName: log.dst_osfamilyPanOSDestinationDeviceOSVersion + pattern: (?:\\.|[^=\\])*? + - fieldName: log.paSuffix + pattern: (?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) + where: oneOf("log.paFormat", ["CEF", "LEEF-legacy"]) + - grok: + source: log.paCefExtensions + patterns: + - fieldName: log.paIgnored + pattern: ^(?:[A-Za-z][A-Za-z0-9_]*=(?:\\.|[^=\\])*?[ \t]+)*?dst_profilePanDstDeviceModel= + - fieldName: log.dst_profilePanDstDeviceModel + pattern: (?:\\.|[^=\\])*? + - fieldName: log.paSuffix + pattern: (?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) + where: oneOf("log.paFormat", ["CEF", "LEEF-legacy"]) + - grok: + source: log.paCefExtensions + patterns: + - fieldName: log.paIgnored + pattern: ^(?:[A-Za-z][A-Za-z0-9_]*=(?:\\.|[^=\\])*?[ \t]+)*?dst_uuidPanOSTunnelID= + - fieldName: log.dst_uuidPanOSTunnelID + pattern: (?:\\.|[^=\\])*? + - fieldName: log.paSuffix + pattern: (?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) + where: oneOf("log.paFormat", ["CEF", "LEEF-legacy"]) + - grok: + source: log.paCefExtensions + patterns: + - fieldName: log.paIgnored + pattern: ^(?:[A-Za-z][A-Za-z0-9_]*=(?:\\.|[^=\\])*?[ \t]+)*?duid= + - fieldName: log.duid + pattern: (?:\\.|[^=\\])*? + - fieldName: log.paSuffix + pattern: (?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) + where: oneOf("log.paFormat", ["CEF", "LEEF-legacy"]) + - grok: + source: log.paCefExtensions + patterns: + - fieldName: log.paIgnored + pattern: ^(?:[A-Za-z][A-Za-z0-9_]*=(?:\\.|[^=\\])*?[ \t]+)*?duser= + - fieldName: log.duser + pattern: (?:\\.|[^=\\])*? + - fieldName: log.paSuffix + pattern: (?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) + where: oneOf("log.paFormat", ["CEF", "LEEF-legacy"]) + - grok: + source: log.paCefExtensions + patterns: + - fieldName: log.paIgnored + pattern: ^(?:[A-Za-z][A-Za-z0-9_]*=(?:\\.|[^=\\])*?[ \t]+)*?dvchost= + - fieldName: log.dvchost + pattern: (?:\\.|[^=\\])*? + - fieldName: log.paSuffix + pattern: (?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) + where: oneOf("log.paFormat", ["CEF", "LEEF-legacy"]) + - grok: + source: log.paCefExtensions + patterns: + - fieldName: log.paIgnored + pattern: ^(?:[A-Za-z][A-Za-z0-9_]*=(?:\\.|[^=\\])*?[ \t]+)*?end= + - fieldName: log.end + pattern: (?:\\.|[^=\\])*? + - fieldName: log.paSuffix + pattern: (?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) + where: oneOf("log.paFormat", ["CEF", "LEEF-legacy"]) + - grok: + source: log.paCefExtensions + patterns: + - fieldName: log.paIgnored + pattern: ^(?:[A-Za-z][A-Za-z0-9_]*=(?:\\.|[^=\\])*?[ \t]+)*?err_indexPanOSRootStatus= + - fieldName: log.err_indexPanOSRootStatus + pattern: (?:\\.|[^=\\])*? + - fieldName: log.paSuffix + pattern: (?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) + where: oneOf("log.paFormat", ["CEF", "LEEF-legacy"]) + - grok: + source: log.paCefExtensions + patterns: + - fieldName: log.paIgnored + pattern: ^(?:[A-Za-z][A-Za-z0-9_]*=(?:\\.|[^=\\])*?[ \t]+)*?externalId= + - fieldName: log.externalId + pattern: (?:\\.|[^=\\])*? + - fieldName: log.paSuffix + pattern: (?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) + where: oneOf("log.paFormat", ["CEF", "LEEF-legacy"]) + - grok: + source: log.paCefExtensions + patterns: + - fieldName: log.paIgnored + pattern: ^(?:[A-Za-z][A-Za-z0-9_]*=(?:\\.|[^=\\])*?[ \t]+)*?fileHash= + - fieldName: log.fileHash + pattern: (?:\\.|[^=\\])*? + - fieldName: log.paSuffix + pattern: (?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) + where: oneOf("log.paFormat", ["CEF", "LEEF-legacy"]) + - grok: + source: log.paCefExtensions + patterns: + - fieldName: log.paIgnored + pattern: ^(?:[A-Za-z][A-Za-z0-9_]*=(?:\\.|[^=\\])*?[ \t]+)*?fileId= + - fieldName: log.fileId + pattern: (?:\\.|[^=\\])*? + - fieldName: log.paSuffix + pattern: (?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) + where: oneOf("log.paFormat", ["CEF", "LEEF-legacy"]) + - grok: + source: log.paCefExtensions + patterns: + - fieldName: log.paIgnored + pattern: ^(?:[A-Za-z][A-Za-z0-9_]*=(?:\\.|[^=\\])*?[ \t]+)*?filePath= + - fieldName: log.filePath + pattern: (?:\\.|[^=\\])*? + - fieldName: log.paSuffix + pattern: (?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) + where: oneOf("log.paFormat", ["CEF", "LEEF-legacy"]) + - grok: + source: log.paCefExtensions + patterns: + - fieldName: log.paIgnored + pattern: ^(?:[A-Za-z][A-Za-z0-9_]*=(?:\\.|[^=\\])*?[ \t]+)*?fileType= + - fieldName: log.fileType + pattern: (?:\\.|[^=\\])*? + - fieldName: log.paSuffix + pattern: (?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) + where: oneOf("log.paFormat", ["CEF", "LEEF-legacy"]) + - grok: + source: log.paCefExtensions + patterns: + - fieldName: log.paIgnored + pattern: ^(?:[A-Za-z][A-Za-z0-9_]*=(?:\\.|[^=\\])*?[ \t]+)*?flags= + - fieldName: log.flags + pattern: (?:\\.|[^=\\])*? + - fieldName: log.paSuffix + pattern: (?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) + where: oneOf("log.paFormat", ["CEF", "LEEF-legacy"]) + - grok: + source: log.paCefExtensions + patterns: + - fieldName: log.paIgnored + pattern: ^(?:[A-Za-z][A-Za-z0-9_]*=(?:\\.|[^=\\])*?[ \t]+)*?flexNumber1= + - fieldName: log.flexNumber1 + pattern: (?:\\.|[^=\\])*? + - fieldName: log.paSuffix + pattern: (?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) + where: oneOf("log.paFormat", ["CEF", "LEEF-legacy"]) + - grok: + source: log.paCefExtensions + patterns: + - fieldName: log.paIgnored + pattern: ^(?:[A-Za-z][A-Za-z0-9_]*=(?:\\.|[^=\\])*?[ \t]+)*?flexNumber1Label= + - fieldName: log.flexNumber1Label + pattern: (?:\\.|[^=\\])*? + - fieldName: log.paSuffix + pattern: (?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) + where: oneOf("log.paFormat", ["CEF", "LEEF-legacy"]) + - grok: + source: log.paCefExtensions + patterns: + - fieldName: log.paIgnored + pattern: ^(?:[A-Za-z][A-Za-z0-9_]*=(?:\\.|[^=\\])*?[ \t]+)*?flexNumber2= + - fieldName: log.flexNumber2 + pattern: (?:\\.|[^=\\])*? + - fieldName: log.paSuffix + pattern: (?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) + where: oneOf("log.paFormat", ["CEF", "LEEF-legacy"]) + - grok: + source: log.paCefExtensions + patterns: + - fieldName: log.paIgnored + pattern: ^(?:[A-Za-z][A-Za-z0-9_]*=(?:\\.|[^=\\])*?[ \t]+)*?flexNumber2Label= + - fieldName: log.flexNumber2Label + pattern: (?:\\.|[^=\\])*? + - fieldName: log.paSuffix + pattern: (?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) + where: oneOf("log.paFormat", ["CEF", "LEEF-legacy"]) + - grok: + source: log.paCefExtensions + patterns: + - fieldName: log.paIgnored + pattern: ^(?:[A-Za-z][A-Za-z0-9_]*=(?:\\.|[^=\\])*?[ \t]+)*?flexString1= + - fieldName: log.flexString1 + pattern: (?:\\.|[^=\\])*? + - fieldName: log.paSuffix + pattern: (?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) + where: oneOf("log.paFormat", ["CEF", "LEEF-legacy"]) + - grok: + source: log.paCefExtensions + patterns: + - fieldName: log.paIgnored + pattern: ^(?:[A-Za-z][A-Za-z0-9_]*=(?:\\.|[^=\\])*?[ \t]+)*?flexString1Label= + - fieldName: log.flexString1Label + pattern: (?:\\.|[^=\\])*? + - fieldName: log.paSuffix + pattern: (?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) + where: oneOf("log.paFormat", ["CEF", "LEEF-legacy"]) + - grok: + source: log.paCefExtensions + patterns: + - fieldName: log.paIgnored + pattern: ^(?:[A-Za-z][A-Za-z0-9_]*=(?:\\.|[^=\\])*?[ \t]+)*?flexString2= + - fieldName: log.flexString2 + pattern: (?:\\.|[^=\\])*? + - fieldName: log.paSuffix + pattern: (?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) + where: oneOf("log.paFormat", ["CEF", "LEEF-legacy"]) + - grok: + source: log.paCefExtensions + patterns: + - fieldName: log.paIgnored + pattern: ^(?:[A-Za-z][A-Za-z0-9_]*=(?:\\.|[^=\\])*?[ \t]+)*?flexString2Label= + - fieldName: log.flexString2Label + pattern: (?:\\.|[^=\\])*? + - fieldName: log.paSuffix + pattern: (?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) + where: oneOf("log.paFormat", ["CEF", "LEEF-legacy"]) + - grok: + source: log.paCefExtensions + patterns: + - fieldName: log.paIgnored + pattern: ^(?:[A-Za-z][A-Za-z0-9_]*=(?:\\.|[^=\\])*?[ \t]+)*?fname= + - fieldName: log.fname + pattern: (?:\\.|[^=\\])*? + - fieldName: log.paSuffix + pattern: (?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) + where: oneOf("log.paFormat", ["CEF", "LEEF-legacy"]) + - grok: + source: log.paCefExtensions + patterns: + - fieldName: log.paIgnored + pattern: ^(?:[A-Za-z][A-Za-z0-9_]*=(?:\\.|[^=\\])*?[ \t]+)*?hostidPanOSDeviceSN= + - fieldName: log.hostidPanOSDeviceSN + pattern: (?:\\.|[^=\\])*? + - fieldName: log.paSuffix + pattern: (?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) + where: oneOf("log.paFormat", ["CEF", "LEEF-legacy"]) + - grok: + source: log.paCefExtensions + patterns: + - fieldName: log.paIgnored + pattern: ^(?:[A-Za-z][A-Za-z0-9_]*=(?:\\.|[^=\\])*?[ \t]+)*?hostidPanOSEndpointSerialNumber= + - fieldName: log.hostidPanOSEndpointSerialNumber + pattern: (?:\\.|[^=\\])*? + - fieldName: log.paSuffix + pattern: (?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) + where: oneOf("log.paFormat", ["CEF", "LEEF-legacy"]) + - grok: + source: log.paCefExtensions + patterns: + - fieldName: log.paIgnored + pattern: ^(?:[A-Za-z][A-Za-z0-9_]*=(?:\\.|[^=\\])*?[ \t]+)*?http2_connectionPanDynamicUsrgrp= + - fieldName: log.http2_connectionPanDynamicUsrgrp + pattern: (?:\\.|[^=\\])*? + - fieldName: log.paSuffix + pattern: (?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) + where: oneOf("log.paFormat", ["CEF", "LEEF-legacy"]) + - grok: + source: log.paCefExtensions + patterns: + - fieldName: log.paIgnored + pattern: ^(?:[A-Za-z][A-Za-z0-9_]*=(?:\\.|[^=\\])*?[ \t]+)*?http_headersPanOSRuleUUID= + - fieldName: log.http_headersPanOSRuleUUID + pattern: (?:\\.|[^=\\])*? + - fieldName: log.paSuffix + pattern: (?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) + where: oneOf("log.paFormat", ["CEF", "LEEF-legacy"]) + - grok: + source: log.paCefExtensions + patterns: + - fieldName: log.paIgnored + pattern: ^(?:[A-Za-z][A-Za-z0-9_]*=(?:\\.|[^=\\])*?[ \t]+)*?http_headersPanOSURLCatList= + - fieldName: log.http_headersPanOSURLCatList + pattern: (?:\\.|[^=\\])*? + - fieldName: log.paSuffix + pattern: (?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) + where: oneOf("log.paFormat", ["CEF", "LEEF-legacy"]) + - grok: + source: log.paCefExtensions + patterns: + - fieldName: log.paIgnored + pattern: ^(?:[A-Za-z][A-Za-z0-9_]*=(?:\\.|[^=\\])*?[ \t]+)*?in= + - fieldName: log.in + pattern: (?:\\.|[^=\\])*? + - fieldName: log.paSuffix + pattern: (?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) + where: oneOf("log.paFormat", ["CEF", "LEEF-legacy"]) + - grok: + source: log.paCefExtensions + patterns: + - fieldName: log.paIgnored + pattern: ^(?:[A-Za-z][A-Za-z0-9_]*=(?:\\.|[^=\\])*?[ \t]+)*?justificationPanASServiceType= + - fieldName: log.justificationPanASServiceType + pattern: (?:\\.|[^=\\])*? + - fieldName: log.paSuffix + pattern: (?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) + where: oneOf("log.paFormat", ["CEF", "LEEF-legacy"]) + - grok: + source: log.paCefExtensions + patterns: + - fieldName: log.paIgnored + pattern: ^(?:[A-Za-z][A-Za-z0-9_]*=(?:\\.|[^=\\])*?[ \t]+)*?macPanOSTimeGeneratedHighResolution= + - fieldName: log.macPanOSTimeGeneratedHighResolution + pattern: (?:\\.|[^=\\])*? + - fieldName: log.paSuffix + pattern: (?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) + where: oneOf("log.paFormat", ["CEF", "LEEF-legacy"]) + - grok: + source: log.paCefExtensions + patterns: + - fieldName: log.paIgnored + pattern: ^(?:[A-Za-z][A-Za-z0-9_]*=(?:\\.|[^=\\])*?[ \t]+)*?monitortagPanOSParentSessionID= + - fieldName: log.monitortagPanOSParentSessionID + pattern: (?:\\.|[^=\\])*? + - fieldName: log.paSuffix + pattern: (?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) + where: oneOf("log.paFormat", ["CEF", "LEEF-legacy"]) + - grok: + source: log.paCefExtensions + patterns: + - fieldName: log.paIgnored + pattern: ^(?:[A-Za-z][A-Za-z0-9_]*=(?:\\.|[^=\\])*?[ \t]+)*?msg= + - fieldName: log.msg + pattern: (?:\\.|[^=\\])*? + - fieldName: log.paSuffix + pattern: (?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) + where: oneOf("log.paFormat", ["CEF", "LEEF-legacy"]) + - grok: + source: log.paCefExtensions + patterns: + - fieldName: log.paIgnored + pattern: ^(?:[A-Za-z][A-Za-z0-9_]*=(?:\\.|[^=\\])*?[ \t]+)*?natsportdestinationTranslatedPort= + - fieldName: log.natsportdestinationTranslatedPort + pattern: (?:\\.|[^=\\])*? + - fieldName: log.paSuffix + pattern: (?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) + where: oneOf("log.paFormat", ["CEF", "LEEF-legacy"]) + - grok: + source: log.paCefExtensions + patterns: + - fieldName: log.paIgnored + pattern: ^(?:[A-Za-z][A-Za-z0-9_]*=(?:\\.|[^=\\])*?[ \t]+)*?natsrcdestinationTranslatedAddress= + - fieldName: log.natsrcdestinationTranslatedAddress + pattern: (?:\\.|[^=\\])*? + - fieldName: log.paSuffix + pattern: (?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) + where: oneOf("log.paFormat", ["CEF", "LEEF-legacy"]) + - grok: + source: log.paCefExtensions + patterns: + - fieldName: log.paIgnored + pattern: ^(?:[A-Za-z][A-Za-z0-9_]*=(?:\\.|[^=\\])*?[ \t]+)*?notbeforePanOSTimeNotAfter= + - fieldName: log.notbeforePanOSTimeNotAfter + pattern: (?:\\.|[^=\\])*? + - fieldName: log.paSuffix + pattern: (?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) + where: oneOf("log.paFormat", ["CEF", "LEEF-legacy"]) + - grok: + source: log.paCefExtensions + patterns: + - fieldName: log.paIgnored + pattern: ^(?:[A-Za-z][A-Za-z0-9_]*=(?:\\.|[^=\\])*?[ \t]+)*?oldFileId= + - fieldName: log.oldFileId + pattern: (?:\\.|[^=\\])*? + - fieldName: log.paSuffix + pattern: (?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) + where: oneOf("log.paFormat", ["CEF", "LEEF-legacy"]) + - grok: + source: log.paCefExtensions + patterns: + - fieldName: log.paIgnored + pattern: ^(?:[A-Za-z][A-Za-z0-9_]*=(?:\\.|[^=\\])*?[ \t]+)*?out= + - fieldName: log.out + pattern: (?:\\.|[^=\\])*? + - fieldName: log.paSuffix + pattern: (?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) + where: oneOf("log.paFormat", ["CEF", "LEEF-legacy"]) + - grok: + source: log.paCefExtensions + patterns: + - fieldName: log.paIgnored + pattern: ^(?:[A-Za-z][A-Za-z0-9_]*=(?:\\.|[^=\\])*?[ \t]+)*?panASServiceDiff= + - fieldName: log.panASServiceDiff + pattern: (?:\\.|[^=\\])*? + - fieldName: log.paSuffix + pattern: (?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) + where: oneOf("log.paFormat", ["CEF", "LEEF-legacy"]) + - grok: + source: log.paCefExtensions + patterns: + - fieldName: log.paIgnored + pattern: ^(?:[A-Za-z][A-Za-z0-9_]*=(?:\\.|[^=\\])*?[ \t]+)*?panASServiceType= + - fieldName: log.panASServiceType + pattern: (?:\\.|[^=\\])*? + - fieldName: log.paSuffix + pattern: (?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) + where: oneOf("log.paFormat", ["CEF", "LEEF-legacy"]) + - grok: + source: log.paCefExtensions + patterns: + - fieldName: log.paIgnored + pattern: ^(?:[A-Za-z][A-Za-z0-9_]*=(?:\\.|[^=\\])*?[ \t]+)*?panContainerName= + - fieldName: log.panContainerName + pattern: (?:\\.|[^=\\])*? + - fieldName: log.paSuffix + pattern: (?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) + where: oneOf("log.paFormat", ["CEF", "LEEF-legacy"]) + - grok: + source: log.paCefExtensions + patterns: + - fieldName: log.paIgnored + pattern: ^(?:[A-Za-z][A-Za-z0-9_]*=(?:\\.|[^=\\])*?[ \t]+)*?panDomainEDL= + - fieldName: log.panDomainEDL + pattern: (?:\\.|[^=\\])*? + - fieldName: log.paSuffix + pattern: (?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) + where: oneOf("log.paFormat", ["CEF", "LEEF-legacy"]) + - grok: + source: log.paCefExtensions + patterns: + - fieldName: log.paIgnored + pattern: ^(?:[A-Za-z][A-Za-z0-9_]*=(?:\\.|[^=\\])*?[ \t]+)*?panDstDAG= + - fieldName: log.panDstDAG + pattern: (?:\\.|[^=\\])*? + - fieldName: log.paSuffix + pattern: (?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) + where: oneOf("log.paFormat", ["CEF", "LEEF-legacy"]) + - grok: + source: log.paCefExtensions + patterns: + - fieldName: log.paIgnored + pattern: ^(?:[A-Za-z][A-Za-z0-9_]*=(?:\\.|[^=\\])*?[ \t]+)*?panDstDeviceCat= + - fieldName: log.panDstDeviceCat + pattern: (?:\\.|[^=\\])*? + - fieldName: log.paSuffix + pattern: (?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) + where: oneOf("log.paFormat", ["CEF", "LEEF-legacy"]) + - grok: + source: log.paCefExtensions + patterns: + - fieldName: log.paIgnored + pattern: ^(?:[A-Za-z][A-Za-z0-9_]*=(?:\\.|[^=\\])*?[ \t]+)*?panDstDeviceModel= + - fieldName: log.panDstDeviceModel + pattern: (?:\\.|[^=\\])*? + - fieldName: log.paSuffix + pattern: (?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) + where: oneOf("log.paFormat", ["CEF", "LEEF-legacy"]) + - grok: + source: log.paCefExtensions + patterns: + - fieldName: log.paIgnored + pattern: ^(?:[A-Za-z][A-Za-z0-9_]*=(?:\\.|[^=\\])*?[ \t]+)*?panDstDeviceOS= + - fieldName: log.panDstDeviceOS + pattern: (?:\\.|[^=\\])*? + - fieldName: log.paSuffix + pattern: (?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) + where: oneOf("log.paFormat", ["CEF", "LEEF-legacy"]) + - grok: + source: log.paCefExtensions + patterns: + - fieldName: log.paIgnored + pattern: ^(?:[A-Za-z][A-Za-z0-9_]*=(?:\\.|[^=\\])*?[ \t]+)*?panDstDeviceOSv= + - fieldName: log.panDstDeviceOSv + pattern: (?:\\.|[^=\\])*? + - fieldName: log.paSuffix + pattern: (?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) + where: oneOf("log.paFormat", ["CEF", "LEEF-legacy"]) + - grok: + source: log.paCefExtensions + patterns: + - fieldName: log.paIgnored + pattern: ^(?:[A-Za-z][A-Za-z0-9_]*=(?:\\.|[^=\\])*?[ \t]+)*?panDstDeviceProf= + - fieldName: log.panDstDeviceProf + pattern: (?:\\.|[^=\\])*? + - fieldName: log.paSuffix + pattern: (?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) + where: oneOf("log.paFormat", ["CEF", "LEEF-legacy"]) + - grok: + source: log.paCefExtensions + patterns: + - fieldName: log.paIgnored + pattern: ^(?:[A-Za-z][A-Za-z0-9_]*=(?:\\.|[^=\\])*?[ \t]+)*?panDstDeviceVendor= + - fieldName: log.panDstDeviceVendor + pattern: (?:\\.|[^=\\])*? + - fieldName: log.paSuffix + pattern: (?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) + where: oneOf("log.paFormat", ["CEF", "LEEF-legacy"]) + - grok: + source: log.paCefExtensions + patterns: + - fieldName: log.paIgnored + pattern: ^(?:[A-Za-z][A-Za-z0-9_]*=(?:\\.|[^=\\])*?[ \t]+)*?panDstEDL= + - fieldName: log.panDstEDL + pattern: (?:\\.|[^=\\])*? + - fieldName: log.paSuffix + pattern: (?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) + where: oneOf("log.paFormat", ["CEF", "LEEF-legacy"]) + - grok: + source: log.paCefExtensions + patterns: + - fieldName: log.paIgnored + pattern: ^(?:[A-Za-z][A-Za-z0-9_]*=(?:\\.|[^=\\])*?[ \t]+)*?panDstHostname= + - fieldName: log.panDstHostname + pattern: (?:\\.|[^=\\])*? + - fieldName: log.paSuffix + pattern: (?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) + where: oneOf("log.paFormat", ["CEF", "LEEF-legacy"]) + - grok: + source: log.paCefExtensions + patterns: + - fieldName: log.paIgnored + pattern: ^(?:[A-Za-z][A-Za-z0-9_]*=(?:\\.|[^=\\])*?[ \t]+)*?panDstMac= + - fieldName: log.panDstMac + pattern: (?:\\.|[^=\\])*? + - fieldName: log.paSuffix + pattern: (?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) + where: oneOf("log.paFormat", ["CEF", "LEEF-legacy"]) + - grok: + source: log.paCefExtensions + patterns: + - fieldName: log.paIgnored + pattern: ^(?:[A-Za-z][A-Za-z0-9_]*=(?:\\.|[^=\\])*?[ \t]+)*?panDynamicUsrgrp= + - fieldName: log.panDynamicUsrgrp + pattern: (?:\\.|[^=\\])*? + - fieldName: log.paSuffix + pattern: (?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) + where: oneOf("log.paFormat", ["CEF", "LEEF-legacy"]) + - grok: + source: log.paCefExtensions + patterns: + - fieldName: log.paIgnored + pattern: ^(?:[A-Za-z][A-Za-z0-9_]*=(?:\\.|[^=\\])*?[ \t]+)*?panEPSerial= + - fieldName: log.panEPSerial + pattern: (?:\\.|[^=\\])*? + - fieldName: log.paSuffix + pattern: (?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) + where: oneOf("log.paFormat", ["CEF", "LEEF-legacy"]) + - grok: + source: log.paCefExtensions + patterns: + - fieldName: log.paIgnored + pattern: ^(?:[A-Za-z][A-Za-z0-9_]*=(?:\\.|[^=\\])*?[ \t]+)*?panGPHostID= + - fieldName: log.panGPHostID + pattern: (?:\\.|[^=\\])*? + - fieldName: log.paSuffix + pattern: (?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) + where: oneOf("log.paFormat", ["CEF", "LEEF-legacy"]) + - grok: + source: log.paCefExtensions + patterns: + - fieldName: log.paIgnored + pattern: ^(?:[A-Za-z][A-Za-z0-9_]*=(?:\\.|[^=\\])*?[ \t]+)*?panHASessionOwner= + - fieldName: log.panHASessionOwner + pattern: (?:\\.|[^=\\])*? + - fieldName: log.paSuffix + pattern: (?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) + where: oneOf("log.paFormat", ["CEF", "LEEF-legacy"]) + - grok: + source: log.paCefExtensions + patterns: + - fieldName: log.paIgnored + pattern: ^(?:[A-Za-z][A-Za-z0-9_]*=(?:\\.|[^=\\])*?[ \t]+)*?panJustification= + - fieldName: log.panJustification + pattern: (?:\\.|[^=\\])*? + - fieldName: log.paSuffix + pattern: (?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) + where: oneOf("log.paFormat", ["CEF", "LEEF-legacy"]) + - grok: + source: log.paCefExtensions + patterns: + - fieldName: log.paIgnored + pattern: ^(?:[A-Za-z][A-Za-z0-9_]*=(?:\\.|[^=\\])*?[ \t]+)*?panLinkChange= + - fieldName: log.panLinkChange + pattern: (?:\\.|[^=\\])*? + - fieldName: log.paSuffix + pattern: (?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) + where: oneOf("log.paFormat", ["CEF", "LEEF-legacy"]) + - grok: + source: log.paCefExtensions + patterns: + - fieldName: log.paIgnored + pattern: ^(?:[A-Za-z][A-Za-z0-9_]*=(?:\\.|[^=\\])*?[ \t]+)*?panLinkDetail= + - fieldName: log.panLinkDetail + pattern: (?:\\.|[^=\\])*? + - fieldName: log.paSuffix + pattern: (?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) + where: oneOf("log.paFormat", ["CEF", "LEEF-legacy"]) + - grok: + source: log.paCefExtensions + patterns: + - fieldName: log.paIgnored + pattern: ^(?:[A-Za-z][A-Za-z0-9_]*=(?:\\.|[^=\\])*?[ \t]+)*?panOSAPName= + - fieldName: log.panOSAPName + pattern: (?:\\.|[^=\\])*? + - fieldName: log.paSuffix + pattern: (?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) + where: oneOf("log.paFormat", ["CEF", "LEEF-legacy"]) + - grok: + source: log.paCefExtensions + patterns: + - fieldName: log.paIgnored + pattern: ^(?:[A-Za-z][A-Za-z0-9_]*=(?:\\.|[^=\\])*?[ \t]+)*?panOSActionFlags= + - fieldName: log.panOSActionFlags + pattern: (?:\\.|[^=\\])*? + - fieldName: log.paSuffix + pattern: (?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) + where: oneOf("log.paFormat", ["CEF", "LEEF-legacy"]) + - grok: + source: log.paCefExtensions + patterns: + - fieldName: log.paIgnored + pattern: ^(?:[A-Za-z][A-Za-z0-9_]*=(?:\\.|[^=\\])*?[ \t]+)*?panOSAreaCode= + - fieldName: log.panOSAreaCode + pattern: (?:\\.|[^=\\])*? + - fieldName: log.paSuffix + pattern: (?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) + where: oneOf("log.paFormat", ["CEF", "LEEF-legacy"]) + - grok: + source: log.paCefExtensions + patterns: + - fieldName: log.paIgnored + pattern: ^(?:[A-Za-z][A-Za-z0-9_]*=(?:\\.|[^=\\])*?[ \t]+)*?panOSAssocID= + - fieldName: log.panOSAssocID + pattern: (?:\\.|[^=\\])*? + - fieldName: log.paSuffix + pattern: (?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) + where: oneOf("log.paFormat", ["CEF", "LEEF-legacy"]) + - grok: + source: log.paCefExtensions + patterns: + - fieldName: log.paIgnored + pattern: ^(?:[A-Za-z][A-Za-z0-9_]*=(?:\\.|[^=\\])*?[ \t]+)*?panOSAttemptedGateways= + - fieldName: log.panOSAttemptedGateways + pattern: (?:\\.|[^=\\])*? + - fieldName: log.paSuffix + pattern: (?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) + where: oneOf("log.paFormat", ["CEF", "LEEF-legacy"]) + - grok: + source: log.paCefExtensions + patterns: + - fieldName: log.paIgnored + pattern: ^(?:[A-Za-z][A-Za-z0-9_]*=(?:\\.|[^=\\])*?[ \t]+)*?panOSAuthMethod= + - fieldName: log.panOSAuthMethod + pattern: (?:\\.|[^=\\])*? + - fieldName: log.paSuffix + pattern: (?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) + where: oneOf("log.paFormat", ["CEF", "LEEF-legacy"]) + - grok: + source: log.paCefExtensions + patterns: + - fieldName: log.paIgnored + pattern: ^(?:[A-Za-z][A-Za-z0-9_]*=(?:\\.|[^=\\])*?[ \t]+)*?panOSCellID= + - fieldName: log.panOSCellID + pattern: (?:\\.|[^=\\])*? + - fieldName: log.paSuffix + pattern: (?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) + where: oneOf("log.paFormat", ["CEF", "LEEF-legacy"]) + - grok: + source: log.paCefExtensions + patterns: + - fieldName: log.paIgnored + pattern: ^(?:[A-Za-z][A-Za-z0-9_]*=(?:\\.|[^=\\])*?[ \t]+)*?panOSCertificateFlags= + - fieldName: log.panOSCertificateFlags + pattern: (?:\\.|[^=\\])*? + - fieldName: log.paSuffix + pattern: (?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) + where: oneOf("log.paFormat", ["CEF", "LEEF-legacy"]) + - grok: + source: log.paCefExtensions + patterns: + - fieldName: log.paIgnored + pattern: ^(?:[A-Za-z][A-Za-z0-9_]*=(?:\\.|[^=\\])*?[ \t]+)*?panOSCertificateSerial= + - fieldName: log.panOSCertificateSerial + pattern: (?:\\.|[^=\\])*? + - fieldName: log.paSuffix + pattern: (?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) + where: oneOf("log.paFormat", ["CEF", "LEEF-legacy"]) + - grok: + source: log.paCefExtensions + patterns: + - fieldName: log.paIgnored + pattern: ^(?:[A-Za-z][A-Za-z0-9_]*=(?:\\.|[^=\\])*?[ \t]+)*?panOSCertificateSize= + - fieldName: log.panOSCertificateSize + pattern: (?:\\.|[^=\\])*? + - fieldName: log.paSuffix + pattern: (?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) + where: oneOf("log.paFormat", ["CEF", "LEEF-legacy"]) + - grok: + source: log.paCefExtensions + patterns: + - fieldName: log.paIgnored + pattern: ^(?:[A-Za-z][A-Za-z0-9_]*=(?:\\.|[^=\\])*?[ \t]+)*?panOSCertificateVersion= + - fieldName: log.panOSCertificateVersion + pattern: (?:\\.|[^=\\])*? + - fieldName: log.paSuffix + pattern: (?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) + where: oneOf("log.paFormat", ["CEF", "LEEF-legacy"]) + - grok: + source: log.paCefExtensions + patterns: + - fieldName: log.paIgnored + pattern: ^(?:[A-Za-z][A-Za-z0-9_]*=(?:\\.|[^=\\])*?[ \t]+)*?panOSChainStatus= + - fieldName: log.panOSChainStatus + pattern: (?:\\.|[^=\\])*? + - fieldName: log.paSuffix + pattern: (?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) + where: oneOf("log.paFormat", ["CEF", "LEEF-legacy"]) + - grok: + source: log.paCefExtensions + patterns: + - fieldName: log.paIgnored + pattern: ^(?:[A-Za-z][A-Za-z0-9_]*=(?:\\.|[^=\\])*?[ \t]+)*?panOSChunkType= + - fieldName: log.panOSChunkType + pattern: (?:\\.|[^=\\])*? + - fieldName: log.paSuffix + pattern: (?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) + where: oneOf("log.paFormat", ["CEF", "LEEF-legacy"]) + - grok: + source: log.paCefExtensions + patterns: + - fieldName: log.paIgnored + pattern: ^(?:[A-Za-z][A-Za-z0-9_]*=(?:\\.|[^=\\])*?[ \t]+)*?panOSClientToFirewall= + - fieldName: log.panOSClientToFirewall + pattern: (?:\\.|[^=\\])*? + - fieldName: log.paSuffix + pattern: (?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) + where: oneOf("log.paFormat", ["CEF", "LEEF-legacy"]) + - grok: + source: log.paCefExtensions + patterns: + - fieldName: log.paIgnored + pattern: ^(?:[A-Za-z][A-Za-z0-9_]*=(?:\\.|[^=\\])*?[ \t]+)*?panOSCommonName= + - fieldName: log.panOSCommonName + pattern: (?:\\.|[^=\\])*? + - fieldName: log.paSuffix + pattern: (?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) + where: oneOf("log.paFormat", ["CEF", "LEEF-legacy"]) + - grok: + source: log.paCefExtensions + patterns: + - fieldName: log.paIgnored + pattern: ^(?:[A-Za-z][A-Za-z0-9_]*=(?:\\.|[^=\\])*?[ \t]+)*?panOSCommonNameLength= + - fieldName: log.panOSCommonNameLength + pattern: (?:\\.|[^=\\])*? + - fieldName: log.paSuffix + pattern: (?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) + where: oneOf("log.paFormat", ["CEF", "LEEF-legacy"]) + - grok: + source: log.paCefExtensions + patterns: + - fieldName: log.paIgnored + pattern: ^(?:[A-Za-z][A-Za-z0-9_]*=(?:\\.|[^=\\])*?[ \t]+)*?panOSConfigVersion= + - fieldName: log.panOSConfigVersion + pattern: (?:\\.|[^=\\])*? + - fieldName: log.paSuffix + pattern: (?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) + where: oneOf("log.paFormat", ["CEF", "LEEF-legacy"]) + - grok: + source: log.paCefExtensions + patterns: + - fieldName: log.paIgnored + pattern: ^(?:[A-Za-z][A-Za-z0-9_]*=(?:\\.|[^=\\])*?[ \t]+)*?panOSConnectionError= + - fieldName: log.panOSConnectionError + pattern: (?:\\.|[^=\\])*? + - fieldName: log.paSuffix + pattern: (?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) + where: oneOf("log.paFormat", ["CEF", "LEEF-legacy"]) + - grok: + source: log.paCefExtensions + patterns: + - fieldName: log.paIgnored + pattern: ^(?:[A-Za-z][A-Za-z0-9_]*=(?:\\.|[^=\\])*?[ \t]+)*?panOSConnectionErrorID= + - fieldName: log.panOSConnectionErrorID + pattern: (?:\\.|[^=\\])*? + - fieldName: log.paSuffix + pattern: (?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) + where: oneOf("log.paFormat", ["CEF", "LEEF-legacy"]) + - grok: + source: log.paCefExtensions + patterns: + - fieldName: log.paIgnored + pattern: ^(?:[A-Za-z][A-Za-z0-9_]*=(?:\\.|[^=\\])*?[ \t]+)*?panOSConnectionMethod= + - fieldName: log.panOSConnectionMethod + pattern: (?:\\.|[^=\\])*? + - fieldName: log.paSuffix + pattern: (?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) + where: oneOf("log.paFormat", ["CEF", "LEEF-legacy"]) + - grok: + source: log.paCefExtensions + patterns: + - fieldName: log.paIgnored + pattern: ^(?:[A-Za-z][A-Za-z0-9_]*=(?:\\.|[^=\\])*?[ \t]+)*?panOSContainerID= + - fieldName: log.panOSContainerID + pattern: (?:\\.|[^=\\])*? + - fieldName: log.paSuffix + pattern: (?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) + where: oneOf("log.paFormat", ["CEF", "LEEF-legacy"]) + - grok: + source: log.paCefExtensions + patterns: + - fieldName: log.paIgnored + pattern: ^(?:[A-Za-z][A-Za-z0-9_]*=(?:\\.|[^=\\])*?[ \t]+)*?panOSContainerName= + - fieldName: log.panOSContainerName + pattern: (?:\\.|[^=\\])*? + - fieldName: log.paSuffix + pattern: (?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) + where: oneOf("log.paFormat", ["CEF", "LEEF-legacy"]) + - grok: + source: log.paCefExtensions + patterns: + - fieldName: log.paIgnored + pattern: ^(?:[A-Za-z][A-Za-z0-9_]*=(?:\\.|[^=\\])*?[ \t]+)*?panOSContainerNameSpace= + - fieldName: log.panOSContainerNameSpace + pattern: (?:\\.|[^=\\])*? + - fieldName: log.paSuffix + pattern: (?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) + where: oneOf("log.paFormat", ["CEF", "LEEF-legacy"]) + - grok: + source: log.paCefExtensions + patterns: + - fieldName: log.paIgnored + pattern: ^(?:[A-Za-z][A-Za-z0-9_]*=(?:\\.|[^=\\])*?[ \t]+)*?panOSContentVer= + - fieldName: log.panOSContentVer + pattern: (?:\\.|[^=\\])*? + - fieldName: log.paSuffix + pattern: (?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) + where: oneOf("log.paFormat", ["CEF", "LEEF-legacy"]) + - grok: + source: log.paCefExtensions + patterns: + - fieldName: log.paIgnored + pattern: ^(?:[A-Za-z][A-Za-z0-9_]*=(?:\\.|[^=\\])*?[ \t]+)*?panOSCountOfRepeats= + - fieldName: log.panOSCountOfRepeats + pattern: (?:\\.|[^=\\])*? + - fieldName: log.paSuffix + pattern: (?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) + where: oneOf("log.paFormat", ["CEF", "LEEF-legacy"]) + - grok: + source: log.paCefExtensions + patterns: + - fieldName: log.paIgnored + pattern: ^(?:[A-Za-z][A-Za-z0-9_]*=(?:\\.|[^=\\])*?[ \t]+)*?panOSDGl1= + - fieldName: log.panOSDGl1 + pattern: (?:\\.|[^=\\])*? + - fieldName: log.paSuffix + pattern: (?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) + where: oneOf("log.paFormat", ["CEF", "LEEF-legacy"]) + - grok: + source: log.paCefExtensions + patterns: + - fieldName: log.paIgnored + pattern: ^(?:[A-Za-z][A-Za-z0-9_]*=(?:\\.|[^=\\])*?[ \t]+)*?panOSDGl2= + - fieldName: log.panOSDGl2 + pattern: (?:\\.|[^=\\])*? + - fieldName: log.paSuffix + pattern: (?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) + where: oneOf("log.paFormat", ["CEF", "LEEF-legacy"]) + - grok: + source: log.paCefExtensions + patterns: + - fieldName: log.paIgnored + pattern: ^(?:[A-Za-z][A-Za-z0-9_]*=(?:\\.|[^=\\])*?[ \t]+)*?panOSDGl3= + - fieldName: log.panOSDGl3 + pattern: (?:\\.|[^=\\])*? + - fieldName: log.paSuffix + pattern: (?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) + where: oneOf("log.paFormat", ["CEF", "LEEF-legacy"]) + - grok: + source: log.paCefExtensions + patterns: + - fieldName: log.paIgnored + pattern: ^(?:[A-Za-z][A-Za-z0-9_]*=(?:\\.|[^=\\])*?[ \t]+)*?panOSDGl4= + - fieldName: log.panOSDGl4 + pattern: (?:\\.|[^=\\])*? + - fieldName: log.paSuffix + pattern: (?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) + where: oneOf("log.paFormat", ["CEF", "LEEF-legacy"]) + - grok: + source: log.paCefExtensions + patterns: + - fieldName: log.paIgnored + pattern: ^(?:[A-Za-z][A-Za-z0-9_]*=(?:\\.|[^=\\])*?[ \t]+)*?panOSDataSourceName= + - fieldName: log.panOSDataSourceName + pattern: (?:\\.|[^=\\])*? + - fieldName: log.paSuffix + pattern: (?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) + where: oneOf("log.paFormat", ["CEF", "LEEF-legacy"]) + - grok: + source: log.paCefExtensions + patterns: + - fieldName: log.paIgnored + pattern: ^(?:[A-Za-z][A-Za-z0-9_]*=(?:\\.|[^=\\])*?[ \t]+)*?panOSDataSourceSubType= + - fieldName: log.panOSDataSourceSubType + pattern: (?:\\.|[^=\\])*? + - fieldName: log.paSuffix + pattern: (?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) + where: oneOf("log.paFormat", ["CEF", "LEEF-legacy"]) + - grok: + source: log.paCefExtensions + patterns: + - fieldName: log.paIgnored + pattern: ^(?:[A-Za-z][A-Za-z0-9_]*=(?:\\.|[^=\\])*?[ \t]+)*?panOSDataSourceType= + - fieldName: log.panOSDataSourceType + pattern: (?:\\.|[^=\\])*? + - fieldName: log.paSuffix + pattern: (?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) + where: oneOf("log.paFormat", ["CEF", "LEEF-legacy"]) + - grok: + source: log.paCefExtensions + patterns: + - fieldName: log.paIgnored + pattern: ^(?:[A-Za-z][A-Za-z0-9_]*=(?:\\.|[^=\\])*?[ \t]+)*?panOSDesc= + - fieldName: log.panOSDesc + pattern: (?:\\.|[^=\\])*? + - fieldName: log.paSuffix + pattern: (?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) + where: oneOf("log.paFormat", ["CEF", "LEEF-legacy"]) + - grok: + source: log.paCefExtensions + patterns: + - fieldName: log.paIgnored + pattern: ^(?:[A-Za-z][A-Za-z0-9_]*=(?:\\.|[^=\\])*?[ \t]+)*?panOSDescription= + - fieldName: log.panOSDescription + pattern: (?:\\.|[^=\\])*? + - fieldName: log.paSuffix + pattern: (?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) + where: oneOf("log.paFormat", ["CEF", "LEEF-legacy"]) + - grok: + source: log.paCefExtensions + patterns: + - fieldName: log.paIgnored + pattern: ^(?:[A-Za-z][A-Za-z0-9_]*=(?:\\.|[^=\\])*?[ \t]+)*?panOSDestinationDeviceCategory= + - fieldName: log.panOSDestinationDeviceCategory + pattern: (?:\\.|[^=\\])*? + - fieldName: log.paSuffix + pattern: (?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) + where: oneOf("log.paFormat", ["CEF", "LEEF-legacy"]) + - grok: + source: log.paCefExtensions + patterns: + - fieldName: log.paIgnored + pattern: ^(?:[A-Za-z][A-Za-z0-9_]*=(?:\\.|[^=\\])*?[ \t]+)*?panOSDestinationDeviceHost= + - fieldName: log.panOSDestinationDeviceHost + pattern: (?:\\.|[^=\\])*? + - fieldName: log.paSuffix + pattern: (?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) + where: oneOf("log.paFormat", ["CEF", "LEEF-legacy"]) + - grok: + source: log.paCefExtensions + patterns: + - fieldName: log.paIgnored + pattern: ^(?:[A-Za-z][A-Za-z0-9_]*=(?:\\.|[^=\\])*?[ \t]+)*?panOSDestinationDeviceMac= + - fieldName: log.panOSDestinationDeviceMac + pattern: (?:\\.|[^=\\])*? + - fieldName: log.paSuffix + pattern: (?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) + where: oneOf("log.paFormat", ["CEF", "LEEF-legacy"]) + - grok: + source: log.paCefExtensions + patterns: + - fieldName: log.paIgnored + pattern: ^(?:[A-Za-z][A-Za-z0-9_]*=(?:\\.|[^=\\])*?[ \t]+)*?panOSDestinationDeviceModel= + - fieldName: log.panOSDestinationDeviceModel + pattern: (?:\\.|[^=\\])*? + - fieldName: log.paSuffix + pattern: (?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) + where: oneOf("log.paFormat", ["CEF", "LEEF-legacy"]) + - grok: + source: log.paCefExtensions + patterns: + - fieldName: log.paIgnored + pattern: ^(?:[A-Za-z][A-Za-z0-9_]*=(?:\\.|[^=\\])*?[ \t]+)*?panOSDestinationDeviceOSFamily= + - fieldName: log.panOSDestinationDeviceOSFamily + pattern: (?:\\.|[^=\\])*? + - fieldName: log.paSuffix + pattern: (?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) + where: oneOf("log.paFormat", ["CEF", "LEEF-legacy"]) + - grok: + source: log.paCefExtensions + patterns: + - fieldName: log.paIgnored + pattern: ^(?:[A-Za-z][A-Za-z0-9_]*=(?:\\.|[^=\\])*?[ \t]+)*?panOSDestinationDeviceOSVersion= + - fieldName: log.panOSDestinationDeviceOSVersion + pattern: (?:\\.|[^=\\])*? + - fieldName: log.paSuffix + pattern: (?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) + where: oneOf("log.paFormat", ["CEF", "LEEF-legacy"]) + - grok: + source: log.paCefExtensions + patterns: + - fieldName: log.paIgnored + pattern: ^(?:[A-Za-z][A-Za-z0-9_]*=(?:\\.|[^=\\])*?[ \t]+)*?panOSDestinationDeviceProfile= + - fieldName: log.panOSDestinationDeviceProfile + pattern: (?:\\.|[^=\\])*? + - fieldName: log.paSuffix + pattern: (?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) + where: oneOf("log.paFormat", ["CEF", "LEEF-legacy"]) + - grok: + source: log.paCefExtensions + patterns: + - fieldName: log.paIgnored + pattern: ^(?:[A-Za-z][A-Za-z0-9_]*=(?:\\.|[^=\\])*?[ \t]+)*?panOSDestinationDeviceVendor= + - fieldName: log.panOSDestinationDeviceVendor + pattern: (?:\\.|[^=\\])*? + - fieldName: log.paSuffix + pattern: (?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) + where: oneOf("log.paFormat", ["CEF", "LEEF-legacy"]) + - grok: + source: log.paCefExtensions + patterns: + - fieldName: log.paIgnored + pattern: ^(?:[A-Za-z][A-Za-z0-9_]*=(?:\\.|[^=\\])*?[ \t]+)*?panOSDestinationDynamicAddressGroup= + - fieldName: log.panOSDestinationDynamicAddressGroup + pattern: (?:\\.|[^=\\])*? + - fieldName: log.paSuffix + pattern: (?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) + where: oneOf("log.paFormat", ["CEF", "LEEF-legacy"]) + - grok: + source: log.paCefExtensions + patterns: + - fieldName: log.paIgnored + pattern: ^(?:[A-Za-z][A-Za-z0-9_]*=(?:\\.|[^=\\])*?[ \t]+)*?panOSDestinationEDL= + - fieldName: log.panOSDestinationEDL + pattern: (?:\\.|[^=\\])*? + - fieldName: log.paSuffix + pattern: (?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) + where: oneOf("log.paFormat", ["CEF", "LEEF-legacy"]) + - grok: + source: log.paCefExtensions + patterns: + - fieldName: log.paIgnored + pattern: ^(?:[A-Za-z][A-Za-z0-9_]*=(?:\\.|[^=\\])*?[ \t]+)*?panOSDestinationUUID= + - fieldName: log.panOSDestinationUUID + pattern: (?:\\.|[^=\\])*? + - fieldName: log.paSuffix + pattern: (?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) + where: oneOf("log.paFormat", ["CEF", "LEEF-legacy"]) + - grok: + source: log.paCefExtensions + patterns: + - fieldName: log.paIgnored + pattern: ^(?:[A-Za-z][A-Za-z0-9_]*=(?:\\.|[^=\\])*?[ \t]+)*?panOSDeviceSN= + - fieldName: log.panOSDeviceSN + pattern: (?:\\.|[^=\\])*? + - fieldName: log.paSuffix + pattern: (?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) + where: oneOf("log.paFormat", ["CEF", "LEEF-legacy"]) + - grok: + source: log.paCefExtensions + patterns: + - fieldName: log.paIgnored + pattern: ^(?:[A-Za-z][A-Za-z0-9_]*=(?:\\.|[^=\\])*?[ \t]+)*?panOSDiameterAVPCode= + - fieldName: log.panOSDiameterAVPCode + pattern: (?:\\.|[^=\\])*? + - fieldName: log.paSuffix + pattern: (?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) + where: oneOf("log.paFormat", ["CEF", "LEEF-legacy"]) + - grok: + source: log.paCefExtensions + patterns: + - fieldName: log.paIgnored + pattern: ^(?:[A-Za-z][A-Za-z0-9_]*=(?:\\.|[^=\\])*?[ \t]+)*?panOSDiameterApp= + - fieldName: log.panOSDiameterApp + pattern: (?:\\.|[^=\\])*? + - fieldName: log.paSuffix + pattern: (?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) + where: oneOf("log.paFormat", ["CEF", "LEEF-legacy"]) + - grok: + source: log.paCefExtensions + patterns: + - fieldName: log.paIgnored + pattern: ^(?:[A-Za-z][A-Za-z0-9_]*=(?:\\.|[^=\\])*?[ \t]+)*?panOSDiameterCmdCode= + - fieldName: log.panOSDiameterCmdCode + pattern: (?:\\.|[^=\\])*? + - fieldName: log.paSuffix + pattern: (?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) + where: oneOf("log.paFormat", ["CEF", "LEEF-legacy"]) + - grok: + source: log.paCefExtensions + patterns: + - fieldName: log.paIgnored + pattern: ^(?:[A-Za-z][A-Za-z0-9_]*=(?:\\.|[^=\\])*?[ \t]+)*?panOSDstUUID= + - fieldName: log.panOSDstUUID + pattern: (?:\\.|[^=\\])*? + - fieldName: log.paSuffix + pattern: (?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) + where: oneOf("log.paFormat", ["CEF", "LEEF-legacy"]) + - grok: + source: log.paCefExtensions + patterns: + - fieldName: log.paIgnored + pattern: ^(?:[A-Za-z][A-Za-z0-9_]*=(?:\\.|[^=\\])*?[ \t]+)*?panOSEllipticCurve= + - fieldName: log.panOSEllipticCurve + pattern: (?:\\.|[^=\\])*? + - fieldName: log.paSuffix + pattern: (?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) + where: oneOf("log.paFormat", ["CEF", "LEEF-legacy"]) + - grok: + source: log.paCefExtensions + patterns: + - fieldName: log.paIgnored + pattern: ^(?:[A-Za-z][A-Za-z0-9_]*=(?:\\.|[^=\\])*?[ \t]+)*?panOSEndUserIP= + - fieldName: log.panOSEndUserIP + pattern: (?:\\.|[^=\\])*? + - fieldName: log.paSuffix + pattern: (?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) + where: oneOf("log.paFormat", ["CEF", "LEEF-legacy"]) + - grok: + source: log.paCefExtensions + patterns: + - fieldName: log.paIgnored + pattern: ^(?:[A-Za-z][A-Za-z0-9_]*=(?:\\.|[^=\\])*?[ \t]+)*?panOSEndpointDeviceName= + - fieldName: log.panOSEndpointDeviceName + pattern: (?:\\.|[^=\\])*? + - fieldName: log.paSuffix + pattern: (?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) + where: oneOf("log.paFormat", ["CEF", "LEEF-legacy"]) + - grok: + source: log.paCefExtensions + patterns: + - fieldName: log.paIgnored + pattern: ^(?:[A-Za-z][A-Za-z0-9_]*=(?:\\.|[^=\\])*?[ \t]+)*?panOSEndpointMac= + - fieldName: log.panOSEndpointMac + pattern: (?:\\.|[^=\\])*? + - fieldName: log.paSuffix + pattern: (?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) + where: oneOf("log.paFormat", ["CEF", "LEEF-legacy"]) + - grok: + source: log.paCefExtensions + patterns: + - fieldName: log.paIgnored + pattern: ^(?:[A-Za-z][A-Za-z0-9_]*=(?:\\.|[^=\\])*?[ \t]+)*?panOSEndpointOSType= + - fieldName: log.panOSEndpointOSType + pattern: (?:\\.|[^=\\])*? + - fieldName: log.paSuffix + pattern: (?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) + where: oneOf("log.paFormat", ["CEF", "LEEF-legacy"]) + - grok: + source: log.paCefExtensions + patterns: + - fieldName: log.paIgnored + pattern: ^(?:[A-Za-z][A-Za-z0-9_]*=(?:\\.|[^=\\])*?[ \t]+)*?panOSEndpointOSVersion= + - fieldName: log.panOSEndpointOSVersion + pattern: (?:\\.|[^=\\])*? + - fieldName: log.paSuffix + pattern: (?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) + where: oneOf("log.paFormat", ["CEF", "LEEF-legacy"]) + - grok: + source: log.paCefExtensions + patterns: + - fieldName: log.paIgnored + pattern: ^(?:[A-Za-z][A-Za-z0-9_]*=(?:\\.|[^=\\])*?[ \t]+)*?panOSEndpointSerialNumber= + - fieldName: log.panOSEndpointSerialNumber + pattern: (?:\\.|[^=\\])*? + - fieldName: log.paSuffix + pattern: (?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) + where: oneOf("log.paFormat", ["CEF", "LEEF-legacy"]) + - grok: + source: log.paCefExtensions + patterns: + - fieldName: log.paIgnored + pattern: ^(?:[A-Za-z][A-Za-z0-9_]*=(?:\\.|[^=\\])*?[ \t]+)*?panOSErrorIndex= + - fieldName: log.panOSErrorIndex + pattern: (?:\\.|[^=\\])*? + - fieldName: log.paSuffix + pattern: (?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) + where: oneOf("log.paFormat", ["CEF", "LEEF-legacy"]) + - grok: + source: log.paCefExtensions + patterns: + - fieldName: log.paIgnored + pattern: ^(?:[A-Za-z][A-Za-z0-9_]*=(?:\\.|[^=\\])*?[ \t]+)*?panOSErrorMessage= + - fieldName: log.panOSErrorMessage + pattern: (?:\\.|[^=\\])*? + - fieldName: log.paSuffix + pattern: (?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) + where: oneOf("log.paFormat", ["CEF", "LEEF-legacy"]) + - grok: + source: log.paCefExtensions + patterns: + - fieldName: log.paIgnored + pattern: ^(?:[A-Za-z][A-Za-z0-9_]*=(?:\\.|[^=\\])*?[ \t]+)*?panOSEventID= + - fieldName: log.panOSEventID + pattern: (?:\\.|[^=\\])*? + - fieldName: log.paSuffix + pattern: (?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) + where: oneOf("log.paFormat", ["CEF", "LEEF-legacy"]) + - grok: + source: log.paCefExtensions + patterns: + - fieldName: log.paIgnored + pattern: ^(?:[A-Za-z][A-Za-z0-9_]*=(?:\\.|[^=\\])*?[ \t]+)*?panOSEventStatus= + - fieldName: log.panOSEventStatus + pattern: (?:\\.|[^=\\])*? + - fieldName: log.paSuffix + pattern: (?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) + where: oneOf("log.paFormat", ["CEF", "LEEF-legacy"]) + - grok: + source: log.paCefExtensions + patterns: + - fieldName: log.paIgnored + pattern: ^(?:[A-Za-z][A-Za-z0-9_]*=(?:\\.|[^=\\])*?[ \t]+)*?panOSFWDeviceGroup= + - fieldName: log.panOSFWDeviceGroup + pattern: (?:\\.|[^=\\])*? + - fieldName: log.paSuffix + pattern: (?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) + where: oneOf("log.paFormat", ["CEF", "LEEF-legacy"]) + - grok: + source: log.paCefExtensions + patterns: + - fieldName: log.paIgnored + pattern: ^(?:[A-Za-z][A-Za-z0-9_]*=(?:\\.|[^=\\])*?[ \t]+)*?panOSFingerprint= + - fieldName: log.panOSFingerprint + pattern: (?:\\.|[^=\\])*? + - fieldName: log.paSuffix + pattern: (?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) + where: oneOf("log.paFormat", ["CEF", "LEEF-legacy"]) + - grok: + source: log.paCefExtensions + patterns: + - fieldName: log.paIgnored + pattern: ^(?:[A-Za-z][A-Za-z0-9_]*=(?:\\.|[^=\\])*?[ \t]+)*?panOSFirewallToServer= + - fieldName: log.panOSFirewallToServer + pattern: (?:\\.|[^=\\])*? + - fieldName: log.paSuffix + pattern: (?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) + where: oneOf("log.paFormat", ["CEF", "LEEF-legacy"]) + - grok: + source: log.paCefExtensions + patterns: + - fieldName: log.paIgnored + pattern: ^(?:[A-Za-z][A-Za-z0-9_]*=(?:\\.|[^=\\])*?[ \t]+)*?panOSGPGatewayLocation= + - fieldName: log.panOSGPGatewayLocation + pattern: (?:\\.|[^=\\])*? + - fieldName: log.paSuffix + pattern: (?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) + where: oneOf("log.paFormat", ["CEF", "LEEF-legacy"]) + - grok: + source: log.paCefExtensions + patterns: + - fieldName: log.paIgnored + pattern: ^(?:[A-Za-z][A-Za-z0-9_]*=(?:\\.|[^=\\])*?[ \t]+)*?panOSGTPCause= + - fieldName: log.panOSGTPCause + pattern: (?:\\.|[^=\\])*? + - fieldName: log.paSuffix + pattern: (?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) + where: oneOf("log.paFormat", ["CEF", "LEEF-legacy"]) + - grok: + source: log.paCefExtensions + patterns: + - fieldName: log.paIgnored + pattern: ^(?:[A-Za-z][A-Za-z0-9_]*=(?:\\.|[^=\\])*?[ \t]+)*?panOSGTPEventCode= + - fieldName: log.panOSGTPEventCode + pattern: (?:\\.|[^=\\])*? + - fieldName: log.paSuffix + pattern: (?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) + where: oneOf("log.paFormat", ["CEF", "LEEF-legacy"]) + - grok: + source: log.paCefExtensions + patterns: + - fieldName: log.paIgnored + pattern: ^(?:[A-Za-z][A-Za-z0-9_]*=(?:\\.|[^=\\])*?[ \t]+)*?panOSGTPEventType= + - fieldName: log.panOSGTPEventType + pattern: (?:\\.|[^=\\])*? + - fieldName: log.paSuffix + pattern: (?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) + where: oneOf("log.paFormat", ["CEF", "LEEF-legacy"]) + - grok: + source: log.paCefExtensions + patterns: + - fieldName: log.paIgnored + pattern: ^(?:[A-Za-z][A-Za-z0-9_]*=(?:\\.|[^=\\])*?[ \t]+)*?panOSGTPInterface= + - fieldName: log.panOSGTPInterface + pattern: (?:\\.|[^=\\])*? + - fieldName: log.paSuffix + pattern: (?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) + where: oneOf("log.paFormat", ["CEF", "LEEF-legacy"]) + - grok: + source: log.paCefExtensions + patterns: + - fieldName: log.paIgnored + pattern: ^(?:[A-Za-z][A-Za-z0-9_]*=(?:\\.|[^=\\])*?[ \t]+)*?panOSGTPMsgType= + - fieldName: log.panOSGTPMsgType + pattern: (?:\\.|[^=\\])*? + - fieldName: log.paSuffix + pattern: (?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) + where: oneOf("log.paFormat", ["CEF", "LEEF-legacy"]) + - grok: + source: log.paCefExtensions + patterns: + - fieldName: log.paIgnored + pattern: ^(?:[A-Za-z][A-Za-z0-9_]*=(?:\\.|[^=\\])*?[ \t]+)*?panOSGateway= + - fieldName: log.panOSGateway + pattern: (?:\\.|[^=\\])*? + - fieldName: log.paSuffix + pattern: (?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) + where: oneOf("log.paFormat", ["CEF", "LEEF-legacy"]) + - grok: + source: log.paCefExtensions + patterns: + - fieldName: log.paIgnored + pattern: ^(?:[A-Za-z][A-Za-z0-9_]*=(?:\\.|[^=\\])*?[ \t]+)*?panOSGatewayPriority= + - fieldName: log.panOSGatewayPriority + pattern: (?:\\.|[^=\\])*? + - fieldName: log.paSuffix + pattern: (?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) + where: oneOf("log.paFormat", ["CEF", "LEEF-legacy"]) + - grok: + source: log.paCefExtensions + patterns: + - fieldName: log.paIgnored + pattern: ^(?:[A-Za-z][A-Za-z0-9_]*=(?:\\.|[^=\\])*?[ \t]+)*?panOSGatewaySelectionType= + - fieldName: log.panOSGatewaySelectionType + pattern: (?:\\.|[^=\\])*? + - fieldName: log.paSuffix + pattern: (?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) + where: oneOf("log.paFormat", ["CEF", "LEEF-legacy"]) + - grok: + source: log.paCefExtensions + patterns: + - fieldName: log.paIgnored + pattern: ^(?:[A-Za-z][A-Za-z0-9_]*=(?:\\.|[^=\\])*?[ \t]+)*?panOSGlobalProtectClientVersion= + - fieldName: log.panOSGlobalProtectClientVersion + pattern: (?:\\.|[^=\\])*? + - fieldName: log.paSuffix + pattern: (?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) + where: oneOf("log.paFormat", ["CEF", "LEEF-legacy"]) + - grok: + source: log.paCefExtensions + patterns: + - fieldName: log.paIgnored + pattern: ^(?:[A-Za-z][A-Za-z0-9_]*=(?:\\.|[^=\\])*?[ \t]+)*?panOSHTTP2Con= + - fieldName: log.panOSHTTP2Con + pattern: (?:\\.|[^=\\])*? + - fieldName: log.paSuffix + pattern: (?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) + where: oneOf("log.paFormat", ["CEF", "LEEF-legacy"]) + - grok: + source: log.paCefExtensions + patterns: + - fieldName: log.paIgnored + pattern: ^(?:[A-Za-z][A-Za-z0-9_]*=(?:\\.|[^=\\])*?[ \t]+)*?panOSHTTPHeader= + - fieldName: log.panOSHTTPHeader + pattern: (?:\\.|[^=\\])*? + - fieldName: log.paSuffix + pattern: (?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) + where: oneOf("log.paFormat", ["CEF", "LEEF-legacy"]) + - grok: + source: log.paCefExtensions + patterns: + - fieldName: log.paIgnored + pattern: ^(?:[A-Za-z][A-Za-z0-9_]*=(?:\\.|[^=\\])*?[ \t]+)*?panOSHTTPUserAgent= + - fieldName: log.panOSHTTPUserAgent + pattern: (?:\\.|[^=\\])*? + - fieldName: log.paSuffix + pattern: (?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) + where: oneOf("log.paFormat", ["CEF", "LEEF-legacy"]) + - grok: + source: log.paCefExtensions + patterns: + - fieldName: log.paIgnored + pattern: ^(?:[A-Za-z][A-Za-z0-9_]*=(?:\\.|[^=\\])*?[ \t]+)*?panOSHostID= + - fieldName: log.panOSHostID + pattern: (?:\\.|[^=\\])*? + - fieldName: log.paSuffix + pattern: (?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) + where: oneOf("log.paFormat", ["CEF", "LEEF-legacy"]) + - grok: + source: log.paCefExtensions + patterns: + - fieldName: log.paIgnored + pattern: ^(?:[A-Za-z][A-Za-z0-9_]*=(?:\\.|[^=\\])*?[ \t]+)*?panOSIssuerCommonName= + - fieldName: log.panOSIssuerCommonName + pattern: (?:\\.|[^=\\])*? + - fieldName: log.paSuffix + pattern: (?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) + where: oneOf("log.paFormat", ["CEF", "LEEF-legacy"]) + - grok: + source: log.paCefExtensions + patterns: + - fieldName: log.paIgnored + pattern: ^(?:[A-Za-z][A-Za-z0-9_]*=(?:\\.|[^=\\])*?[ \t]+)*?panOSIssuerNameLength= + - fieldName: log.panOSIssuerNameLength + pattern: (?:\\.|[^=\\])*? + - fieldName: log.paSuffix + pattern: (?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) + where: oneOf("log.paFormat", ["CEF", "LEEF-legacy"]) + - grok: + source: log.paCefExtensions + patterns: + - fieldName: log.paIgnored + pattern: ^(?:[A-Za-z][A-Za-z0-9_]*=(?:\\.|[^=\\])*?[ \t]+)*?panOSLogTimeStamp= + - fieldName: log.panOSLogTimeStamp + pattern: (?:\\.|[^=\\])*? + - fieldName: log.paSuffix + pattern: (?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) + where: oneOf("log.paFormat", ["CEF", "LEEF-legacy"]) + - grok: + source: log.paCefExtensions + patterns: + - fieldName: log.paIgnored + pattern: ^(?:[A-Za-z][A-Za-z0-9_]*=(?:\\.|[^=\\])*?[ \t]+)*?panOSLogTypeSeqNo= + - fieldName: log.panOSLogTypeSeqNo + pattern: (?:\\.|[^=\\])*? + - fieldName: log.paSuffix + pattern: (?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) + where: oneOf("log.paFormat", ["CEF", "LEEF-legacy"]) + - grok: + source: log.paCefExtensions + patterns: + - fieldName: log.paIgnored + pattern: ^(?:[A-Za-z][A-Za-z0-9_]*=(?:\\.|[^=\\])*?[ \t]+)*?panOSLoginDuration= + - fieldName: log.panOSLoginDuration + pattern: (?:\\.|[^=\\])*? + - fieldName: log.paSuffix + pattern: (?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) + where: oneOf("log.paFormat", ["CEF", "LEEF-legacy"]) + - grok: + source: log.paCefExtensions + patterns: + - fieldName: log.paIgnored + pattern: ^(?:[A-Za-z][A-Za-z0-9_]*=(?:\\.|[^=\\])*?[ \t]+)*?panOSMSISDN= + - fieldName: log.panOSMSISDN + pattern: (?:\\.|[^=\\])*? + - fieldName: log.paSuffix + pattern: (?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) + where: oneOf("log.paFormat", ["CEF", "LEEF-legacy"]) + - grok: + source: log.paCefExtensions + patterns: + - fieldName: log.paIgnored + pattern: ^(?:[A-Za-z][A-Za-z0-9_]*=(?:\\.|[^=\\])*?[ \t]+)*?panOSMonitorTag= + - fieldName: log.panOSMonitorTag + pattern: (?:\\.|[^=\\])*? + - fieldName: log.paSuffix + pattern: (?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) + where: oneOf("log.paFormat", ["CEF", "LEEF-legacy"]) + - grok: + source: log.paCefExtensions + patterns: + - fieldName: log.paIgnored + pattern: ^(?:[A-Za-z][A-Za-z0-9_]*=(?:\\.|[^=\\])*?[ \t]+)*?panOSOpCode= + - fieldName: log.panOSOpCode + pattern: (?:\\.|[^=\\])*? + - fieldName: log.paSuffix + pattern: (?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) + where: oneOf("log.paFormat", ["CEF", "LEEF-legacy"]) + - grok: + source: log.paCefExtensions + patterns: + - fieldName: log.paIgnored + pattern: ^(?:[A-Za-z][A-Za-z0-9_]*=(?:\\.|[^=\\])*?[ \t]+)*?panOSPPID= + - fieldName: log.panOSPPID + pattern: (?:\\.|[^=\\])*? + - fieldName: log.paSuffix + pattern: (?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) + where: oneOf("log.paFormat", ["CEF", "LEEF-legacy"]) + - grok: + source: log.paCefExtensions + patterns: + - fieldName: log.paIgnored + pattern: ^(?:[A-Za-z][A-Za-z0-9_]*=(?:\\.|[^=\\])*?[ \t]+)*?panOSPacketsReceived= + - fieldName: log.panOSPacketsReceived + pattern: (?:\\.|[^=\\])*? + - fieldName: log.paSuffix + pattern: (?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) + where: oneOf("log.paFormat", ["CEF", "LEEF-legacy"]) + - grok: + source: log.paCefExtensions + patterns: + - fieldName: log.paIgnored + pattern: ^(?:[A-Za-z][A-Za-z0-9_]*=(?:\\.|[^=\\])*?[ \t]+)*?panOSPacketsSent= + - fieldName: log.panOSPacketsSent + pattern: (?:\\.|[^=\\])*? + - fieldName: log.paSuffix + pattern: (?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) + where: oneOf("log.paFormat", ["CEF", "LEEF-legacy"]) + - grok: + source: log.paCefExtensions + patterns: + - fieldName: log.paIgnored + pattern: ^(?:[A-Za-z][A-Za-z0-9_]*=(?:\\.|[^=\\])*?[ \t]+)*?panOSParentSessionID= + - fieldName: log.panOSParentSessionID + pattern: (?:\\.|[^=\\])*? + - fieldName: log.paSuffix + pattern: (?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) + where: oneOf("log.paFormat", ["CEF", "LEEF-legacy"]) + - grok: + source: log.paCefExtensions + patterns: + - fieldName: log.paIgnored + pattern: ^(?:[A-Za-z][A-Za-z0-9_]*=(?:\\.|[^=\\])*?[ \t]+)*?panOSParentStartTime= + - fieldName: log.panOSParentStartTime + pattern: (?:\\.|[^=\\])*? + - fieldName: log.paSuffix + pattern: (?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) + where: oneOf("log.paFormat", ["CEF", "LEEF-legacy"]) + - grok: + source: log.paCefExtensions + patterns: + - fieldName: log.paIgnored + pattern: ^(?:[A-Za-z][A-Za-z0-9_]*=(?:\\.|[^=\\])*?[ \t]+)*?panOSPayloadProtID= + - fieldName: log.panOSPayloadProtID + pattern: (?:\\.|[^=\\])*? + - fieldName: log.paSuffix + pattern: (?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) + where: oneOf("log.paFormat", ["CEF", "LEEF-legacy"]) + - grok: + source: log.paCefExtensions + patterns: + - fieldName: log.paIgnored + pattern: ^(?:[A-Za-z][A-Za-z0-9_]*=(?:\\.|[^=\\])*?[ \t]+)*?panOSPcapID= + - fieldName: log.panOSPcapID + pattern: (?:\\.|[^=\\])*? + - fieldName: log.paSuffix + pattern: (?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) + where: oneOf("log.paFormat", ["CEF", "LEEF-legacy"]) + - grok: + source: log.paCefExtensions + patterns: + - fieldName: log.paIgnored + pattern: ^(?:[A-Za-z][A-Za-z0-9_]*=(?:\\.|[^=\\])*?[ \t]+)*?panOSPolicyAuditComment= + - fieldName: log.panOSPolicyAuditComment + pattern: (?:\\.|[^=\\])*? + - fieldName: log.paSuffix + pattern: (?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) + where: oneOf("log.paFormat", ["CEF", "LEEF-legacy"]) + - grok: + source: log.paCefExtensions + patterns: + - fieldName: log.paIgnored + pattern: ^(?:[A-Za-z][A-Za-z0-9_]*=(?:\\.|[^=\\])*?[ \t]+)*?panOSPolicyName= + - fieldName: log.panOSPolicyName + pattern: (?:\\.|[^=\\])*? + - fieldName: log.paSuffix + pattern: (?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) + where: oneOf("log.paFormat", ["CEF", "LEEF-legacy"]) + - grok: + source: log.paCefExtensions + patterns: + - fieldName: log.paIgnored + pattern: ^(?:[A-Za-z][A-Za-z0-9_]*=(?:\\.|[^=\\])*?[ \t]+)*?panOSPortal= + - fieldName: log.panOSPortal + pattern: (?:\\.|[^=\\])*? + - fieldName: log.paSuffix + pattern: (?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) + where: oneOf("log.paFormat", ["CEF", "LEEF-legacy"]) + - grok: + source: log.paCefExtensions + patterns: + - fieldName: log.paIgnored + pattern: ^(?:[A-Za-z][A-Za-z0-9_]*=(?:\\.|[^=\\])*?[ \t]+)*?panOSPrivateIPv4= + - fieldName: log.panOSPrivateIPv4 + pattern: (?:\\.|[^=\\])*? + - fieldName: log.paSuffix + pattern: (?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) + where: oneOf("log.paFormat", ["CEF", "LEEF-legacy"]) + - grok: + source: log.paCefExtensions + patterns: + - fieldName: log.paIgnored + pattern: ^(?:[A-Za-z][A-Za-z0-9_]*=(?:\\.|[^=\\])*?[ \t]+)*?panOSPrivateIPv6= + - fieldName: log.panOSPrivateIPv6 + pattern: (?:\\.|[^=\\])*? + - fieldName: log.paSuffix + pattern: (?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) + where: oneOf("log.paFormat", ["CEF", "LEEF-legacy"]) + - grok: + source: log.paCefExtensions + patterns: + - fieldName: log.paIgnored + pattern: ^(?:[A-Za-z][A-Za-z0-9_]*=(?:\\.|[^=\\])*?[ \t]+)*?panOSProxyType= + - fieldName: log.panOSProxyType + pattern: (?:\\.|[^=\\])*? + - fieldName: log.paSuffix + pattern: (?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) + where: oneOf("log.paFormat", ["CEF", "LEEF-legacy"]) + - grok: + source: log.paCefExtensions + patterns: + - fieldName: log.paIgnored + pattern: ^(?:[A-Za-z][A-Za-z0-9_]*=(?:\\.|[^=\\])*?[ \t]+)*?panOSPublicIPv4= + - fieldName: log.panOSPublicIPv4 + pattern: (?:\\.|[^=\\])*? + - fieldName: log.paSuffix + pattern: (?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) + where: oneOf("log.paFormat", ["CEF", "LEEF-legacy"]) + - grok: + source: log.paCefExtensions + patterns: + - fieldName: log.paIgnored + pattern: ^(?:[A-Za-z][A-Za-z0-9_]*=(?:\\.|[^=\\])*?[ \t]+)*?panOSPublicIPv6= + - fieldName: log.panOSPublicIPv6 + pattern: (?:\\.|[^=\\])*? + - fieldName: log.paSuffix + pattern: (?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) + where: oneOf("log.paFormat", ["CEF", "LEEF-legacy"]) + - grok: + source: log.paCefExtensions + patterns: + - fieldName: log.paIgnored + pattern: ^(?:[A-Za-z][A-Za-z0-9_]*=(?:\\.|[^=\\])*?[ \t]+)*?panOSQuarantineReason= + - fieldName: log.panOSQuarantineReason + pattern: (?:\\.|[^=\\])*? + - fieldName: log.paSuffix + pattern: (?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) + where: oneOf("log.paFormat", ["CEF", "LEEF-legacy"]) + - grok: + source: log.paCefExtensions + patterns: + - fieldName: log.paIgnored + pattern: ^(?:[A-Za-z][A-Za-z0-9_]*=(?:\\.|[^=\\])*?[ \t]+)*?panOSRadioTech= + - fieldName: log.panOSRadioTech + pattern: (?:\\.|[^=\\])*? + - fieldName: log.paSuffix + pattern: (?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) + where: oneOf("log.paFormat", ["CEF", "LEEF-legacy"]) + - grok: + source: log.paCefExtensions + patterns: + - fieldName: log.paIgnored + pattern: ^(?:[A-Za-z][A-Za-z0-9_]*=(?:\\.|[^=\\])*?[ \t]+)*?panOSReferer= + - fieldName: log.panOSReferer + pattern: (?:\\.|[^=\\])*? + - fieldName: log.paSuffix + pattern: (?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) + where: oneOf("log.paFormat", ["CEF", "LEEF-legacy"]) + - grok: + source: log.paCefExtensions + patterns: + - fieldName: log.paIgnored + pattern: ^(?:[A-Za-z][A-Za-z0-9_]*=(?:\\.|[^=\\])*?[ \t]+)*?panOSRmtUserID= + - fieldName: log.panOSRmtUserID + pattern: (?:\\.|[^=\\])*? + - fieldName: log.paSuffix + pattern: (?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) + where: oneOf("log.paFormat", ["CEF", "LEEF-legacy"]) + - grok: + source: log.paCefExtensions + patterns: + - fieldName: log.paIgnored + pattern: ^(?:[A-Za-z][A-Za-z0-9_]*=(?:\\.|[^=\\])*?[ \t]+)*?panOSRmtUserIP= + - fieldName: log.panOSRmtUserIP + pattern: (?:\\.|[^=\\])*? + - fieldName: log.paSuffix + pattern: (?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) + where: oneOf("log.paFormat", ["CEF", "LEEF-legacy"]) + - grok: + source: log.paCefExtensions + patterns: + - fieldName: log.paIgnored + pattern: ^(?:[A-Za-z][A-Za-z0-9_]*=(?:\\.|[^=\\])*?[ \t]+)*?panOSRootCNLength= + - fieldName: log.panOSRootCNLength + pattern: (?:\\.|[^=\\])*? + - fieldName: log.paSuffix + pattern: (?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) + where: oneOf("log.paFormat", ["CEF", "LEEF-legacy"]) + - grok: + source: log.paCefExtensions + patterns: + - fieldName: log.paIgnored + pattern: ^(?:[A-Za-z][A-Za-z0-9_]*=(?:\\.|[^=\\])*?[ \t]+)*?panOSRootCommonName= + - fieldName: log.panOSRootCommonName + pattern: (?:\\.|[^=\\])*? + - fieldName: log.paSuffix + pattern: (?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) + where: oneOf("log.paFormat", ["CEF", "LEEF-legacy"]) + - grok: + source: log.paCefExtensions + patterns: + - fieldName: log.paIgnored + pattern: ^(?:[A-Za-z][A-Za-z0-9_]*=(?:\\.|[^=\\])*?[ \t]+)*?panOSRootStatus= + - fieldName: log.panOSRootStatus + pattern: (?:\\.|[^=\\])*? + - fieldName: log.paSuffix + pattern: (?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) + where: oneOf("log.paFormat", ["CEF", "LEEF-legacy"]) + - grok: + source: log.paCefExtensions + patterns: + - fieldName: log.paIgnored + pattern: ^(?:[A-Za-z][A-Za-z0-9_]*=(?:\\.|[^=\\])*?[ \t]+)*?panOSRuleUUID= + - fieldName: log.panOSRuleUUID + pattern: (?:\\.|[^=\\])*? + - fieldName: log.paSuffix + pattern: (?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) + where: oneOf("log.paFormat", ["CEF", "LEEF-legacy"]) + - grok: + source: log.paCefExtensions + patterns: + - fieldName: log.paIgnored + pattern: ^(?:[A-Za-z][A-Za-z0-9_]*=(?:\\.|[^=\\])*?[ \t]+)*?panOSSCCPCallingGT= + - fieldName: log.panOSSCCPCallingGT + pattern: (?:\\.|[^=\\])*? + - fieldName: log.paSuffix + pattern: (?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) + where: oneOf("log.paFormat", ["CEF", "LEEF-legacy"]) + - grok: + source: log.paCefExtensions + patterns: + - fieldName: log.paIgnored + pattern: ^(?:[A-Za-z][A-Za-z0-9_]*=(?:\\.|[^=\\])*?[ \t]+)*?panOSSCCPCallingPartySSN= + - fieldName: log.panOSSCCPCallingPartySSN + pattern: (?:\\.|[^=\\])*? + - fieldName: log.paSuffix + pattern: (?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) + where: oneOf("log.paFormat", ["CEF", "LEEF-legacy"]) + - grok: + source: log.paCefExtensions + patterns: + - fieldName: log.paIgnored + pattern: ^(?:[A-Za-z][A-Za-z0-9_]*=(?:\\.|[^=\\])*?[ \t]+)*?panOSSCTPAssocEndReason= + - fieldName: log.panOSSCTPAssocEndReason + pattern: (?:\\.|[^=\\])*? + - fieldName: log.paSuffix + pattern: (?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) + where: oneOf("log.paFormat", ["CEF", "LEEF-legacy"]) + - grok: + source: log.paCefExtensions + patterns: + - fieldName: log.paIgnored + pattern: ^(?:[A-Za-z][A-Za-z0-9_]*=(?:\\.|[^=\\])*?[ \t]+)*?panOSSCTPAssocID= + - fieldName: log.panOSSCTPAssocID + pattern: (?:\\.|[^=\\])*? + - fieldName: log.paSuffix + pattern: (?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) + where: oneOf("log.paFormat", ["CEF", "LEEF-legacy"]) + - grok: + source: log.paCefExtensions + patterns: + - fieldName: log.paIgnored + pattern: ^(?:[A-Za-z][A-Za-z0-9_]*=(?:\\.|[^=\\])*?[ \t]+)*?panOSSCTPCauseCode= + - fieldName: log.panOSSCTPCauseCode + pattern: (?:\\.|[^=\\])*? + - fieldName: log.paSuffix + pattern: (?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) + where: oneOf("log.paFormat", ["CEF", "LEEF-legacy"]) + - grok: + source: log.paCefExtensions + patterns: + - fieldName: log.paIgnored + pattern: ^(?:[A-Za-z][A-Za-z0-9_]*=(?:\\.|[^=\\])*?[ \t]+)*?panOSSCTPChunkRcv= + - fieldName: log.panOSSCTPChunkRcv + pattern: (?:\\.|[^=\\])*? + - fieldName: log.paSuffix + pattern: (?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) + where: oneOf("log.paFormat", ["CEF", "LEEF-legacy"]) + - grok: + source: log.paCefExtensions + patterns: + - fieldName: log.paIgnored + pattern: ^(?:[A-Za-z][A-Za-z0-9_]*=(?:\\.|[^=\\])*?[ \t]+)*?panOSSCTPChunkSent= + - fieldName: log.panOSSCTPChunkSent + pattern: (?:\\.|[^=\\])*? + - fieldName: log.paSuffix + pattern: (?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) + where: oneOf("log.paFormat", ["CEF", "LEEF-legacy"]) + - grok: + source: log.paCefExtensions + patterns: + - fieldName: log.paIgnored + pattern: ^(?:[A-Za-z][A-Za-z0-9_]*=(?:\\.|[^=\\])*?[ \t]+)*?panOSSCTPChunks= + - fieldName: log.panOSSCTPChunks + pattern: (?:\\.|[^=\\])*? + - fieldName: log.paSuffix + pattern: (?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) + where: oneOf("log.paFormat", ["CEF", "LEEF-legacy"]) + - grok: + source: log.paCefExtensions + patterns: + - fieldName: log.paIgnored + pattern: ^(?:[A-Za-z][A-Za-z0-9_]*=(?:\\.|[^=\\])*?[ \t]+)*?panOSSCTPChunksRcv= + - fieldName: log.panOSSCTPChunksRcv + pattern: (?:\\.|[^=\\])*? + - fieldName: log.paSuffix + pattern: (?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) + where: oneOf("log.paFormat", ["CEF", "LEEF-legacy"]) + - grok: + source: log.paCefExtensions + patterns: + - fieldName: log.paIgnored + pattern: ^(?:[A-Za-z][A-Za-z0-9_]*=(?:\\.|[^=\\])*?[ \t]+)*?panOSSCTPFilter= + - fieldName: log.panOSSCTPFilter + pattern: (?:\\.|[^=\\])*? + - fieldName: log.paSuffix + pattern: (?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) + where: oneOf("log.paFormat", ["CEF", "LEEF-legacy"]) + - grok: + source: log.paCefExtensions + patterns: + - fieldName: log.paIgnored + pattern: ^(?:[A-Za-z][A-Za-z0-9_]*=(?:\\.|[^=\\])*?[ \t]+)*?panOSSCTPStreamID= + - fieldName: log.panOSSCTPStreamID + pattern: (?:\\.|[^=\\])*? + - fieldName: log.paSuffix + pattern: (?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) + where: oneOf("log.paFormat", ["CEF", "LEEF-legacy"]) + - grok: + source: log.paCefExtensions + patterns: + - fieldName: log.paIgnored + pattern: ^(?:[A-Za-z][A-Za-z0-9_]*=(?:\\.|[^=\\])*?[ \t]+)*?panOSSCTPVerTag1= + - fieldName: log.panOSSCTPVerTag1 + pattern: (?:\\.|[^=\\])*? + - fieldName: log.paSuffix + pattern: (?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) + where: oneOf("log.paFormat", ["CEF", "LEEF-legacy"]) + - grok: + source: log.paCefExtensions + patterns: + - fieldName: log.paIgnored + pattern: ^(?:[A-Za-z][A-Za-z0-9_]*=(?:\\.|[^=\\])*?[ \t]+)*?panOSSCTPVerTag2= + - fieldName: log.panOSSCTPVerTag2 + pattern: (?:\\.|[^=\\])*? + - fieldName: log.paSuffix + pattern: (?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) + where: oneOf("log.paFormat", ["CEF", "LEEF-legacy"]) + - grok: + source: log.paCefExtensions + patterns: + - fieldName: log.paIgnored + pattern: ^(?:[A-Za-z][A-Za-z0-9_]*=(?:\\.|[^=\\])*?[ \t]+)*?panOSSNILength= + - fieldName: log.panOSSNILength + pattern: (?:\\.|[^=\\])*? + - fieldName: log.paSuffix + pattern: (?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) + where: oneOf("log.paFormat", ["CEF", "LEEF-legacy"]) + - grok: + source: log.paCefExtensions + patterns: + - fieldName: log.paIgnored + pattern: ^(?:[A-Za-z][A-Za-z0-9_]*=(?:\\.|[^=\\])*?[ \t]+)*?panOSSSLResponseTime= + - fieldName: log.panOSSSLResponseTime + pattern: (?:\\.|[^=\\])*? + - fieldName: log.paSuffix + pattern: (?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) + where: oneOf("log.paFormat", ["CEF", "LEEF-legacy"]) + - grok: + source: log.paCefExtensions + patterns: + - fieldName: log.paIgnored + pattern: ^(?:[A-Za-z][A-Za-z0-9_]*=(?:\\.|[^=\\])*?[ \t]+)*?panOSSequenceNo= + - fieldName: log.panOSSequenceNo + pattern: (?:\\.|[^=\\])*? + - fieldName: log.paSuffix + pattern: (?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) + where: oneOf("log.paFormat", ["CEF", "LEEF-legacy"]) + - grok: + source: log.paCefExtensions + patterns: + - fieldName: log.paIgnored + pattern: ^(?:[A-Za-z][A-Za-z0-9_]*=(?:\\.|[^=\\])*?[ \t]+)*?panOSServerNameIndication= + - fieldName: log.panOSServerNameIndication + pattern: (?:\\.|[^=\\])*? + - fieldName: log.paSuffix + pattern: (?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) + where: oneOf("log.paFormat", ["CEF", "LEEF-legacy"]) + - grok: + source: log.paCefExtensions + patterns: + - fieldName: log.paIgnored + pattern: ^(?:[A-Za-z][A-Za-z0-9_]*=(?:\\.|[^=\\])*?[ \t]+)*?panOSServingCntryMCC= + - fieldName: log.panOSServingCntryMCC + pattern: (?:\\.|[^=\\])*? + - fieldName: log.paSuffix + pattern: (?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) + where: oneOf("log.paFormat", ["CEF", "LEEF-legacy"]) + - grok: + source: log.paCefExtensions + patterns: + - fieldName: log.paIgnored + pattern: ^(?:[A-Za-z][A-Za-z0-9_]*=(?:\\.|[^=\\])*?[ \t]+)*?panOSServingNetMNC= + - fieldName: log.panOSServingNetMNC + pattern: (?:\\.|[^=\\])*? + - fieldName: log.paSuffix + pattern: (?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) + where: oneOf("log.paFormat", ["CEF", "LEEF-legacy"]) + - grok: + source: log.paCefExtensions + patterns: + - fieldName: log.paIgnored + pattern: ^(?:[A-Za-z][A-Za-z0-9_]*=(?:\\.|[^=\\])*?[ \t]+)*?panOSSeverity= + - fieldName: log.panOSSeverity + pattern: (?:\\.|[^=\\])*? + - fieldName: log.paSuffix + pattern: (?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) + where: oneOf("log.paFormat", ["CEF", "LEEF-legacy"]) + - grok: + source: log.paCefExtensions + patterns: + - fieldName: log.paIgnored + pattern: ^(?:[A-Za-z][A-Za-z0-9_]*=(?:\\.|[^=\\])*?[ \t]+)*?panOSSourceDeviceCategory= + - fieldName: log.panOSSourceDeviceCategory + pattern: (?:\\.|[^=\\])*? + - fieldName: log.paSuffix + pattern: (?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) + where: oneOf("log.paFormat", ["CEF", "LEEF-legacy"]) + - grok: + source: log.paCefExtensions + patterns: + - fieldName: log.paIgnored + pattern: ^(?:[A-Za-z][A-Za-z0-9_]*=(?:\\.|[^=\\])*?[ \t]+)*?panOSSourceDeviceHost= + - fieldName: log.panOSSourceDeviceHost + pattern: (?:\\.|[^=\\])*? + - fieldName: log.paSuffix + pattern: (?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) + where: oneOf("log.paFormat", ["CEF", "LEEF-legacy"]) + - grok: + source: log.paCefExtensions + patterns: + - fieldName: log.paIgnored + pattern: ^(?:[A-Za-z][A-Za-z0-9_]*=(?:\\.|[^=\\])*?[ \t]+)*?panOSSourceDeviceMac= + - fieldName: log.panOSSourceDeviceMac + pattern: (?:\\.|[^=\\])*? + - fieldName: log.paSuffix + pattern: (?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) + where: oneOf("log.paFormat", ["CEF", "LEEF-legacy"]) + - grok: + source: log.paCefExtensions + patterns: + - fieldName: log.paIgnored + pattern: ^(?:[A-Za-z][A-Za-z0-9_]*=(?:\\.|[^=\\])*?[ \t]+)*?panOSSourceDeviceModel= + - fieldName: log.panOSSourceDeviceModel + pattern: (?:\\.|[^=\\])*? + - fieldName: log.paSuffix + pattern: (?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) + where: oneOf("log.paFormat", ["CEF", "LEEF-legacy"]) + - grok: + source: log.paCefExtensions + patterns: + - fieldName: log.paIgnored + pattern: ^(?:[A-Za-z][A-Za-z0-9_]*=(?:\\.|[^=\\])*?[ \t]+)*?panOSSourceDeviceOSFamily= + - fieldName: log.panOSSourceDeviceOSFamily + pattern: (?:\\.|[^=\\])*? + - fieldName: log.paSuffix + pattern: (?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) + where: oneOf("log.paFormat", ["CEF", "LEEF-legacy"]) + - grok: + source: log.paCefExtensions + patterns: + - fieldName: log.paIgnored + pattern: ^(?:[A-Za-z][A-Za-z0-9_]*=(?:\\.|[^=\\])*?[ \t]+)*?panOSSourceDeviceOSVersion= + - fieldName: log.panOSSourceDeviceOSVersion + pattern: (?:\\.|[^=\\])*? + - fieldName: log.paSuffix + pattern: (?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) + where: oneOf("log.paFormat", ["CEF", "LEEF-legacy"]) + - grok: + source: log.paCefExtensions + patterns: + - fieldName: log.paIgnored + pattern: ^(?:[A-Za-z][A-Za-z0-9_]*=(?:\\.|[^=\\])*?[ \t]+)*?panOSSourceDeviceProfile= + - fieldName: log.panOSSourceDeviceProfile + pattern: (?:\\.|[^=\\])*? + - fieldName: log.paSuffix + pattern: (?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) + where: oneOf("log.paFormat", ["CEF", "LEEF-legacy"]) + - grok: + source: log.paCefExtensions + patterns: + - fieldName: log.paIgnored + pattern: ^(?:[A-Za-z][A-Za-z0-9_]*=(?:\\.|[^=\\])*?[ \t]+)*?panOSSourceDeviceVendor= + - fieldName: log.panOSSourceDeviceVendor + pattern: (?:\\.|[^=\\])*? + - fieldName: log.paSuffix + pattern: (?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) + where: oneOf("log.paFormat", ["CEF", "LEEF-legacy"]) + - grok: + source: log.paCefExtensions + patterns: + - fieldName: log.paIgnored + pattern: ^(?:[A-Za-z][A-Za-z0-9_]*=(?:\\.|[^=\\])*?[ \t]+)*?panOSSourceDynamicAddressGroup= + - fieldName: log.panOSSourceDynamicAddressGroup + pattern: (?:\\.|[^=\\])*? + - fieldName: log.paSuffix + pattern: (?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) + where: oneOf("log.paFormat", ["CEF", "LEEF-legacy"]) + - grok: + source: log.paCefExtensions + patterns: + - fieldName: log.paIgnored + pattern: ^(?:[A-Za-z][A-Za-z0-9_]*=(?:\\.|[^=\\])*?[ \t]+)*?panOSSourceEDL= + - fieldName: log.panOSSourceEDL + pattern: (?:\\.|[^=\\])*? + - fieldName: log.paSuffix + pattern: (?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) + where: oneOf("log.paFormat", ["CEF", "LEEF-legacy"]) + - grok: + source: log.paCefExtensions + patterns: + - fieldName: log.paIgnored + pattern: ^(?:[A-Za-z][A-Za-z0-9_]*=(?:\\.|[^=\\])*?[ \t]+)*?panOSSourceHostname= + - fieldName: log.panOSSourceHostname + pattern: (?:\\.|[^=\\])*? + - fieldName: log.paSuffix + pattern: (?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) + where: oneOf("log.paFormat", ["CEF", "LEEF-legacy"]) + - grok: + source: log.paCefExtensions + patterns: + - fieldName: log.paIgnored + pattern: ^(?:[A-Za-z][A-Za-z0-9_]*=(?:\\.|[^=\\])*?[ \t]+)*?panOSSourceMac= + - fieldName: log.panOSSourceMac + pattern: (?:\\.|[^=\\])*? + - fieldName: log.paSuffix + pattern: (?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) + where: oneOf("log.paFormat", ["CEF", "LEEF-legacy"]) + - grok: + source: log.paCefExtensions + patterns: + - fieldName: log.paIgnored + pattern: ^(?:[A-Za-z][A-Za-z0-9_]*=(?:\\.|[^=\\])*?[ \t]+)*?panOSSourceRegion= + - fieldName: log.panOSSourceRegion + pattern: (?:\\.|[^=\\])*? + - fieldName: log.paSuffix + pattern: (?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) + where: oneOf("log.paFormat", ["CEF", "LEEF-legacy"]) + - grok: + source: log.paCefExtensions + patterns: + - fieldName: log.paIgnored + pattern: ^(?:[A-Za-z][A-Za-z0-9_]*=(?:\\.|[^=\\])*?[ \t]+)*?panOSSourceUUID= + - fieldName: log.panOSSourceUUID + pattern: (?:\\.|[^=\\])*? + - fieldName: log.paSuffix + pattern: (?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) + where: oneOf("log.paFormat", ["CEF", "LEEF-legacy"]) + - grok: + source: log.paCefExtensions + patterns: + - fieldName: log.paIgnored + pattern: ^(?:[A-Za-z][A-Za-z0-9_]*=(?:\\.|[^=\\])*?[ \t]+)*?panOSSourceUserName= + - fieldName: log.panOSSourceUserName + pattern: (?:\\.|[^=\\])*? + - fieldName: log.paSuffix + pattern: (?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) + where: oneOf("log.paFormat", ["CEF", "LEEF-legacy"]) + - grok: + source: log.paCefExtensions + patterns: + - fieldName: log.paIgnored + pattern: ^(?:[A-Za-z][A-Za-z0-9_]*=(?:\\.|[^=\\])*?[ \t]+)*?panOSSrcUUID= + - fieldName: log.panOSSrcUUID + pattern: (?:\\.|[^=\\])*? + - fieldName: log.paSuffix + pattern: (?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) + where: oneOf("log.paFormat", ["CEF", "LEEF-legacy"]) + - grok: + source: log.paCefExtensions + patterns: + - fieldName: log.paIgnored + pattern: ^(?:[A-Za-z][A-Za-z0-9_]*=(?:\\.|[^=\\])*?[ \t]+)*?panOSStage= + - fieldName: log.panOSStage + pattern: (?:\\.|[^=\\])*? + - fieldName: log.paSuffix + pattern: (?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) + where: oneOf("log.paFormat", ["CEF", "LEEF-legacy"]) + - grok: + source: log.paCefExtensions + patterns: + - fieldName: log.paIgnored + pattern: ^(?:[A-Za-z][A-Za-z0-9_]*=(?:\\.|[^=\\])*?[ \t]+)*?panOSTLSAuth= + - fieldName: log.panOSTLSAuth + pattern: (?:\\.|[^=\\])*? + - fieldName: log.paSuffix + pattern: (?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) + where: oneOf("log.paFormat", ["CEF", "LEEF-legacy"]) + - grok: + source: log.paCefExtensions + patterns: + - fieldName: log.paIgnored + pattern: ^(?:[A-Za-z][A-Za-z0-9_]*=(?:\\.|[^=\\])*?[ \t]+)*?panOSTLSEncryptionAlgorithm= + - fieldName: log.panOSTLSEncryptionAlgorithm + pattern: (?:\\.|[^=\\])*? + - fieldName: log.paSuffix + pattern: (?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) + where: oneOf("log.paFormat", ["CEF", "LEEF-legacy"]) + - grok: + source: log.paCefExtensions + patterns: + - fieldName: log.paIgnored + pattern: ^(?:[A-Za-z][A-Za-z0-9_]*=(?:\\.|[^=\\])*?[ \t]+)*?panOSTLSKeyExchange= + - fieldName: log.panOSTLSKeyExchange + pattern: (?:\\.|[^=\\])*? + - fieldName: log.paSuffix + pattern: (?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) + where: oneOf("log.paFormat", ["CEF", "LEEF-legacy"]) + - grok: + source: log.paCefExtensions + patterns: + - fieldName: log.paIgnored + pattern: ^(?:[A-Za-z][A-Za-z0-9_]*=(?:\\.|[^=\\])*?[ \t]+)*?panOSTLSVersion= + - fieldName: log.panOSTLSVersion + pattern: (?:\\.|[^=\\])*? + - fieldName: log.paSuffix + pattern: (?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) + where: oneOf("log.paFormat", ["CEF", "LEEF-legacy"]) + - grok: + source: log.paCefExtensions + patterns: + - fieldName: log.paIgnored + pattern: ^(?:[A-Za-z][A-Za-z0-9_]*=(?:\\.|[^=\\])*?[ \t]+)*?panOSTagName= + - fieldName: log.panOSTagName + pattern: (?:\\.|[^=\\])*? + - fieldName: log.paSuffix + pattern: (?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) + where: oneOf("log.paFormat", ["CEF", "LEEF-legacy"]) + - grok: + source: log.paCefExtensions + patterns: + - fieldName: log.paIgnored + pattern: ^(?:[A-Za-z][A-Za-z0-9_]*=(?:\\.|[^=\\])*?[ \t]+)*?panOSThreatCategory= + - fieldName: log.panOSThreatCategory + pattern: (?:\\.|[^=\\])*? + - fieldName: log.paSuffix + pattern: (?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) + where: oneOf("log.paFormat", ["CEF", "LEEF-legacy"]) + - grok: + source: log.paCefExtensions + patterns: + - fieldName: log.paIgnored + pattern: ^(?:[A-Za-z][A-Za-z0-9_]*=(?:\\.|[^=\\])*?[ \t]+)*?panOSTimeGeneratedHighResolution= + - fieldName: log.panOSTimeGeneratedHighResolution + pattern: (?:\\.|[^=\\])*? + - fieldName: log.paSuffix + pattern: (?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) + where: oneOf("log.paFormat", ["CEF", "LEEF-legacy"]) + - grok: + source: log.paCefExtensions + patterns: + - fieldName: log.paIgnored + pattern: ^(?:[A-Za-z][A-Za-z0-9_]*=(?:\\.|[^=\\])*?[ \t]+)*?panOSTimeNotAfter= + - fieldName: log.panOSTimeNotAfter + pattern: (?:\\.|[^=\\])*? + - fieldName: log.paSuffix + pattern: (?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) + where: oneOf("log.paFormat", ["CEF", "LEEF-legacy"]) + - grok: + source: log.paCefExtensions + patterns: + - fieldName: log.paIgnored + pattern: ^(?:[A-Za-z][A-Za-z0-9_]*=(?:\\.|[^=\\])*?[ \t]+)*?panOSTimeNotBefore= + - fieldName: log.panOSTimeNotBefore + pattern: (?:\\.|[^=\\])*? + - fieldName: log.paSuffix + pattern: (?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) + where: oneOf("log.paFormat", ["CEF", "LEEF-legacy"]) + - grok: + source: log.paCefExtensions + patterns: + - fieldName: log.paIgnored + pattern: ^(?:[A-Za-z][A-Za-z0-9_]*=(?:\\.|[^=\\])*?[ \t]+)*?panOSTimeReceivedManagementPlane= + - fieldName: log.panOSTimeReceivedManagementPlane + pattern: (?:\\.|[^=\\])*? + - fieldName: log.paSuffix + pattern: (?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) + where: oneOf("log.paFormat", ["CEF", "LEEF-legacy"]) + - grok: + source: log.paCefExtensions + patterns: + - fieldName: log.paIgnored + pattern: ^(?:[A-Za-z][A-Za-z0-9_]*=(?:\\.|[^=\\])*?[ \t]+)*?panOSTimeout= + - fieldName: log.panOSTimeout + pattern: (?:\\.|[^=\\])*? + - fieldName: log.paSuffix + pattern: (?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) + where: oneOf("log.paFormat", ["CEF", "LEEF-legacy"]) + - grok: + source: log.paCefExtensions + patterns: + - fieldName: log.paIgnored + pattern: ^(?:[A-Za-z][A-Za-z0-9_]*=(?:\\.|[^=\\])*?[ \t]+)*?panOSTrafficOriginRegion= + - fieldName: log.panOSTrafficOriginRegion + pattern: (?:\\.|[^=\\])*? + - fieldName: log.paSuffix + pattern: (?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) + where: oneOf("log.paFormat", ["CEF", "LEEF-legacy"]) + - grok: + source: log.paCefExtensions + patterns: + - fieldName: log.paIgnored + pattern: ^(?:[A-Za-z][A-Za-z0-9_]*=(?:\\.|[^=\\])*?[ \t]+)*?panOSTrafficSessionID= + - fieldName: log.panOSTrafficSessionID + pattern: (?:\\.|[^=\\])*? + - fieldName: log.paSuffix + pattern: (?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) + where: oneOf("log.paFormat", ["CEF", "LEEF-legacy"]) + - grok: + source: log.paCefExtensions + patterns: + - fieldName: log.paIgnored + pattern: ^(?:[A-Za-z][A-Za-z0-9_]*=(?:\\.|[^=\\])*?[ \t]+)*?panOSTunneInspectionRule= + - fieldName: log.panOSTunneInspectionRule + pattern: (?:\\.|[^=\\])*? + - fieldName: log.paSuffix + pattern: (?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) + where: oneOf("log.paFormat", ["CEF", "LEEF-legacy"]) + - grok: + source: log.paCefExtensions + patterns: + - fieldName: log.paIgnored + pattern: ^(?:[A-Za-z][A-Za-z0-9_]*=(?:\\.|[^=\\])*?[ \t]+)*?panOSTunnel= + - fieldName: log.panOSTunnel + pattern: (?:\\.|[^=\\])*? + - fieldName: log.paSuffix + pattern: (?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) + where: oneOf("log.paFormat", ["CEF", "LEEF-legacy"]) + - grok: + source: log.paCefExtensions + patterns: + - fieldName: log.paIgnored + pattern: ^(?:[A-Za-z][A-Za-z0-9_]*=(?:\\.|[^=\\])*?[ \t]+)*?panOSTunnelEndptID1= + - fieldName: log.panOSTunnelEndptID1 + pattern: (?:\\.|[^=\\])*? + - fieldName: log.paSuffix + pattern: (?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) + where: oneOf("log.paFormat", ["CEF", "LEEF-legacy"]) + - grok: + source: log.paCefExtensions + patterns: + - fieldName: log.paIgnored + pattern: ^(?:[A-Za-z][A-Za-z0-9_]*=(?:\\.|[^=\\])*?[ \t]+)*?panOSTunnelEndptID2= + - fieldName: log.panOSTunnelEndptID2 + pattern: (?:\\.|[^=\\])*? + - fieldName: log.paSuffix + pattern: (?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) + where: oneOf("log.paFormat", ["CEF", "LEEF-legacy"]) + - grok: + source: log.paCefExtensions + patterns: + - fieldName: log.paIgnored + pattern: ^(?:[A-Za-z][A-Za-z0-9_]*=(?:\\.|[^=\\])*?[ \t]+)*?panOSTunnelFragment= + - fieldName: log.panOSTunnelFragment + pattern: (?:\\.|[^=\\])*? + - fieldName: log.paSuffix + pattern: (?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) + where: oneOf("log.paFormat", ["CEF", "LEEF-legacy"]) + - grok: + source: log.paCefExtensions + patterns: + - fieldName: log.paIgnored + pattern: ^(?:[A-Za-z][A-Za-z0-9_]*=(?:\\.|[^=\\])*?[ \t]+)*?panOSTunnelID= + - fieldName: log.panOSTunnelID + pattern: (?:\\.|[^=\\])*? + - fieldName: log.paSuffix + pattern: (?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) + where: oneOf("log.paFormat", ["CEF", "LEEF-legacy"]) + - grok: + source: log.paCefExtensions + patterns: + - fieldName: log.paIgnored + pattern: ^(?:[A-Za-z][A-Za-z0-9_]*=(?:\\.|[^=\\])*?[ \t]+)*?panOSTunnelInspectionRule= + - fieldName: log.panOSTunnelInspectionRule + pattern: (?:\\.|[^=\\])*? + - fieldName: log.paSuffix + pattern: (?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) + where: oneOf("log.paFormat", ["CEF", "LEEF-legacy"]) + - grok: + source: log.paCefExtensions + patterns: + - fieldName: log.paIgnored + pattern: ^(?:[A-Za-z][A-Za-z0-9_]*=(?:\\.|[^=\\])*?[ \t]+)*?panOSTunnelType= + - fieldName: log.panOSTunnelType + pattern: (?:\\.|[^=\\])*? + - fieldName: log.paSuffix + pattern: (?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) + where: oneOf("log.paFormat", ["CEF", "LEEF-legacy"]) + - grok: + source: log.paCefExtensions + patterns: + - fieldName: log.paIgnored + pattern: ^(?:[A-Za-z][A-Za-z0-9_]*=(?:\\.|[^=\\])*?[ \t]+)*?panOSUGFlags= + - fieldName: log.panOSUGFlags + pattern: (?:\\.|[^=\\])*? + - fieldName: log.paSuffix + pattern: (?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) + where: oneOf("log.paFormat", ["CEF", "LEEF-legacy"]) + - grok: + source: log.paCefExtensions + patterns: + - fieldName: log.paIgnored + pattern: ^(?:[A-Za-z][A-Za-z0-9_]*=(?:\\.|[^=\\])*?[ \t]+)*?panOSURLCatList= + - fieldName: log.panOSURLCatList + pattern: (?:\\.|[^=\\])*? + - fieldName: log.paSuffix + pattern: (?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) + where: oneOf("log.paFormat", ["CEF", "LEEF-legacy"]) + - grok: + source: log.paCefExtensions + patterns: + - fieldName: log.paIgnored + pattern: ^(?:[A-Za-z][A-Za-z0-9_]*=(?:\\.|[^=\\])*?[ \t]+)*?panOSUserBySource= + - fieldName: log.panOSUserBySource + pattern: (?:\\.|[^=\\])*? + - fieldName: log.paSuffix + pattern: (?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) + where: oneOf("log.paFormat", ["CEF", "LEEF-legacy"]) + - grok: + source: log.paCefExtensions + patterns: + - fieldName: log.paIgnored + pattern: ^(?:[A-Za-z][A-Za-z0-9_]*=(?:\\.|[^=\\])*?[ \t]+)*?panOSVirtualSystem= + - fieldName: log.panOSVirtualSystem + pattern: (?:\\.|[^=\\])*? + - fieldName: log.paSuffix + pattern: (?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) + where: oneOf("log.paFormat", ["CEF", "LEEF-legacy"]) + - grok: + source: log.paCefExtensions + patterns: + - fieldName: log.paIgnored + pattern: ^(?:[A-Za-z][A-Za-z0-9_]*=(?:\\.|[^=\\])*?[ \t]+)*?panOSVsysName= + - fieldName: log.panOSVsysName + pattern: (?:\\.|[^=\\])*? + - fieldName: log.paSuffix + pattern: (?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) + where: oneOf("log.paFormat", ["CEF", "LEEF-legacy"]) + - grok: + source: log.paCefExtensions + patterns: + - fieldName: log.paIgnored + pattern: ^(?:[A-Za-z][A-Za-z0-9_]*=(?:\\.|[^=\\])*?[ \t]+)*?panOSXForwarderfor= + - fieldName: log.panOSXForwarderfor + pattern: (?:\\.|[^=\\])*? + - fieldName: log.paSuffix + pattern: (?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) + where: oneOf("log.paFormat", ["CEF", "LEEF-legacy"]) + - grok: + source: log.paCefExtensions + patterns: + - fieldName: log.paIgnored + pattern: ^(?:[A-Za-z][A-Za-z0-9_]*=(?:\\.|[^=\\])*?[ \t]+)*?panPODName= + - fieldName: log.panPODName + pattern: (?:\\.|[^=\\])*? + - fieldName: log.paSuffix + pattern: (?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) + where: oneOf("log.paFormat", ["CEF", "LEEF-legacy"]) + - grok: + source: log.paCefExtensions + patterns: + - fieldName: log.paIgnored + pattern: ^(?:[A-Za-z][A-Za-z0-9_]*=(?:\\.|[^=\\])*?[ \t]+)*?panPODNamespace= + - fieldName: log.panPODNamespace + pattern: (?:\\.|[^=\\])*? + - fieldName: log.paSuffix + pattern: (?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) + where: oneOf("log.paFormat", ["CEF", "LEEF-legacy"]) + - grok: + source: log.paCefExtensions + patterns: + - fieldName: log.paIgnored + pattern: ^(?:[A-Za-z][A-Za-z0-9_]*=(?:\\.|[^=\\])*?[ \t]+)*?panPartialHash= + - fieldName: log.panPartialHash + pattern: (?:\\.|[^=\\])*? + - fieldName: log.paSuffix + pattern: (?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) + where: oneOf("log.paFormat", ["CEF", "LEEF-legacy"]) + - grok: + source: log.paCefExtensions + patterns: + - fieldName: log.paIgnored + pattern: ^(?:[A-Za-z][A-Za-z0-9_]*=(?:\\.|[^=\\])*?[ \t]+)*?panPolicyID= + - fieldName: log.panPolicyID + pattern: (?:\\.|[^=\\])*? + - fieldName: log.paSuffix + pattern: (?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) + where: oneOf("log.paFormat", ["CEF", "LEEF-legacy"]) + - grok: + source: log.paCefExtensions + patterns: + - fieldName: log.paIgnored + pattern: ^(?:[A-Za-z][A-Za-z0-9_]*=(?:\\.|[^=\\])*?[ \t]+)*?panReasonFilteringAction= + - fieldName: log.panReasonFilteringAction + pattern: (?:\\.|[^=\\])*? + - fieldName: log.paSuffix + pattern: (?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) + where: oneOf("log.paFormat", ["CEF", "LEEF-legacy"]) + - grok: + source: log.paCefExtensions + patterns: + - fieldName: log.paIgnored + pattern: ^(?:[A-Za-z][A-Za-z0-9_]*=(?:\\.|[^=\\])*?[ \t]+)*?panSDWANCluster= + - fieldName: log.panSDWANCluster + pattern: (?:\\.|[^=\\])*? + - fieldName: log.paSuffix + pattern: (?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) + where: oneOf("log.paFormat", ["CEF", "LEEF-legacy"]) + - grok: + source: log.paCefExtensions + patterns: + - fieldName: log.paIgnored + pattern: ^(?:[A-Za-z][A-Za-z0-9_]*=(?:\\.|[^=\\])*?[ \t]+)*?panSDWANClustype= + - fieldName: log.panSDWANClustype + pattern: (?:\\.|[^=\\])*? + - fieldName: log.paSuffix + pattern: (?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) + where: oneOf("log.paFormat", ["CEF", "LEEF-legacy"]) + - grok: + source: log.paCefExtensions + patterns: + - fieldName: log.paIgnored + pattern: ^(?:[A-Za-z][A-Za-z0-9_]*=(?:\\.|[^=\\])*?[ \t]+)*?panSDWANDevice= + - fieldName: log.panSDWANDevice + pattern: (?:\\.|[^=\\])*? + - fieldName: log.paSuffix + pattern: (?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) + where: oneOf("log.paFormat", ["CEF", "LEEF-legacy"]) + - grok: + source: log.paCefExtensions + patterns: + - fieldName: log.paIgnored + pattern: ^(?:[A-Za-z][A-Za-z0-9_]*=(?:\\.|[^=\\])*?[ \t]+)*?panSDWANSite= + - fieldName: log.panSDWANSite + pattern: (?:\\.|[^=\\])*? + - fieldName: log.paSuffix + pattern: (?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) + where: oneOf("log.paFormat", ["CEF", "LEEF-legacy"]) + - grok: + source: log.paCefExtensions + patterns: + - fieldName: log.paIgnored + pattern: ^(?:[A-Za-z][A-Za-z0-9_]*=(?:\\.|[^=\\])*?[ \t]+)*?panSrcDAG= + - fieldName: log.panSrcDAG + pattern: (?:\\.|[^=\\])*? + - fieldName: log.paSuffix + pattern: (?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) + where: oneOf("log.paFormat", ["CEF", "LEEF-legacy"]) + - grok: + source: log.paCefExtensions + patterns: + - fieldName: log.paIgnored + pattern: ^(?:[A-Za-z][A-Za-z0-9_]*=(?:\\.|[^=\\])*?[ \t]+)*?panSrcDeviceCat= + - fieldName: log.panSrcDeviceCat + pattern: (?:\\.|[^=\\])*? + - fieldName: log.paSuffix + pattern: (?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) + where: oneOf("log.paFormat", ["CEF", "LEEF-legacy"]) + - grok: + source: log.paCefExtensions + patterns: + - fieldName: log.paIgnored + pattern: ^(?:[A-Za-z][A-Za-z0-9_]*=(?:\\.|[^=\\])*?[ \t]+)*?panSrcDeviceModel= + - fieldName: log.panSrcDeviceModel + pattern: (?:\\.|[^=\\])*? + - fieldName: log.paSuffix + pattern: (?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) + where: oneOf("log.paFormat", ["CEF", "LEEF-legacy"]) + - grok: + source: log.paCefExtensions + patterns: + - fieldName: log.paIgnored + pattern: ^(?:[A-Za-z][A-Za-z0-9_]*=(?:\\.|[^=\\])*?[ \t]+)*?panSrcDeviceOS= + - fieldName: log.panSrcDeviceOS + pattern: (?:\\.|[^=\\])*? + - fieldName: log.paSuffix + pattern: (?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) + where: oneOf("log.paFormat", ["CEF", "LEEF-legacy"]) + - grok: + source: log.paCefExtensions + patterns: + - fieldName: log.paIgnored + pattern: ^(?:[A-Za-z][A-Za-z0-9_]*=(?:\\.|[^=\\])*?[ \t]+)*?panSrcDeviceOSv= + - fieldName: log.panSrcDeviceOSv + pattern: (?:\\.|[^=\\])*? + - fieldName: log.paSuffix + pattern: (?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) + where: oneOf("log.paFormat", ["CEF", "LEEF-legacy"]) + - grok: + source: log.paCefExtensions + patterns: + - fieldName: log.paIgnored + pattern: ^(?:[A-Za-z][A-Za-z0-9_]*=(?:\\.|[^=\\])*?[ \t]+)*?panSrcDeviceProf= + - fieldName: log.panSrcDeviceProf + pattern: (?:\\.|[^=\\])*? + - fieldName: log.paSuffix + pattern: (?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) + where: oneOf("log.paFormat", ["CEF", "LEEF-legacy"]) + - grok: + source: log.paCefExtensions + patterns: + - fieldName: log.paIgnored + pattern: ^(?:[A-Za-z][A-Za-z0-9_]*=(?:\\.|[^=\\])*?[ \t]+)*?panSrcDeviceVendor= + - fieldName: log.panSrcDeviceVendor + pattern: (?:\\.|[^=\\])*? + - fieldName: log.paSuffix + pattern: (?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) + where: oneOf("log.paFormat", ["CEF", "LEEF-legacy"]) + - grok: + source: log.paCefExtensions + patterns: + - fieldName: log.paIgnored + pattern: ^(?:[A-Za-z][A-Za-z0-9_]*=(?:\\.|[^=\\])*?[ \t]+)*?panSrcEDL= + - fieldName: log.panSrcEDL + pattern: (?:\\.|[^=\\])*? + - fieldName: log.paSuffix + pattern: (?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) + where: oneOf("log.paFormat", ["CEF", "LEEF-legacy"]) + - grok: + source: log.paCefExtensions + patterns: + - fieldName: log.paIgnored + pattern: ^(?:[A-Za-z][A-Za-z0-9_]*=(?:\\.|[^=\\])*?[ \t]+)*?panSrcHostname= + - fieldName: log.panSrcHostname + pattern: (?:\\.|[^=\\])*? + - fieldName: log.paSuffix + pattern: (?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) + where: oneOf("log.paFormat", ["CEF", "LEEF-legacy"]) + - grok: + source: log.paCefExtensions + patterns: + - fieldName: log.paIgnored + pattern: ^(?:[A-Za-z][A-Za-z0-9_]*=(?:\\.|[^=\\])*?[ \t]+)*?panSrcMac= + - fieldName: log.panSrcMac + pattern: (?:\\.|[^=\\])*? + - fieldName: log.paSuffix + pattern: (?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) + where: oneOf("log.paFormat", ["CEF", "LEEF-legacy"]) + - grok: + source: log.paCefExtensions + patterns: + - fieldName: log.paIgnored + pattern: ^(?:[A-Za-z][A-Za-z0-9_]*=(?:\\.|[^=\\])*?[ \t]+)*?panTimeHighRes= + - fieldName: log.panTimeHighRes + pattern: (?:\\.|[^=\\])*? + - fieldName: log.paSuffix + pattern: (?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) + where: oneOf("log.paFormat", ["CEF", "LEEF-legacy"]) + - grok: + source: log.paCefExtensions + patterns: + - fieldName: log.paIgnored + pattern: ^(?:[A-Za-z][A-Za-z0-9_]*=(?:\\.|[^=\\])*?[ \t]+)*?panXFFIP= + - fieldName: log.panXFFIP + pattern: (?:\\.|[^=\\])*? + - fieldName: log.paSuffix + pattern: (?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) + where: oneOf("log.paFormat", ["CEF", "LEEF-legacy"]) + - grok: + source: log.paCefExtensions + patterns: + - fieldName: log.paIgnored + pattern: ^(?:[A-Za-z][A-Za-z0-9_]*=(?:\\.|[^=\\])*?[ \t]+)*?parent_session_idPanOSParentStartTime= + - fieldName: log.parent_session_idPanOSParentStartTime + pattern: (?:\\.|[^=\\])*? + - fieldName: log.paSuffix + pattern: (?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) + where: oneOf("log.paFormat", ["CEF", "LEEF-legacy"]) + - grok: + source: log.paCefExtensions + patterns: + - fieldName: log.paIgnored + pattern: ^(?:[A-Za-z][A-Za-z0-9_]*=(?:\\.|[^=\\])*?[ \t]+)*?partial_hashPanTimeHighRes= + - fieldName: log.partial_hashPanTimeHighRes + pattern: (?:\\.|[^=\\])*? + - fieldName: log.paSuffix + pattern: (?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) + where: oneOf("log.paFormat", ["CEF", "LEEF-legacy"]) + - grok: + source: log.paCefExtensions + patterns: + - fieldName: log.paIgnored + pattern: ^(?:[A-Za-z][A-Za-z0-9_]*=(?:\\.|[^=\\])*?[ \t]+)*?pcap_idfileHash= + - fieldName: log.pcap_idfileHash + pattern: (?:\\.|[^=\\])*? + - fieldName: log.paSuffix + pattern: (?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) + where: oneOf("log.paFormat", ["CEF", "LEEF-legacy"]) + - grok: + source: log.paCefExtensions + patterns: + - fieldName: log.paIgnored + pattern: ^(?:[A-Za-z][A-Za-z0-9_]*=(?:\\.|[^=\\])*?[ \t]+)*?pcap_idrequestMethod= + - fieldName: log.pcap_idrequestMethod + pattern: (?:\\.|[^=\\])*? + - fieldName: log.paSuffix + pattern: (?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) + where: oneOf("log.paFormat", ["CEF", "LEEF-legacy"]) + - grok: + source: log.paCefExtensions + patterns: + - fieldName: log.paIgnored + pattern: ^(?:[A-Za-z][A-Za-z0-9_]*=(?:\\.|[^=\\])*?[ \t]+)*?pod_namePanSrcEDL= + - fieldName: log.pod_namePanSrcEDL + pattern: (?:\\.|[^=\\])*? + - fieldName: log.paSuffix + pattern: (?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) + where: oneOf("log.paFormat", ["CEF", "LEEF-legacy"]) + - grok: + source: log.paCefExtensions + patterns: + - fieldName: log.paIgnored + pattern: ^(?:[A-Za-z][A-Za-z0-9_]*=(?:\\.|[^=\\])*?[ \t]+)*?pod_namespacePanOSContainerName= + - fieldName: log.pod_namespacePanOSContainerName + pattern: (?:\\.|[^=\\])*? + - fieldName: log.paSuffix + pattern: (?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) + where: oneOf("log.paFormat", ["CEF", "LEEF-legacy"]) + - grok: + source: log.paCefExtensions + patterns: + - fieldName: log.paIgnored + pattern: ^(?:[A-Za-z][A-Za-z0-9_]*=(?:\\.|[^=\\])*?[ \t]+)*?ppidPanOSHTTPHeader= + - fieldName: log.ppidPanOSHTTPHeader + pattern: (?:\\.|[^=\\])*? + - fieldName: log.paSuffix + pattern: (?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) + where: oneOf("log.paFormat", ["CEF", "LEEF-legacy"]) + - grok: + source: log.paCefExtensions + patterns: + - fieldName: log.paIgnored + pattern: ^(?:[A-Za-z][A-Za-z0-9_]*=(?:\\.|[^=\\])*?[ \t]+)*?priorityPanOSAttemptedGateways= + - fieldName: log.priorityPanOSAttemptedGateways + pattern: (?:\\.|[^=\\])*? + - fieldName: log.paSuffix + pattern: (?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) + where: oneOf("log.paFormat", ["CEF", "LEEF-legacy"]) + - grok: + source: log.paCefExtensions + patterns: + - fieldName: log.paIgnored + pattern: ^(?:[A-Za-z][A-Za-z0-9_]*=(?:\\.|[^=\\])*?[ \t]+)*?proto= + - fieldName: log.proto + pattern: (?:\\.|[^=\\])*? + - fieldName: log.paSuffix + pattern: (?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) + where: oneOf("log.paFormat", ["CEF", "LEEF-legacy"]) + - grok: + source: log.paCefExtensions + patterns: + - fieldName: log.paIgnored + pattern: ^(?:[A-Za-z][A-Za-z0-9_]*=(?:\\.|[^=\\])*?[ \t]+)*?proxy_typePanOSCertificateSerial= + - fieldName: log.proxy_typePanOSCertificateSerial + pattern: (?:\\.|[^=\\])*? + - fieldName: log.paSuffix + pattern: (?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) + where: oneOf("log.paFormat", ["CEF", "LEEF-legacy"]) + - grok: + source: log.paCefExtensions + patterns: + - fieldName: log.paIgnored + pattern: ^(?:[A-Za-z][A-Za-z0-9_]*=(?:\\.|[^=\\])*?[ \t]+)*?public_ipPanOSPublicIPv6= + - fieldName: log.public_ipPanOSPublicIPv6 + pattern: (?:\\.|[^=\\])*? + - fieldName: log.paSuffix + pattern: (?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) + where: oneOf("log.paFormat", ["CEF", "LEEF-legacy"]) + - grok: + source: log.paCefExtensions + patterns: + - fieldName: log.paIgnored + pattern: ^(?:[A-Za-z][A-Za-z0-9_]*=(?:\\.|[^=\\])*?[ \t]+)*?reason= + - fieldName: log.reason + pattern: (?:\\.|[^=\\])*? + - fieldName: log.paSuffix + pattern: (?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) + where: oneOf("log.paFormat", ["CEF", "LEEF-legacy"]) + - grok: + source: log.paCefExtensions + patterns: + - fieldName: log.paIgnored + pattern: ^(?:[A-Za-z][A-Za-z0-9_]*=(?:\\.|[^=\\])*?[ \t]+)*?reasonPanOSConnectionError= + - fieldName: log.reasonPanOSConnectionError + pattern: (?:\\.|[^=\\])*? + - fieldName: log.paSuffix + pattern: (?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) + where: oneOf("log.paFormat", ["CEF", "LEEF-legacy"]) + - grok: + source: log.paCefExtensions + patterns: + - fieldName: log.paIgnored + pattern: ^(?:[A-Za-z][A-Za-z0-9_]*=(?:\\.|[^=\\])*?[ \t]+)*?receive_timePanOSDeviceSN= + - fieldName: log.receive_timePanOSDeviceSN + pattern: (?:\\.|[^=\\])*? + - fieldName: log.paSuffix + pattern: (?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) + where: oneOf("log.paFormat", ["CEF", "LEEF-legacy"]) + - grok: + source: log.paCefExtensions + patterns: + - fieldName: log.paIgnored + pattern: ^(?:[A-Za-z][A-Za-z0-9_]*=(?:\\.|[^=\\])*?[ \t]+)*?receive_timedeviceExternalId= + - fieldName: log.receive_timedeviceExternalId + pattern: (?:\\.|[^=\\])*? + - fieldName: log.paSuffix + pattern: (?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) + where: oneOf("log.paFormat", ["CEF", "LEEF-legacy"]) + - grok: + source: log.paCefExtensions + patterns: + - fieldName: log.paIgnored + pattern: ^(?:[A-Za-z][A-Za-z0-9_]*=(?:\\.|[^=\\])*?[ \t]+)*?reportidPanOSDGl1= + - fieldName: log.reportidPanOSDGl1 + pattern: (?:\\.|[^=\\])*? + - fieldName: log.paSuffix + pattern: (?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) + where: oneOf("log.paFormat", ["CEF", "LEEF-legacy"]) + - grok: + source: log.paCefExtensions + patterns: + - fieldName: log.paIgnored + pattern: ^(?:[A-Za-z][A-Za-z0-9_]*=(?:\\.|[^=\\])*?[ \t]+)*?request= + - fieldName: log.request + pattern: (?:\\.|[^=\\])*? + - fieldName: log.paSuffix + pattern: (?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) + where: oneOf("log.paFormat", ["CEF", "LEEF-legacy"]) + - grok: + source: log.paCefExtensions + patterns: + - fieldName: log.paIgnored + pattern: ^(?:[A-Za-z][A-Za-z0-9_]*=(?:\\.|[^=\\])*?[ \t]+)*?requestClientApplication= + - fieldName: log.requestClientApplication + pattern: (?:\\.|[^=\\])*? + - fieldName: log.paSuffix + pattern: (?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) + where: oneOf("log.paFormat", ["CEF", "LEEF-legacy"]) + - grok: + source: log.paCefExtensions + patterns: + - fieldName: log.paIgnored + pattern: ^(?:[A-Za-z][A-Za-z0-9_]*=(?:\\.|[^=\\])*?[ \t]+)*?requestContext= + - fieldName: log.requestContext + pattern: (?:\\.|[^=\\])*? + - fieldName: log.paSuffix + pattern: (?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) + where: oneOf("log.paFormat", ["CEF", "LEEF-legacy"]) + - grok: + source: log.paCefExtensions + patterns: + - fieldName: log.paIgnored + pattern: ^(?:[A-Za-z][A-Za-z0-9_]*=(?:\\.|[^=\\])*?[ \t]+)*?requestMethod= + - fieldName: log.requestMethod + pattern: (?:\\.|[^=\\])*? + - fieldName: log.paSuffix + pattern: (?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) + where: oneOf("log.paFormat", ["CEF", "LEEF-legacy"]) + - grok: + source: log.paCefExtensions + patterns: + - fieldName: log.paIgnored + pattern: ^(?:[A-Za-z][A-Za-z0-9_]*=(?:\\.|[^=\\])*?[ \t]+)*?rootcn_lenPanOSSNILength= + - fieldName: log.rootcn_lenPanOSSNILength + pattern: (?:\\.|[^=\\])*? + - fieldName: log.paSuffix + pattern: (?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) + where: oneOf("log.paFormat", ["CEF", "LEEF-legacy"]) + - grok: + source: log.paCefExtensions + patterns: + - fieldName: log.paIgnored + pattern: ^(?:[A-Za-z][A-Za-z0-9_]*=(?:\\.|[^=\\])*?[ \t]+)*?rt= + - fieldName: log.rt + pattern: (?:\\.|[^=\\])*? + - fieldName: log.paSuffix + pattern: (?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) + where: oneOf("log.paFormat", ["CEF", "LEEF-legacy"]) + - grok: + source: log.paCefExtensions + patterns: + - fieldName: log.paIgnored + pattern: ^(?:[A-Za-z][A-Za-z0-9_]*=(?:\\.|[^=\\])*?[ \t]+)*?rule_uuidPanOSClientToFirewall= + - fieldName: log.rule_uuidPanOSClientToFirewall + pattern: (?:\\.|[^=\\])*? + - fieldName: log.paSuffix + pattern: (?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) + where: oneOf("log.paFormat", ["CEF", "LEEF-legacy"]) + - grok: + source: log.paCefExtensions + patterns: + - fieldName: log.paIgnored + pattern: ^(?:[A-Za-z][A-Za-z0-9_]*=(?:\\.|[^=\\])*?[ \t]+)*?rule_uuidPanOSTimeGeneratedHighResolution= + - fieldName: log.rule_uuidPanOSTimeGeneratedHighResolution + pattern: (?:\\.|[^=\\])*? + - fieldName: log.paSuffix + pattern: (?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) + where: oneOf("log.paFormat", ["CEF", "LEEF-legacy"]) + - grok: + source: log.paCefExtensions + patterns: + - fieldName: log.paIgnored + pattern: ^(?:[A-Za-z][A-Za-z0-9_]*=(?:\\.|[^=\\])*?[ \t]+)*?rulesuser= + - fieldName: log.rulesuser + pattern: (?:\\.|[^=\\])*? + - fieldName: log.paSuffix + pattern: (?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) + where: oneOf("log.paFormat", ["CEF", "LEEF-legacy"]) + - grok: + source: log.paCefExtensions + patterns: + - fieldName: log.paIgnored + pattern: ^(?:[A-Za-z][A-Za-z0-9_]*=(?:\\.|[^=\\])*?[ \t]+)*?selection_typePanOSSSLResponseTime= + - fieldName: log.selection_typePanOSSSLResponseTime + pattern: (?:\\.|[^=\\])*? + - fieldName: log.paSuffix + pattern: (?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) + where: oneOf("log.paFormat", ["CEF", "LEEF-legacy"]) + - grok: + source: log.paCefExtensions + patterns: + - fieldName: log.paIgnored + pattern: ^(?:[A-Za-z][A-Za-z0-9_]*=(?:\\.|[^=\\])*?[ \t]+)*?seqnoPanOSActionFlags= + - fieldName: log.seqnoPanOSActionFlags + pattern: (?:\\.|[^=\\])*? + - fieldName: log.paSuffix + pattern: (?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) + where: oneOf("log.paFormat", ["CEF", "LEEF-legacy"]) + - grok: + source: log.paCefExtensions + patterns: + - fieldName: log.paIgnored + pattern: ^(?:[A-Za-z][A-Za-z0-9_]*=(?:\\.|[^=\\])*?[ \t]+)*?serialPanOSLogTimeStamp= + - fieldName: log.serialPanOSLogTimeStamp + pattern: (?:\\.|[^=\\])*? + - fieldName: log.paSuffix + pattern: (?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) + where: oneOf("log.paFormat", ["CEF", "LEEF-legacy"]) + - grok: + source: log.paCefExtensions + patterns: + - fieldName: log.paIgnored + pattern: ^(?:[A-Za-z][A-Za-z0-9_]*=(?:\\.|[^=\\])*?[ \t]+)*?serialnumberPanDomainEDL= + - fieldName: log.serialnumberPanDomainEDL + pattern: (?:\\.|[^=\\])*? + - fieldName: log.paSuffix + pattern: (?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) + where: oneOf("log.paFormat", ["CEF", "LEEF-legacy"]) + - grok: + source: log.paCefExtensions + patterns: + - fieldName: log.paIgnored + pattern: ^(?:[A-Za-z][A-Za-z0-9_]*=(?:\\.|[^=\\])*?[ \t]+)*?severity= + - fieldName: log.severity + pattern: (?:\\.|[^=\\])*? + - fieldName: log.paSuffix + pattern: (?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) + where: oneOf("log.paFormat", ["CEF", "LEEF-legacy"]) + - grok: + source: log.paCefExtensions + patterns: + - fieldName: log.paIgnored + pattern: ^(?:[A-Za-z][A-Za-z0-9_]*=(?:\\.|[^=\\])*?[ \t]+)*?shost= + - fieldName: log.shost + pattern: (?:\\.|[^=\\])*? + - fieldName: log.paSuffix + pattern: (?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) + where: oneOf("log.paFormat", ["CEF", "LEEF-legacy"]) + - grok: + source: log.paCefExtensions + patterns: + - fieldName: log.paIgnored + pattern: ^(?:[A-Za-z][A-Za-z0-9_]*=(?:\\.|[^=\\])*?[ \t]+)*?sni_lenPanOSErrorMessage= + - fieldName: log.sni_lenPanOSErrorMessage + pattern: (?:\\.|[^=\\])*? + - fieldName: log.paSuffix + pattern: (?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) + where: oneOf("log.paFormat", ["CEF", "LEEF-legacy"]) + - grok: + source: log.paCefExtensions + patterns: + - fieldName: log.paIgnored + pattern: ^(?:[A-Za-z][A-Za-z0-9_]*=(?:\\.|[^=\\])*?[ \t]+)*?sourceTranslatedAddress= + - fieldName: log.sourceTranslatedAddress + pattern: (?:\\.|[^=\\])*? + - fieldName: log.paSuffix + pattern: (?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) + where: oneOf("log.paFormat", ["CEF", "LEEF-legacy"]) + - grok: + source: log.paCefExtensions + patterns: + - fieldName: log.paIgnored + pattern: ^(?:[A-Za-z][A-Za-z0-9_]*=(?:\\.|[^=\\])*?[ \t]+)*?sourceTranslatedPort= + - fieldName: log.sourceTranslatedPort + pattern: (?:\\.|[^=\\])*? + - fieldName: log.paSuffix + pattern: (?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) + where: oneOf("log.paFormat", ["CEF", "LEEF-legacy"]) + - grok: + source: log.paCefExtensions + patterns: + - fieldName: log.paIgnored + pattern: ^(?:[A-Za-z][A-Za-z0-9_]*=(?:\\.|[^=\\])*?[ \t]+)*?spt= + - fieldName: log.spt + pattern: (?:\\.|[^=\\])*? + - fieldName: log.paSuffix + pattern: (?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) + where: oneOf("log.paFormat", ["CEF", "LEEF-legacy"]) + - grok: + source: log.paCefExtensions + patterns: + - fieldName: log.paIgnored + pattern: ^(?:[A-Za-z][A-Za-z0-9_]*=(?:\\.|[^=\\])*?[ \t]+)*?src= + - fieldName: log.src + pattern: (?:\\.|[^=\\])*? + - fieldName: log.paSuffix + pattern: (?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) + where: oneOf("log.paFormat", ["CEF", "LEEF-legacy"]) + - grok: + source: log.paCefExtensions + patterns: + - fieldName: log.paIgnored + pattern: ^(?:[A-Za-z][A-Za-z0-9_]*=(?:\\.|[^=\\])*?[ \t]+)*?src_categoryPanOSSourceDeviceProfile= + - fieldName: log.src_categoryPanOSSourceDeviceProfile + pattern: (?:\\.|[^=\\])*? + - fieldName: log.paSuffix + pattern: (?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) + where: oneOf("log.paFormat", ["CEF", "LEEF-legacy"]) + - grok: + source: log.paCefExtensions + patterns: + - fieldName: log.paIgnored + pattern: ^(?:[A-Za-z][A-Za-z0-9_]*=(?:\\.|[^=\\])*?[ \t]+)*?src_categoryPanSrcDeviceProf= + - fieldName: log.src_categoryPanSrcDeviceProf + pattern: (?:\\.|[^=\\])*? + - fieldName: log.paSuffix + pattern: (?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) + where: oneOf("log.paFormat", ["CEF", "LEEF-legacy"]) + - grok: + source: log.paCefExtensions + patterns: + - fieldName: log.paIgnored + pattern: ^(?:[A-Za-z][A-Za-z0-9_]*=(?:\\.|[^=\\])*?[ \t]+)*?src_hostPanOSSourceDeviceMac= + - fieldName: log.src_hostPanOSSourceDeviceMac + pattern: (?:\\.|[^=\\])*? + - fieldName: log.paSuffix + pattern: (?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) + where: oneOf("log.paFormat", ["CEF", "LEEF-legacy"]) + - grok: + source: log.paCefExtensions + patterns: + - fieldName: log.paIgnored + pattern: ^(?:[A-Za-z][A-Za-z0-9_]*=(?:\\.|[^=\\])*?[ \t]+)*?src_hostPanSrcMac= + - fieldName: log.src_hostPanSrcMac + pattern: (?:\\.|[^=\\])*? + - fieldName: log.paSuffix + pattern: (?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) + where: oneOf("log.paFormat", ["CEF", "LEEF-legacy"]) + - grok: + source: log.paCefExtensions + patterns: + - fieldName: log.paIgnored + pattern: ^(?:[A-Za-z][A-Za-z0-9_]*=(?:\\.|[^=\\])*?[ \t]+)*?src_macPanOSTrafficOriginRegion= + - fieldName: log.src_macPanOSTrafficOriginRegion + pattern: (?:\\.|[^=\\])*? + - fieldName: log.paSuffix + pattern: (?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) + where: oneOf("log.paFormat", ["CEF", "LEEF-legacy"]) + - grok: + source: log.paCefExtensions + patterns: + - fieldName: log.paIgnored + pattern: ^(?:[A-Za-z][A-Za-z0-9_]*=(?:\\.|[^=\\])*?[ \t]+)*?src_modelPanOSSourceDeviceVendor= + - fieldName: log.src_modelPanOSSourceDeviceVendor + pattern: (?:\\.|[^=\\])*? + - fieldName: log.paSuffix + pattern: (?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) + where: oneOf("log.paFormat", ["CEF", "LEEF-legacy"]) + - grok: + source: log.paCefExtensions + patterns: + - fieldName: log.paIgnored + pattern: ^(?:[A-Za-z][A-Za-z0-9_]*=(?:\\.|[^=\\])*?[ \t]+)*?src_modelPanSrcDeviceVendor= + - fieldName: log.src_modelPanSrcDeviceVendor + pattern: (?:\\.|[^=\\])*? + - fieldName: log.paSuffix + pattern: (?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) + where: oneOf("log.paFormat", ["CEF", "LEEF-legacy"]) + - grok: + source: log.paCefExtensions + patterns: + - fieldName: log.paIgnored + pattern: ^(?:[A-Za-z][A-Za-z0-9_]*=(?:\\.|[^=\\])*?[ \t]+)*?src_osfamilyPanOSSourceDeviceOSVersion= + - fieldName: log.src_osfamilyPanOSSourceDeviceOSVersion + pattern: (?:\\.|[^=\\])*? + - fieldName: log.paSuffix + pattern: (?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) + where: oneOf("log.paFormat", ["CEF", "LEEF-legacy"]) + - grok: + source: log.paCefExtensions + patterns: + - fieldName: log.paIgnored + pattern: ^(?:[A-Za-z][A-Za-z0-9_]*=(?:\\.|[^=\\])*?[ \t]+)*?src_osversionPanSrcHostname= + - fieldName: log.src_osversionPanSrcHostname + pattern: (?:\\.|[^=\\])*? + - fieldName: log.paSuffix + pattern: (?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) + where: oneOf("log.paFormat", ["CEF", "LEEF-legacy"]) + - grok: + source: log.paCefExtensions + patterns: + - fieldName: log.paIgnored + pattern: ^(?:[A-Za-z][A-Za-z0-9_]*=(?:\\.|[^=\\])*?[ \t]+)*?src_uuidPanOSDstUUID= + - fieldName: log.src_uuidPanOSDstUUID + pattern: (?:\\.|[^=\\])*? + - fieldName: log.paSuffix + pattern: (?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) + where: oneOf("log.paFormat", ["CEF", "LEEF-legacy"]) + - grok: + source: log.paCefExtensions + patterns: + - fieldName: log.paIgnored + pattern: ^(?:[A-Za-z][A-Za-z0-9_]*=(?:\\.|[^=\\])*?[ \t]+)*?src_vendorPanSrcDeviceOS= + - fieldName: log.src_vendorPanSrcDeviceOS + pattern: (?:\\.|[^=\\])*? + - fieldName: log.paSuffix + pattern: (?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) + where: oneOf("log.paFormat", ["CEF", "LEEF-legacy"]) + - grok: + source: log.paCefExtensions + patterns: + - fieldName: log.paIgnored + pattern: ^(?:[A-Za-z][A-Za-z0-9_]*=(?:\\.|[^=\\])*?[ \t]+)*?srccnt= + - fieldName: log.srccnt + pattern: (?:\\.|[^=\\])*? + - fieldName: log.paSuffix + pattern: (?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) + where: oneOf("log.paFormat", ["CEF", "LEEF-legacy"]) + - grok: + source: log.paCefExtensions + patterns: + - fieldName: log.paIgnored + pattern: ^(?:[A-Za-z][A-Za-z0-9_]*=(?:\\.|[^=\\])*?[ \t]+)*?srcdst= + - fieldName: log.srcdst + pattern: (?:\\.|[^=\\])*? + - fieldName: log.paSuffix + pattern: (?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) + where: oneOf("log.paFormat", ["CEF", "LEEF-legacy"]) + - grok: + source: log.paCefExtensions + patterns: + - fieldName: log.paIgnored + pattern: ^(?:[A-Za-z][A-Za-z0-9_]*=(?:\\.|[^=\\])*?[ \t]+)*?srcuserPanOSSourceRegion= + - fieldName: log.srcuserPanOSSourceRegion + pattern: (?:\\.|[^=\\])*? + - fieldName: log.paSuffix + pattern: (?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) + where: oneOf("log.paFormat", ["CEF", "LEEF-legacy"]) + - grok: + source: log.paCefExtensions + patterns: + - fieldName: log.paIgnored + pattern: ^(?:[A-Za-z][A-Za-z0-9_]*=(?:\\.|[^=\\])*?[ \t]+)*?stagePanOSAuthMethod= + - fieldName: log.stagePanOSAuthMethod + pattern: (?:\\.|[^=\\])*? + - fieldName: log.paSuffix + pattern: (?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) + where: oneOf("log.paFormat", ["CEF", "LEEF-legacy"]) + - grok: + source: log.paCefExtensions + patterns: + - fieldName: log.paIgnored + pattern: ^(?:[A-Za-z][A-Za-z0-9_]*=(?:\\.|[^=\\])*?[ \t]+)*?start= + - fieldName: log.start + pattern: (?:\\.|[^=\\])*? + - fieldName: log.paSuffix + pattern: (?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) + where: oneOf("log.paFormat", ["CEF", "LEEF-legacy"]) + - grok: + source: log.paCefExtensions + patterns: + - fieldName: log.paIgnored + pattern: ^(?:[A-Za-z][A-Za-z0-9_]*=(?:\\.|[^=\\])*?[ \t]+)*?statusPanOSGPGatewayLocation= + - fieldName: log.statusPanOSGPGatewayLocation + pattern: (?:\\.|[^=\\])*? + - fieldName: log.paSuffix + pattern: (?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) + where: oneOf("log.paFormat", ["CEF", "LEEF-legacy"]) + - grok: + source: log.paCefExtensions + patterns: + - fieldName: log.paIgnored + pattern: ^(?:[A-Za-z][A-Za-z0-9_]*=(?:\\.|[^=\\])*?[ \t]+)*?suid= + - fieldName: log.suid + pattern: (?:\\.|[^=\\])*? + - fieldName: log.paSuffix + pattern: (?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) + where: oneOf("log.paFormat", ["CEF", "LEEF-legacy"]) + - grok: + source: log.paCefExtensions + patterns: + - fieldName: log.paIgnored + pattern: ^(?:[A-Za-z][A-Za-z0-9_]*=(?:\\.|[^=\\])*?[ \t]+)*?suser= + - fieldName: log.suser + pattern: (?:\\.|[^=\\])*? + - fieldName: log.paSuffix + pattern: (?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) + where: oneOf("log.paFormat", ["CEF", "LEEF-legacy"]) + - grok: + source: log.paCefExtensions + patterns: + - fieldName: log.paIgnored + pattern: ^(?:[A-Za-z][A-Za-z0-9_]*=(?:\\.|[^=\\])*?[ \t]+)*?tag_namePanOSEventID= + - fieldName: log.tag_namePanOSEventID + pattern: (?:\\.|[^=\\])*? + - fieldName: log.paSuffix + pattern: (?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) + where: oneOf("log.paFormat", ["CEF", "LEEF-legacy"]) + - grok: + source: log.paCefExtensions + patterns: + - fieldName: log.paIgnored + pattern: ^(?:[A-Za-z][A-Za-z0-9_]*=(?:\\.|[^=\\])*?[ \t]+)*?thr_categoryPanOSContentVer= + - fieldName: log.thr_categoryPanOSContentVer + pattern: (?:\\.|[^=\\])*? + - fieldName: log.paSuffix + pattern: (?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) + where: oneOf("log.paFormat", ["CEF", "LEEF-legacy"]) + - grok: + source: log.paCefExtensions + patterns: + - fieldName: log.paIgnored + pattern: ^(?:[A-Za-z][A-Za-z0-9_]*=(?:\\.|[^=\\])*?[ \t]+)*?tls_authPanOSPolicyName= + - fieldName: log.tls_authPanOSPolicyName + pattern: (?:\\.|[^=\\])*? + - fieldName: log.paSuffix + pattern: (?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) + where: oneOf("log.paFormat", ["CEF", "LEEF-legacy"]) + - grok: + source: log.paCefExtensions + patterns: + - fieldName: log.paIgnored + pattern: ^(?:[A-Za-z][A-Za-z0-9_]*=(?:\\.|[^=\\])*?[ \t]+)*?tls_versionPanOSTLSKeyExchange= + - fieldName: log.tls_versionPanOSTLSKeyExchange + pattern: (?:\\.|[^=\\])*? + - fieldName: log.paSuffix + pattern: (?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) + where: oneOf("log.paFormat", ["CEF", "LEEF-legacy"]) + - grok: + source: log.paCefExtensions + patterns: + - fieldName: log.paIgnored + pattern: ^(?:[A-Za-z][A-Za-z0-9_]*=(?:\\.|[^=\\])*?[ \t]+)*?todeviceInboundInterface= + - fieldName: log.todeviceInboundInterface + pattern: (?:\\.|[^=\\])*? + - fieldName: log.paSuffix + pattern: (?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) + where: oneOf("log.paFormat", ["CEF", "LEEF-legacy"]) + - grok: + source: log.paCefExtensions + patterns: + - fieldName: log.paIgnored + pattern: ^(?:[A-Za-z][A-Za-z0-9_]*=(?:\\.|[^=\\])*?[ \t]+)*?tunnelPanOSThreatCategory= + - fieldName: log.tunnelPanOSThreatCategory + pattern: (?:\\.|[^=\\])*? + - fieldName: log.paSuffix + pattern: (?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) + where: oneOf("log.paFormat", ["CEF", "LEEF-legacy"]) + - grok: + source: log.paCefExtensions + patterns: + - fieldName: log.paIgnored + pattern: ^(?:[A-Za-z][A-Za-z0-9_]*=(?:\\.|[^=\\])*?[ \t]+)*?ugflagsPanOSUserBySource= + - fieldName: log.ugflagsPanOSUserBySource + pattern: (?:\\.|[^=\\])*? + - fieldName: log.paSuffix + pattern: (?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) + where: oneOf("log.paFormat", ["CEF", "LEEF-legacy"]) + - grok: + source: log.paCefExtensions + patterns: + - fieldName: log.paIgnored + pattern: ^(?:[A-Za-z][A-Za-z0-9_]*=(?:\\.|[^=\\])*?[ \t]+)*?url_category_listPanOSHTTP2Con= + - fieldName: log.url_category_listPanOSHTTP2Con + pattern: (?:\\.|[^=\\])*? + - fieldName: log.paSuffix + pattern: (?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) + where: oneOf("log.paFormat", ["CEF", "LEEF-legacy"]) + - grok: + source: log.paCefExtensions + patterns: + - fieldName: log.paIgnored + pattern: ^(?:[A-Za-z][A-Za-z0-9_]*=(?:\\.|[^=\\])*?[ \t]+)*?userexternalId= + - fieldName: log.userexternalId + pattern: (?:\\.|[^=\\])*? + - fieldName: log.paSuffix + pattern: (?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) + where: oneOf("log.paFormat", ["CEF", "LEEF-legacy"]) + - grok: + source: log.paCefExtensions + patterns: + - fieldName: log.paIgnored + pattern: ^(?:[A-Za-z][A-Za-z0-9_]*=(?:\\.|[^=\\])*?[ \t]+)*?xffPanOSReferer= + - fieldName: log.xffPanOSReferer + pattern: (?:\\.|[^=\\])*? + - fieldName: log.paSuffix + pattern: (?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) + where: oneOf("log.paFormat", ["CEF", "LEEF-legacy"]) + - grok: + source: log.paCefExtensions + patterns: + - fieldName: log.paIgnored + pattern: ^(?:[A-Za-z][A-Za-z0-9_]*=(?:\\.|[^=\\])*?[ \t]+)*?xff_ipPanSrcDeviceCat= + - fieldName: log.xff_ipPanSrcDeviceCat + pattern: (?:\\.|[^=\\])*? + - fieldName: log.paSuffix + pattern: (?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) + where: oneOf("log.paFormat", ["CEF", "LEEF-legacy"]) + - csv: + source: log.paPayload + separator: ',' + headers: + - log.future_use + - log.receive_time + - log.serial + - log.pa_type + - log.pa_subtype + - log.future_use + - log.time_generated + - log.src + - log.dst + - log.natsrc + - log.natdst + - log.rule + - log.srcuser + - log.dstuser + - log.app + - log.vsys + - log.from + - log.to + - log.inbound_if + - log.outbound_if + - log.logset + - log.future_use + - log.sessionid + - log.repeatcnt + - log.spt + - log.dpt + - log.natspt + - log.natdpt + - log.flags + - log.proto + - log.act + - log.bytes + - log.bytes_sent + - log.bytes_received + - log.packets + - log.start + - log.elapsed + - log.category + - log.future_use + - log.seqno + - log.actionflags + - log.srcloc + - log.dstloc + - log.future_use + - log.pkts_sent + - log.pkts_received + - log.session_end_reason + - log.dg_hier_level_1 + - log.dg_hier_level_2 + - log.dg_hier_level_3 + - log.dg_hier_level_4 + - log.vsys_name + - log.device_name + - log.action_source + - log.src_uuid + - log.dst_uuid + - log.tunnelid_imsi + - log.monitortag_imei + - log.parent_session_id + - log.parent_start_time + - log.tunnel + - log.assoc_id + - log.chunks + - log.chunks_sent + - log.chunks_received + - log.rule_uuid + - log.http2_connection + - log.link_change_count + - log.policy_id + - log.link_switches + - log.sdwan_cluster + - log.sdwan_device_type + - log.sdwan_cluster_type + - log.sdwan_site + - log.dynusergroup_name + - log.xff_ip + - log.src_category + - log.src_profile + - log.src_model + - log.src_vendor + - log.src_osfamily + - log.src_osversion + - log.src_host + - log.src_mac + - log.dst_category + - log.dst_profile + - log.dst_model + - log.dst_vendor + - log.dst_osfamily + - log.dst_osversion + - log.dst_host + - log.dst_mac + - log.container_id + - log.pod_namespace + - log.pod_name + - log.src_edl + - log.dst_edl + - log.hostid + - log.serialnumber + - log.src_dag + - log.dst_dag + - log.session_owner + - log.high_res_timestamp + - log.nsdsai_sst + - log.nsdsai_sd + - log.subcategory_of_app + - log.category_of_app + - log.technology_of_app + - log.risk_of_app + - log.characteristic_of_app + - log.container_of_app + - log.tunneled_app + - log.is_saas_of_app + - log.sanctioned_state_of_app + - log.offloaded + - log.flow_type + - log.cluster_name + - log.ai_traffic + - log.ai_forward_error + - log.k8s_cluster_id + - log.tcp_rtt_c2s + - log.tcp_rtt_s2c + - log.total_n_ooseq_c2s + - log.total_n_ooseq_s2c + - log.tcp_retransit_cnt_c2s + - log.tcp_retransit_cnt_s2c + - log.tcp_zero_window_cnt_c2s + - log.tcp_zero_window_cnt_s2c + - log.src_adv_devid + - log.dst_adv_devid + where: equals("log.paFormat", "CSV") && regexMatch("log.paPayload", "^[^,]*,[^,]*,[^,]*,TRAFFIC,") + - csv: + source: log.paPayload + separator: ',' + headers: + - log.future_use + - log.receive_time + - log.serial + - log.pa_type + - log.pa_subtype + - log.future_use + - log.time_generated + - log.src + - log.dst + - log.natsrc + - log.natdst + - log.rule + - log.srcuser + - log.dstuser + - log.app + - log.vsys + - log.from + - log.to + - log.inbound_if + - log.outbound_if + - log.logset + - log.future_use + - log.sessionid + - log.repeatcnt + - log.spt + - log.dpt + - log.natspt + - log.natdpt + - log.flags + - log.proto + - log.act + - log.misc + - log.pa_threatid + - log.category + - log.severityLabel + - log.direction + - log.seqno + - log.actionflags + - log.srcloc + - log.dstloc + - log.future_use + - log.contenttype + - log.pcap_id + - log.filedigest + - log.cloud + - log.url_idx + - log.user_agent + - log.filetype + - log.xff + - log.referer + - log.sender + - log.subject + - log.recipient + - log.reportid + - log.dg_hier_level_1 + - log.dg_hier_level_2 + - log.dg_hier_level_3 + - log.dg_hier_level_4 + - log.vsys_name + - log.device_name + - log.future_use + - log.src_uuid + - log.dst_uuid + - log.http_method + - log.tunnelid_imsi + - log.monitortag_imei + - log.parent_session_id + - log.parent_start_time + - log.tunnel + - log.thr_category + - log.contentver + - log.future_use + - log.assoc_id + - log.ppid + - log.http_headers + - log.url_category_list + - log.rule_uuid + - log.http2_connection + - log.dynusergroup_name + - log.xff_ip + - log.src_category + - log.src_profile + - log.src_model + - log.src_vendor + - log.src_osfamily + - log.src_osversion + - log.src_host + - log.src_mac + - log.dst_category + - log.dst_profile + - log.dst_model + - log.dst_vendor + - log.dst_osfamily + - log.dst_osversion + - log.dst_host + - log.dst_mac + - log.container_id + - log.pod_namespace + - log.pod_name + - log.src_edl + - log.dst_edl + - log.hostid + - log.serialnumber + - log.domain_edl + - log.src_dag + - log.dst_dag + - log.partial_hash + - log.high_res_timestamp + - log.reason + - log.justification + - log.nssai_sst + - log.subcategory_of_app + - log.category_of_app + - log.technology_of_app + - log.risk_of_app + - log.characteristic_of_app + - log.container_of_app + - log.tunneled_app + - log.is_saas_of_app + - log.sanctioned_state_of_app + - log.cloud_reportid + - log.flow_type + - log.cluster_name + where: equals("log.paFormat", "CSV") && regexMatch("log.paPayload", "^[^,]*,[^,]*,[^,]*,THREAT,") && !regexMatch("log.paPayload", + "^[^,]*,[^,]*,[^,]*,THREAT,(?:url|data|dlp|dlp-non-file|file),") + - csv: + source: log.paPayload + separator: ',' + headers: + - log.future_use + - log.receive_time + - log.serial + - log.pa_type + - log.pa_subtype + - log.future_use + - log.time_generated + - log.src + - log.dst + - log.natsrc + - log.natdst + - log.rule + - log.srcuser + - log.dstuser + - log.app + - log.vsys + - log.from + - log.to + - log.inbound_if + - log.outbound_if + - log.logset + - log.future_use + - log.sessionid + - log.repeatcnt + - log.spt + - log.dpt + - log.natspt + - log.natdpt + - log.flags + - log.proto + - log.act + - log.misc + - log.pa_threatid + - log.category + - log.severityLabel + - log.direction + - log.seqno + - log.actionflags + - log.srcloc + - log.dstloc + - log.future_use + - log.contenttype + - log.pcap_id + - log.filedigest + - log.cloud + - log.url_idx + - log.user_agent + - log.filetype + - log.xff + - log.referer + - log.sender + - log.subject + - log.recipient + - log.reportid + - log.dg_hier_level_1 + - log.dg_hier_level_2 + - log.dg_hier_level_3 + - log.dg_hier_level_4 + - log.vsys_name + - log.device_name + - log.future_use + - log.src_uuid + - log.dst_uuid + - log.http_method + - log.tunnelid_imsi + - log.monitortag_imei + - log.parent_session_id + - log.parent_start_time + - log.tunnel + - log.thr_category + - log.contentver + - log.future_use + - log.assoc_id + - log.ppid + - log.http_headers + - log.url_category_list + - log.rule_uuid + - log.http2_connection + - log.dynusergroup_name + - log.xff_ip + - log.src_category + - log.src_profile + - log.src_model + - log.src_vendor + - log.src_osfamily + - log.src_osversion + - log.src_host + - log.src_mac + - log.dst_category + - log.dst_profile + - log.dst_model + - log.dst_vendor + - log.dst_osfamily + - log.dst_osversion + - log.dst_host + - log.dst_mac + - log.container_id + - log.pod_namespace + - log.pod_name + - log.src_edl + - log.dst_edl + - log.hostid + - log.serialnumber + - log.domain_edl + - log.src_dag + - log.dst_dag + - log.partial_hash + - log.high_res_timestamp + - log.reason + - log.justification + - log.nssai_sst + - log.subcategory_of_app + - log.category_of_app + - log.technology_of_app + - log.risk_of_app + - log.characteristic_of_app + - log.container_of_app + - log.tunneled_app + - log.is_saas_of_app + - log.sanctioned_state_of_app + - log.cloud_reportid + - log.cluster_name + - log.flow_type + where: equals("log.paFormat", "CSV") && regexMatch("log.paPayload", "^[^,]*,[^,]*,[^,]*,THREAT,(?:data|dlp|dlp-non-file|file),") + - csv: + source: log.paPayload + separator: ',' + headers: + - log.future_use + - log.receive_time + - log.serial + - log.pa_type + - log.pa_subtype + - log.future_use + - log.time_generated + - log.src + - log.dst + - log.natsrc + - log.natdst + - log.rule + - log.srcuser + - log.dstuser + - log.app + - log.vsys + - log.from + - log.to + - log.inbound_if + - log.outbound_if + - log.logset + - log.future_use + - log.sessionid + - log.repeatcnt + - log.spt + - log.dpt + - log.natspt + - log.natdpt + - log.flags + - log.proto + - log.act + - log.misc + - log.pa_threatid + - log.category + - log.severityLabel + - log.direction + - log.seqno + - log.actionflags + - log.srcloc + - log.dstloc + - log.future_use + - log.contenttype + - log.pcap_id + - log.filedigest + - log.cloud + - log.url_idx + - log.user_agent + - log.filetype + - log.xff + - log.referer + - log.sender + - log.subject + - log.recipient + - log.reportid + - log.dg_hier_level_1 + - log.dg_hier_level_2 + - log.dg_hier_level_3 + - log.dg_hier_level_4 + - log.vsys_name + - log.device_name + - log.future_use + - log.src_uuid + - log.dst_uuid + - log.http_method + - log.tunnelid_imsi + - log.monitortag_imei + - log.parent_session_id + - log.parent_start_time + - log.tunnel + - log.thr_category + - log.contentver + - log.future_use + - log.assoc_id + - log.ppid + - log.http_headers + - log.paURLTail0 + - log.paURLTail1 + - log.paURLTail2 + - log.paURLTail3 + - log.paURLTail4 + - log.paURLTail5 + - log.paURLTail6 + - log.paURLTail7 + - log.paURLTail8 + - log.paURLTail9 + - log.paURLTail10 + - log.paURLTail11 + - log.paURLTail12 + - log.paURLTail13 + - log.paURLTail14 + - log.paURLTail15 + - log.paURLTail16 + - log.paURLTail17 + - log.paURLTail18 + - log.paURLTail19 + - log.paURLTail20 + - log.paURLTail21 + - log.paURLTail22 + - log.paURLTail23 + - log.paURLTail24 + - log.paURLTail25 + - log.paURLTail26 + - log.paURLTail27 + - log.paURLTail28 + - log.paURLTail29 + - log.paURLTail30 + - log.paURLTail31 + - log.paURLTail32 + - log.paURLTail33 + - log.paURLTail34 + - log.paURLTail35 + - log.paURLTail36 + - log.paURLTail37 + - log.paURLTail38 + - log.paURLTail39 + - log.paURLTail40 + - log.paURLTail41 + - log.paURLTail42 + - log.paURLTail43 + - log.paURLTail44 + - log.paURLTail45 + - log.paURLTail46 + - log.paURLTail47 + - log.paURLTail48 + - log.paURLTail49 + where: equals("log.paFormat", "CSV") && regexMatch("log.paPayload", "^[^,]*,[^,]*,[^,]*,THREAT,url,") + - csv: + source: log.paPayload + separator: ',' + headers: + - log.future_use + - log.receive_time + - log.serial + - log.pa_type + - log.pa_subtype + - log.future_use + - log.time_generated + - log.srcuser + - log.vsys + - log.machinename + - log.os + - log.src + - log.matchname + - log.repeatcnt + - log.matchtype + - log.future_use + - log.future_use + - log.seqno + - log.actionflags + - log.dg_hier_level_1 + - log.dg_hier_level_2 + - log.dg_hier_level_3 + - log.dg_hier_level_4 + - log.vsys_name + - log.device_name + - log.vsys_id + - log.srcipv6 + - log.hostid + - log.serialnumber + - log.mac + - log.high_res_timestamp + - log.cluster_name + where: equals("log.paFormat", "CSV") && regexMatch("log.paPayload", "^[^,]*,[^,]*,[^,]*,HIP-MATCH,") + - csv: + source: log.paPayload + separator: ',' + headers: + - log.future_use + - log.receive_time + - log.serial + - log.pa_type + - log.pa_subtype + - log.future_use + - log.time_generated + - log.vsys + - log.eventid + - log.stage + - log.auth_method + - log.tunnel_type + - log.srcuser + - log.srcregion + - log.machinename + - log.public_ip + - log.public_ipv6 + - log.private_ip + - log.private_ipv6 + - log.hostid + - log.serialnumber + - log.client_ver + - log.client_os + - log.client_os_ver + - log.repeatcnt + - log.reason + - log.error + - log.opaque + - log.status + - log.location + - log.PanOSLoginDuration + - log.connect_method + - log.error_code + - log.portal + - log.seqno + - log.actionflags + - log.high_res_timestamp + - log.selection_type + - log.response_time + - log.priority + - log.attempted_gateways + - log.gateway + - log.dg_hier_level_1 + - log.dg_hier_level_2 + - log.dg_hier_level_3 + - log.dg_hier_level_4 + - log.vsys_name + - log.device_name + - log.vsys_id + - log.cluster_name + where: equals("log.paFormat", "CSV") && regexMatch("log.paPayload", "^[^,]*,[^,]*,[^,]*,GLOBALPROTECT,") + - csv: + source: log.paPayload + separator: ',' + headers: + - log.future_use + - log.receive_time + - log.serial + - log.pa_type + - log.pa_subtype + - log.future_use + - log.time_generated + - log.vsys + - log.src + - log.tag_name + - log.eventid + - log.repeatcnt + - log.timeout + - log.datasourcename + - log.datasource_type + - log.datasource_subtype + - log.seqno + - log.actionflags + - log.dg_hier_level_1 + - log.dg_hier_level_2 + - log.dg_hier_level_3 + - log.dg_hier_level_4 + - log.vsys_name + - log.device_name + - log.vsys_id + - log.high_res_timestamp + - log.cluster_name + where: equals("log.paFormat", "CSV") && regexMatch("log.paPayload", "^[^,]*,[^,]*,[^,]*,IPTAG,") + - csv: + source: log.paPayload + separator: ',' + headers: + - log.future_use + - log.receive_time + - log.serial + - log.pa_type + - log.pa_subtype + - log.future_use + - log.time_generated + - log.vsys + - log.src + - log.user + - log.datasourcename + - log.eventid + - log.repeatcnt + - log.timeout + - log.beginport + - log.endport + - log.datasource + - log.datasource_type + - log.seqno + - log.actionflags + - log.dg_hier_level_1 + - log.dg_hier_level_2 + - log.dg_hier_level_3 + - log.dg_hier_level_4 + - log.vsys_name + - log.device_name + - log.vsys_id + - log.factortype + - log.factorcompletiontime + - log.factorno + - log.ugflags + - log.userbysource + - log.tag_name + - log.high_res_timestamp + - log.origin_data_source + - log.future_use + - log.cluster_name + where: equals("log.paFormat", "CSV") && regexMatch("log.paPayload", "^[^,]*,[^,]*,[^,]*,USERID,") + - csv: + source: log.paPayload + separator: ',' + headers: + - log.future_use + - log.receive_time + - log.serial + - log.pa_type + - log.pa_subtype + - log.config_ver + - log.time_generated + - log.src + - log.dst + - log.natsrc + - log.natdst + - log.rule + - log.srcuser + - log.dstuser + - log.app + - log.vsys + - log.from + - log.to + - log.inbound_if + - log.outbound_if + - log.logset + - log.time_received + - log.sessionid + - log.repeatcnt + - log.spt + - log.dpt + - log.natspt + - log.natdpt + - log.flags + - log.proto + - log.act + - log.tunnel + - log.future_use + - log.future_use + - log.src_uuid + - log.dst_uuid + - log.rule_uuid + - log.hs_stage_c2f + - log.hs_stage_f2s + - log.tls_version + - log.tls_keyxchg + - log.tls_enc + - log.tls_auth + - log.policy_name + - log.ec_curve + - log.err_index + - log.root_status + - log.chain_status + - log.proxy_type + - log.cert_serial + - log.fingerprint + - log.notbefore + - log.notafter + - log.cert_ver + - log.cert_size + - log.cn_len + - log.issuer_len + - log.rootcn_len + - log.sni_len + - log.cert_flags + - log.cn + - log.issuer_cn + - log.root_cn + - log.sni + - log.error + - log.container_id + - log.pod_namespace + - log.pod_name + - log.src_edl + - log.dst_edl + - log.src_dag + - log.dst_dag + - log.high_res_timestamp + - log.src_category + - log.src_profile + - log.src_model + - log.src_vendor + - log.src_osfamily + - log.src_osversion + - log.src_host + - log.src_mac + - log.dst_category + - log.dst_profile + - log.dst_model + - log.dst_vendor + - log.dst_osfamily + - log.dst_osversion + - log.dst_host + - log.dst_mac + - log.seqno + - log.actionflags + - log.dg_hier_level_1 + - log.dg_hier_level_2 + - log.dg_hier_level_3 + - log.dg_hier_level_4 + - log.vsys_name + - log.device_name + - log.vsys_id + - log.subcategory_of_app + - log.category_of_app + - log.technology_of_app + - log.risk_of_app + - log.characteristic_of_app + - log.container_of_app + - log.is_saas_of_app + - log.sanctioned_state_of_app + - log.cluster_name + where: equals("log.paFormat", "CSV") && regexMatch("log.paPayload", "^[^,]*,[^,]*,[^,]*,DECRYPTION,") + - csv: + source: log.paPayload + separator: ',' + headers: + - log.future_use + - log.receive_time + - log.serial + - log.pa_type + - log.pa_subtype + - log.future_use + - log.time_generated + - log.src + - log.dst + - log.natsrc + - log.natdst + - log.rule + - log.srcuser + - log.dstuser + - log.app + - log.vsys + - log.from + - log.to + - log.inbound_if + - log.outbound_if + - log.logset + - log.future_use + - log.sessionid + - log.repeatcnt + - log.spt + - log.dpt + - log.natspt + - log.natdpt + - log.flags + - log.proto + - log.act + - log.severityLabel + - log.seqno + - log.actionflags + - log.srcloc + - log.dstloc + - log.dg_hier_level_1 + - log.dg_hier_level_2 + - log.dg_hier_level_3 + - log.dg_hier_level_4 + - log.vsys_name + - log.device_name + - log.tunnelid + - log.monitortag + - log.parent_session_id + - log.parent_start_time + - log.tunnel + - log.bytes + - log.bytes_sent + - log.bytes_received + - log.packets + - log.pkts_sent + - log.pkts_received + - log.max_encap + - log.unknown_proto + - log.strict_check + - log.tunnel_fragment + - log.sessions_created + - log.sessions_closed + - log.session_end_reason + - log.action_source + - log.start + - log.elapsed + - log.tunnel_insp_rule + - log.remote_user_ip + - log.remote_user_id + - log.rule_uuid + - log.pcap_id + - log.dynusergroup_name + - log.src_edl + - log.dst_edl + - log.high_res_timestamp + - log.nssai_sd + - log.nssai_sst + - log.pdu_session_id + - log.subcategory_of_app + - log.category_of_app + - log.technology_of_app + - log.risk_of_app + - log.characteristic_of_app + - log.container_of_app + - log.is_saas_of_app + - log.sanctioned_state_of_app + - log.cluster_name + where: equals("log.paFormat", "CSV") && regexMatch("log.paPayload", "^[^,]*,[^,]*,[^,]*,(?:TUNNEL|START|END),") + - csv: + source: log.paPayload + separator: ',' + headers: + - log.future_use + - log.receive_time + - log.serial + - log.pa_type + - log.future_use + - log.future_use + - log.time_generated + - log.src + - log.dst + - log.future_use + - log.future_use + - log.rule + - log.future_use + - log.future_use + - log.future_use + - log.vsys + - log.from + - log.to + - log.inbound_if + - log.outbound_if + - log.logset + - log.future_use + - log.sessionid + - log.repeatcnt + - log.spt + - log.dpt + - log.future_use + - log.future_use + - log.future_use + - log.future_use + - log.proto + - log.act + - log.dg_hier_level_1 + - log.dg_hier_level_2 + - log.dg_hier_level_3 + - log.dg_hier_level_4 + - log.vsys_name + - log.device_name + - log.seqno + - log.future_use + - log.assoc_id + - log.ppid + - log.severityLabel + - log.sctp_chunk_type + - log.future_use + - log.verif_tag_1 + - log.verif_tag_2 + - log.sctp_cause_code + - log.diam_app_id + - log.diam_cmd_code + - log.diam_avp_code + - log.stream_id + - log.assoc_end_reason + - log.op_code + - log.sccp_calling_ssn + - log.sccp_calling_gt + - log.sctp_filter + - log.chunks + - log.chunks_sent + - log.chunks_received + - log.packets + - log.pkts_sent + - log.pkts_received + - log.rule_uuid + - log.high_res_timestamp + where: equals("log.paFormat", "CSV") && regexMatch("log.paPayload", "^[^,]*,[^,]*,[^,]*,SCTP,") + - csv: + source: log.paPayload + separator: ',' + headers: + - log.future_use + - log.receive_time + - log.serial + - log.pa_type + - log.pa_subtype + - log.future_use + - log.time_generated + - log.host + - log.vsys + - log.cmd + - log.admin + - log.client + - log.result + - log.path + - log.paConfigTail0 + - log.paConfigTail1 + - log.paConfigTail2 + - log.paConfigTail3 + - log.paConfigTail4 + - log.paConfigTail5 + - log.paConfigTail6 + - log.paConfigTail7 + - log.paConfigTail8 + - log.paConfigTail9 + - log.paConfigTail10 + - log.paConfigTail11 + - log.paConfigTail12 + - log.paConfigTail13 + where: equals("log.paFormat", "CSV") && regexMatch("log.paPayload", "^[^,]*,[^,]*,[^,]*,CONFIG,") + - csv: + source: log.paPayload + separator: ',' + headers: + - log.future_use + - log.receive_time + - log.serial + - log.pa_type + - log.pa_subtype + - log.future_use + - log.time_generated + - log.vsys + - log.src + - log.user + - log.normalize_user + - log.object + - log.authpolicy + - log.repeatcnt + - log.authid + - log.vendor + - log.logset + - log.serverprofile + - log.desc + - log.clienttype + - log.event + - log.factorno + - log.seqno + - log.actionflags + - log.dg_hier_level_1 + - log.dg_hier_level_2 + - log.dg_hier_level_3 + - log.dg_hier_level_4 + - log.vsys_name + - log.device_name + - log.vsys_id + - log.authproto + - log.rule_uuid + - log.high_res_timestamp + - log.src_category + - log.src_profile + - log.src_model + - log.src_vendor + - log.src_osfamily + - log.src_osversion + - log.src_host + - log.src_mac + - log.region + - log.future_use + - log.user_agent + - log.sessionid + - log.cluster_name + where: equals("log.paFormat", "CSV") && regexMatch("log.paPayload", "^[^,]*,[^,]*,[^,]*,AUTHENTICATION,") + - csv: + source: log.paPayload + separator: ',' + headers: + - log.future_use + - log.receive_time + - log.serial + - log.pa_type + - log.pa_subtype + - log.future_use + - log.time_generated + - log.vsys + - log.eventid + - log.object + - log.future_use + - log.future_use + - log.module + - log.severityLabel + - log.opaque + - log.seqno + - log.actionflags + - log.dg_hier_level_1 + - log.dg_hier_level_2 + - log.dg_hier_level_3 + - log.dg_hier_level_4 + - log.vsys_name + - log.device_name + - log.future_use + - log.future_use + - log.high_res_timestamp + where: equals("log.paFormat", "CSV") && regexMatch("log.paPayload", "^[^,]*,[^,]*,[^,]*,SYSTEM,") + - csv: + source: log.paPayload + separator: ',' + headers: + - log.future_use + - log.receive_time + - log.serial + - log.pa_type + - log.pa_subtype + - log.future_use + - log.time_generated + - log.src + - log.srcuser + - log.vsys + - log.category + - log.severityLabel + - log.dg_hier_level_1 + - log.dg_hier_level_2 + - log.dg_hier_level_3 + - log.dg_hier_level_4 + - log.vsys_name + - log.device_name + - log.vsys_id + - log.objectname + - log.object_id + - log.evidence + where: equals("log.paFormat", "CSV") && regexMatch("log.paPayload", "^[^,]*,[^,]*,[^,]*,CORRELATION,") + - csv: + source: log.paPayload + separator: ',' + headers: + - log.future_use + - log.receive_time + - log.serial + - log.pa_type + - log.pa_subtype + - log.future_use + - log.time_generated + - log.src + - log.dst + - log.future_use + - log.future_use + - log.rule + - log.future_use + - log.future_use + - log.app + - log.vsys + - log.from + - log.to + - log.inbound_if + - log.outbound_if + - log.logset + - log.future_use + - log.sessionid + - log.future_use + - log.spt + - log.dpt + - log.future_use + - log.future_use + - log.future_use + - log.proto + - log.act + - log.event_type + - log.msisdn + - log.apn + - log.rat + - log.msg_type + - log.end_ip_adr + - log.teid1 + - log.teid2 + - log.gtp_interface + - log.cause_code + - log.severityLabel + - log.mcc + - log.mnc + - log.area_code + - log.cell_id + - log.event_code + - log.future_use + - log.future_use + - log.srcloc + - log.dstloc + - log.future_use + - log.future_use + - log.future_use + - log.future_use + - log.future_use + - log.future_use + - log.future_use + - log.imsi + - log.imei + - log.future_use + - log.future_use + - log.future_use + - log.future_use + - log.future_use + - log.future_use + - log.future_use + - log.future_use + - log.future_use + - log.future_use + - log.future_use + - log.future_use + - log.future_use + - log.future_use + - log.future_use + - log.future_use + - log.start + - log.elapsed + - log.tunnel_insp_rule + - log.remote_user_ip + - log.remote_user_id + - log.rule_uuid + - log.pcap_id + - log.high_res_timestamp + - log.nssai_sst + - log.nssai_sd + - log.subcategory_of_app + - log.category_of_app + - log.technology_of_app + - log.risk_of_app + - log.characteristic_of_app + - log.container_of_app + - log.saas_of_app + - log.sanctioned_state_of_app + where: equals("log.paFormat", "CSV") && regexMatch("log.paPayload", "^[^,]*,[^,]*,[^,]*,GTP,") + - csv: + source: log.paPayload + separator: ',' + headers: + - log.future_use + - log.receive_time + - log.serial + - log.pa_type + - log.pa_subtype + - log.future_use + - log.time_generated + - log.src + - log.dst + - log.natsrc + - log.natdst + - log.rule + - log.srcuser + - log.dstuser + - log.app + - log.vsys + - log.from + - log.to + - log.inbound_if + - log.outbound_if + - log.logset + - log.future_use + - log.sessionid + - log.repeatcnt + - log.spt + - log.dpt + - log.natspt + - log.natdpt + - log.flags + - log.proto + - log.act + - log.misc + - log.pa_threatid + - log.category + - log.severityLabel + - log.direction + - log.seqno + - log.actionflags + - log.srcloc + - log.dstloc + - log.future_use + - log.contenttype + - log.pcap_id + - log.filedigest + - log.cloud + - log.url_idx + - log.user_agent + - log.filetype + - log.xff + - log.referer + - log.sender + - log.subject + - log.recipient + - log.reportid + - log.dg_hier_level_1 + - log.dg_hier_level_2 + - log.dg_hier_level_3 + - log.dg_hier_level_4 + - log.vsys_name + - log.device_name + - log.future_use + - log.src_uuid + - log.dst_uuid + - log.http_method + - log.tunnelid_imsi + - log.monitortag_imei + - log.parent_session_id + - log.parent_start_time + - log.tunnel + - log.thr_category + - log.contentver + - log.future_use + - log.assoc_id + - log.ppid + - log.http_headers + - log.response_headers + - log.http_status_code + - log.url_category_list + - log.rule_uuid + - log.http2_connection + - log.dynusergroup_name + - log.xff_ip + - log.src_category + - log.src_profile + - log.src_model + - log.src_vendor + - log.src_osfamily + - log.src_osversion + - log.src_host + - log.src_mac + - log.dst_category + - log.dst_profile + - log.dst_model + - log.dst_vendor + - log.dst_osfamily + - log.dst_osversion + - log.dst_host + - log.dst_mac + - log.container_id + - log.pod_namespace + - log.pod_name + - log.src_edl + - log.dst_edl + - log.hostid + - log.serialnumber + - log.domain_edl + - log.src_dag + - log.dst_dag + - log.partial_hash + - log.high_res_timestamp + - log.reason + - log.justification + - log.nssai_sst + - log.subcategory_of_app + - log.category_of_app + - log.technology_of_app + - log.risk_of_app + - log.characteristic_of_app + - log.container_of_app + - log.tunneled_app + - log.is_saas_of_app + - log.sanctioned_state_of_app + - log.cloud_reportid + - log.cluster_name + - log.flow_type + where: equals("log.paFormat", "CSV") && equals("log.pa_type", "THREAT") && equals("log.pa_subtype", "url") + && regexMatch("log.paURLTail1", "^[1-5][0-9]{2}$") && regexMatch("log.paURLTail34", "^\\d{4}-\\d{2}-\\d{2}T\\d{2}:\\d{2}:\\d{2}(?:\\.\\d+)?(?:Z|[+-]\\d{2}:\\d{2})$") + - csv: + source: log.paPayload + separator: ',' + headers: + - log.future_use + - log.receive_time + - log.serial + - log.pa_type + - log.pa_subtype + - log.future_use + - log.time_generated + - log.src + - log.dst + - log.natsrc + - log.natdst + - log.rule + - log.srcuser + - log.dstuser + - log.app + - log.vsys + - log.from + - log.to + - log.inbound_if + - log.outbound_if + - log.logset + - log.future_use + - log.sessionid + - log.repeatcnt + - log.spt + - log.dpt + - log.natspt + - log.natdpt + - log.flags + - log.proto + - log.act + - log.misc + - log.pa_threatid + - log.category + - log.severityLabel + - log.direction + - log.seqno + - log.actionflags + - log.srcloc + - log.dstloc + - log.future_use + - log.contenttype + - log.pcap_id + - log.filedigest + - log.cloud + - log.url_idx + - log.user_agent + - log.filetype + - log.xff + - log.referer + - log.sender + - log.subject + - log.recipient + - log.reportid + - log.dg_hier_level_1 + - log.dg_hier_level_2 + - log.dg_hier_level_3 + - log.dg_hier_level_4 + - log.vsys_name + - log.device_name + - log.future_use + - log.src_uuid + - log.dst_uuid + - log.http_method + - log.tunnelid_imsi + - log.monitortag_imei + - log.parent_session_id + - log.parent_start_time + - log.tunnel + - log.thr_category + - log.contentver + - log.future_use + - log.assoc_id + - log.ppid + - log.http_headers + - log.url_category_list + - log.rule_uuid + - log.http2_connection + - log.dynusergroup_name + - log.xff_ip + - log.src_category + - log.src_profile + - log.src_model + - log.src_vendor + - log.src_osfamily + - log.src_osversion + - log.src_host + - log.src_mac + - log.dst_category + - log.dst_profile + - log.dst_model + - log.dst_vendor + - log.dst_osfamily + - log.dst_osversion + - log.dst_host + - log.dst_mac + - log.container_id + - log.pod_namespace + - log.pod_name + - log.src_edl + - log.dst_edl + - log.hostid + - log.serialnumber + - log.domain_edl + - log.src_dag + - log.dst_dag + - log.partial_hash + - log.high_res_timestamp + - log.reason + - log.justification + - log.nssai_sst + - log.subcategory_of_app + - log.category_of_app + - log.technology_of_app + - log.risk_of_app + - log.characteristic_of_app + - log.container_of_app + - log.tunneled_app + - log.is_saas_of_app + - log.sanctioned_state_of_app + - log.cloud_reportid + - log.paURLLegacyTail1 + - log.paURLLegacyTail2 + where: equals("log.paFormat", "CSV") && equals("log.pa_type", "THREAT") && equals("log.pa_subtype", "url") + && !(equals("log.paFormat", "CSV") && equals("log.pa_type", "THREAT") && equals("log.pa_subtype", "url") + && regexMatch("log.paURLTail1", "^[1-5][0-9]{2}$") && regexMatch("log.paURLTail34", "^\\d{4}-\\d{2}-\\d{2}T\\d{2}:\\d{2}:\\d{2}(?:\\.\\d+)?(?:Z|[+-]\\d{2}:\\d{2})$")) + && regexMatch("log.paURLTail32", "^\\d{4}-\\d{2}-\\d{2}T\\d{2}:\\d{2}:\\d{2}(?:\\.\\d+)?(?:Z|[+-]\\d{2}:\\d{2})$") + - add: + function: string + params: + key: log.paURLLayout + value: current + where: equals("log.paFormat", "CSV") && equals("log.pa_type", "THREAT") && equals("log.pa_subtype", "url") + && regexMatch("log.paURLTail1", "^[1-5][0-9]{2}$") && regexMatch("log.paURLTail34", "^\\d{4}-\\d{2}-\\d{2}T\\d{2}:\\d{2}:\\d{2}(?:\\.\\d+)?(?:Z|[+-]\\d{2}:\\d{2})$") + - add: + function: string + params: + key: log.paURLLayout + value: legacy + where: equals("log.paFormat", "CSV") && equals("log.pa_type", "THREAT") && equals("log.pa_subtype", "url") + && !(equals("log.paFormat", "CSV") && equals("log.pa_type", "THREAT") && equals("log.pa_subtype", "url") + && regexMatch("log.paURLTail1", "^[1-5][0-9]{2}$") && regexMatch("log.paURLTail34", "^\\d{4}-\\d{2}-\\d{2}T\\d{2}:\\d{2}:\\d{2}(?:\\.\\d+)?(?:Z|[+-]\\d{2}:\\d{2})$")) + && regexMatch("log.paURLTail32", "^\\d{4}-\\d{2}-\\d{2}T\\d{2}:\\d{2}:\\d{2}(?:\\.\\d+)?(?:Z|[+-]\\d{2}:\\d{2})$") + - csv: + source: log.paPayload + separator: ',' + headers: + - log.future_use + - log.receive_time + - log.serial + - log.pa_type + - log.pa_subtype + - log.future_use + - log.time_generated + - log.host + - log.vsys + - log.cmd + - log.admin + - log.client + - log.result + - log.path + - log.before_change_detail + - log.after_change_detail + - log.seqno + - log.actionflags + - log.dg_hier_level_1 + - log.dg_hier_level_2 + - log.dg_hier_level_3 + - log.dg_hier_level_4 + - log.vsys_name + - log.device_name + - log.dg_id + - log.comment + - log.future_use + - log.high_res_timestamp + where: equals("log.paFormat", "CSV") && equals("log.pa_type", "CONFIG") && regexMatch("log.paConfigTail13", + "^\\d{4}-\\d{2}-\\d{2}T\\d{2}:\\d{2}:\\d{2}(?:\\.\\d+)?(?:Z|[+-]\\d{2}:\\d{2})$") + - csv: + source: log.paPayload + separator: ',' + headers: + - log.future_use + - log.receive_time + - log.serial + - log.pa_type + - log.pa_subtype + - log.future_use + - log.time_generated + - log.host + - log.vsys + - log.cmd + - log.admin + - log.client + - log.result + - log.path + - log.seqno + - log.actionflags + - log.dg_hier_level_1 + - log.dg_hier_level_2 + - log.dg_hier_level_3 + - log.dg_hier_level_4 + - log.vsys_name + - log.device_name + - log.dg_id + - log.comment + - log.future_use + - log.high_res_timestamp + where: equals("log.paFormat", "CSV") && equals("log.pa_type", "CONFIG") && !(equals("log.paFormat", "CSV") + && equals("log.pa_type", "CONFIG") && regexMatch("log.paConfigTail13", "^\\d{4}-\\d{2}-\\d{2}T\\d{2}:\\d{2}:\\d{2}(?:\\.\\d+)?(?:Z|[+-]\\d{2}:\\d{2})$")) + && regexMatch("log.paConfigTail11", "^\\d{4}-\\d{2}-\\d{2}T\\d{2}:\\d{2}:\\d{2}(?:\\.\\d+)?(?:Z|[+-]\\d{2}:\\d{2})$") + - add: + function: string + params: + key: log.paConfigLayout + value: custom + where: equals("log.paFormat", "CSV") && equals("log.pa_type", "CONFIG") && regexMatch("log.paConfigTail13", + "^\\d{4}-\\d{2}-\\d{2}T\\d{2}:\\d{2}:\\d{2}(?:\\.\\d+)?(?:Z|[+-]\\d{2}:\\d{2})$") + - add: + function: string + params: + key: log.paConfigLayout + value: default + where: equals("log.paFormat", "CSV") && equals("log.pa_type", "CONFIG") && !(equals("log.paFormat", "CSV") + && equals("log.pa_type", "CONFIG") && regexMatch("log.paConfigTail13", "^\\d{4}-\\d{2}-\\d{2}T\\d{2}:\\d{2}:\\d{2}(?:\\.\\d+)?(?:Z|[+-]\\d{2}:\\d{2})$")) + && regexMatch("log.paConfigTail11", "^\\d{4}-\\d{2}-\\d{2}T\\d{2}:\\d{2}:\\d{2}(?:\\.\\d+)?(?:Z|[+-]\\d{2}:\\d{2})$") + - delete: + fields: + - log.paURLTail0 + - log.paURLTail1 + - log.paURLTail2 + - log.paURLTail3 + - log.paURLTail4 + - log.paURLTail5 + - log.paURLTail6 + - log.paURLTail7 + - log.paURLTail8 + - log.paURLTail9 + - log.paURLTail10 + - log.paURLTail11 + - log.paURLTail12 + - log.paURLTail13 + - log.paURLTail14 + - log.paURLTail15 + - log.paURLTail16 + - log.paURLTail17 + - log.paURLTail18 + - log.paURLTail19 + - log.paURLTail20 + - log.paURLTail21 + - log.paURLTail22 + - log.paURLTail23 + - log.paURLTail24 + - log.paURLTail25 + - log.paURLTail26 + - log.paURLTail27 + - log.paURLTail28 + - log.paURLTail29 + - log.paURLTail30 + - log.paURLTail31 + - log.paURLTail32 + - log.paURLTail33 + - log.paURLTail34 + - log.paURLTail35 + - log.paURLTail36 + - log.paURLTail37 + - log.paURLTail38 + - log.paURLTail39 + - log.paURLTail40 + - log.paURLTail41 + - log.paURLTail42 + - log.paURLTail43 + - log.paURLTail44 + - log.paURLTail45 + - log.paURLTail46 + - log.paURLTail47 + - log.paURLTail48 + - log.paURLTail49 + where: exists("log.paURLLayout") + - delete: + fields: + - log.paConfigTail0 + - log.paConfigTail1 + - log.paConfigTail2 + - log.paConfigTail3 + - log.paConfigTail4 + - log.paConfigTail5 + - log.paConfigTail6 + - log.paConfigTail7 + - log.paConfigTail8 + - log.paConfigTail9 + - log.paConfigTail10 + - log.paConfigTail11 + - log.paConfigTail12 + - log.paConfigTail13 + where: exists("log.paConfigLayout") + - grok: + source: log.deviceExternalId + patterns: + - fieldName: log.serial + pattern: (?s)^.+$ + where: exists("log.deviceExternalId") && !oneOf("log.deviceExternalId", ["", "-", "N/A"]) && oneOf("log.paFormat", + ["CEF", "LEEF-legacy"]) + - grok: + source: log.dvchost + patterns: + - fieldName: log.device_name + pattern: (?s)^.+$ + where: exists("log.dvchost") && !oneOf("log.dvchost", ["", "-", "N/A"]) && oneOf("log.paFormat", ["CEF", "LEEF-legacy"]) + - grok: + source: log.suser + patterns: + - fieldName: log.srcuser + pattern: (?s)^.+$ + where: exists("log.suser") && !oneOf("log.suser", ["", "-", "N/A"]) && oneOf("log.paFormat", ["CEF", "LEEF-legacy"]) + - grok: + source: log.duser + patterns: + - fieldName: log.dstuser + pattern: (?s)^.+$ + where: exists("log.duser") && !oneOf("log.duser", ["", "-", "N/A"]) && oneOf("log.paFormat", ["CEF", "LEEF-legacy"]) + - grok: + source: log.shost + patterns: + - fieldName: log.srchost + pattern: (?s)^.+$ + where: exists("log.shost") && !oneOf("log.shost", ["", "-", "N/A"]) && oneOf("log.paFormat", ["CEF", "LEEF-legacy"]) + - grok: + source: log.request + patterns: + - fieldName: log.misc + pattern: (?s)^.+$ + where: exists("log.request") && !oneOf("log.request", ["", "-", "N/A"]) && oneOf("log.paFormat", ["CEF", "LEEF-legacy"]) + - grok: + source: log.fileHash + patterns: + - fieldName: log.filedigest + pattern: (?s)^.+$ + where: exists("log.fileHash") && !oneOf("log.fileHash", ["", "-", "N/A"]) && oneOf("log.paFormat", ["CEF", + "LEEF-legacy"]) + - grok: + source: log.fileType + patterns: + - fieldName: log.filetype + pattern: (?s)^.+$ + where: exists("log.fileType") && !oneOf("log.fileType", ["", "-", "N/A"]) && oneOf("log.paFormat", ["CEF", + "LEEF-legacy"]) + - grok: + source: log.sourceTranslatedAddress + patterns: + - fieldName: log.natsrc + pattern: (?s)^.+$ + where: exists("log.sourceTranslatedAddress") && !oneOf("log.sourceTranslatedAddress", ["", "-", "N/A"]) && + oneOf("log.paFormat", ["CEF", "LEEF-legacy"]) + - grok: + source: log.destinationTranslatedAddress + patterns: + - fieldName: log.natdst + pattern: (?s)^.+$ + where: exists("log.destinationTranslatedAddress") && !oneOf("log.destinationTranslatedAddress", ["", "-", + "N/A"]) && oneOf("log.paFormat", ["CEF", "LEEF-legacy"]) + - grok: + source: log.sourceTranslatedPort + patterns: + - fieldName: log.natspt + pattern: (?s)^.+$ + where: exists("log.sourceTranslatedPort") && !oneOf("log.sourceTranslatedPort", ["", "-", "N/A"]) && oneOf("log.paFormat", + ["CEF", "LEEF-legacy"]) + - grok: + source: log.destinationTranslatedPort + patterns: + - fieldName: log.natdpt + pattern: (?s)^.+$ + where: exists("log.destinationTranslatedPort") && !oneOf("log.destinationTranslatedPort", ["", "-", "N/A"]) + && oneOf("log.paFormat", ["CEF", "LEEF-legacy"]) + - grok: + source: log.PanOSSourceHostname + patterns: + - fieldName: log.src_host + pattern: (?s)^.+$ + where: exists("log.PanOSSourceHostname") && !oneOf("log.PanOSSourceHostname", ["", "-", "N/A"]) && oneOf("log.paFormat", + ["CEF", "LEEF-legacy"]) && !exists("log.src_host") + - grok: + source: log.panOSSourceHostname + patterns: + - fieldName: log.src_host + pattern: (?s)^.+$ + where: exists("log.panOSSourceHostname") && !oneOf("log.panOSSourceHostname", ["", "-", "N/A"]) && oneOf("log.paFormat", + ["CEF", "LEEF-legacy"]) && !exists("log.src_host") + - grok: + source: log.PanOSSourceMac + patterns: + - fieldName: log.src_mac + pattern: (?s)^.+$ + where: exists("log.PanOSSourceMac") && !oneOf("log.PanOSSourceMac", ["", "-", "N/A"]) && oneOf("log.paFormat", + ["CEF", "LEEF-legacy"]) && !exists("log.src_mac") + - grok: + source: log.panOSSourceMac + patterns: + - fieldName: log.src_mac + pattern: (?s)^.+$ + where: exists("log.panOSSourceMac") && !oneOf("log.panOSSourceMac", ["", "-", "N/A"]) && oneOf("log.paFormat", + ["CEF", "LEEF-legacy"]) && !exists("log.src_mac") + - grok: + source: log.PanOSSourceDeviceOSFamily + patterns: + - fieldName: log.src_osfamily + pattern: (?s)^.+$ + where: exists("log.PanOSSourceDeviceOSFamily") && !oneOf("log.PanOSSourceDeviceOSFamily", ["", "-", "N/A"]) + && oneOf("log.paFormat", ["CEF", "LEEF-legacy"]) && !exists("log.src_osfamily") + - grok: + source: log.panOSSourceDeviceOSFamily + patterns: + - fieldName: log.src_osfamily + pattern: (?s)^.+$ + where: exists("log.panOSSourceDeviceOSFamily") && !oneOf("log.panOSSourceDeviceOSFamily", ["", "-", "N/A"]) + && oneOf("log.paFormat", ["CEF", "LEEF-legacy"]) && !exists("log.src_osfamily") + - grok: + source: log.PanOSEndpointMac + patterns: + - fieldName: log.mac + pattern: (?s)^.+$ + where: exists("log.PanOSEndpointMac") && !oneOf("log.PanOSEndpointMac", ["", "-", "N/A"]) && oneOf("log.paFormat", + ["CEF", "LEEF-legacy"]) && !exists("log.mac") + - grok: + source: log.panOSEndpointMac + patterns: + - fieldName: log.mac + pattern: (?s)^.+$ + where: exists("log.panOSEndpointMac") && !oneOf("log.panOSEndpointMac", ["", "-", "N/A"]) && oneOf("log.paFormat", + ["CEF", "LEEF-legacy"]) && !exists("log.mac") + - grok: + source: log.PanOSPublicIPv4 + patterns: + - fieldName: log.public_ip + pattern: (?s)^.+$ + where: exists("log.PanOSPublicIPv4") && !oneOf("log.PanOSPublicIPv4", ["", "-", "N/A"]) && oneOf("log.paFormat", + ["CEF", "LEEF-legacy"]) && !exists("log.public_ip") + - grok: + source: log.panOSPublicIPv4 + patterns: + - fieldName: log.public_ip + pattern: (?s)^.+$ + where: exists("log.panOSPublicIPv4") && !oneOf("log.panOSPublicIPv4", ["", "-", "N/A"]) && oneOf("log.paFormat", + ["CEF", "LEEF-legacy"]) && !exists("log.public_ip") + - grok: + source: log.PanOSPublicIPv6 + patterns: + - fieldName: log.public_ipv6 + pattern: (?s)^.+$ + where: exists("log.PanOSPublicIPv6") && !oneOf("log.PanOSPublicIPv6", ["", "-", "N/A"]) && oneOf("log.paFormat", + ["CEF", "LEEF-legacy"]) && !exists("log.public_ipv6") + - grok: + source: log.panOSPublicIPv6 + patterns: + - fieldName: log.public_ipv6 + pattern: (?s)^.+$ + where: exists("log.panOSPublicIPv6") && !oneOf("log.panOSPublicIPv6", ["", "-", "N/A"]) && oneOf("log.paFormat", + ["CEF", "LEEF-legacy"]) && !exists("log.public_ipv6") + - grok: + source: log.PanOSEventID + patterns: + - fieldName: log.eventid + pattern: (?s)^.+$ + where: exists("log.PanOSEventID") && !oneOf("log.PanOSEventID", ["", "-", "N/A"]) && oneOf("log.paFormat", + ["CEF", "LEEF-legacy"]) && !exists("log.eventid") + - grok: + source: log.panOSEventID + patterns: + - fieldName: log.eventid + pattern: (?s)^.+$ + where: exists("log.panOSEventID") && !oneOf("log.panOSEventID", ["", "-", "N/A"]) && oneOf("log.paFormat", + ["CEF", "LEEF-legacy"]) && !exists("log.eventid") + - grok: + source: log.PanOSEventStatus + patterns: + - fieldName: log.status + pattern: (?s)^.+$ + where: exists("log.PanOSEventStatus") && !oneOf("log.PanOSEventStatus", ["", "-", "N/A"]) && oneOf("log.paFormat", + ["CEF", "LEEF-legacy"]) && !exists("log.status") + - grok: + source: log.panOSEventStatus + patterns: + - fieldName: log.status + pattern: (?s)^.+$ + where: exists("log.panOSEventStatus") && !oneOf("log.panOSEventStatus", ["", "-", "N/A"]) && oneOf("log.paFormat", + ["CEF", "LEEF-legacy"]) && !exists("log.status") + - grok: + source: log.PanOSEndpointDeviceName + patterns: + - fieldName: log.machinename + pattern: (?s)^.+$ + where: exists("log.PanOSEndpointDeviceName") && !oneOf("log.PanOSEndpointDeviceName", ["", "-", "N/A"]) && + oneOf("log.paFormat", ["CEF", "LEEF-legacy"]) && !exists("log.machinename") + - grok: + source: log.panOSEndpointDeviceName + patterns: + - fieldName: log.machinename + pattern: (?s)^.+$ + where: exists("log.panOSEndpointDeviceName") && !oneOf("log.panOSEndpointDeviceName", ["", "-", "N/A"]) && + oneOf("log.paFormat", ["CEF", "LEEF-legacy"]) && !exists("log.machinename") + - grok: + source: log.PanOSEndpointOSType + patterns: + - fieldName: log.client_os + pattern: (?s)^.+$ + where: exists("log.PanOSEndpointOSType") && !oneOf("log.PanOSEndpointOSType", ["", "-", "N/A"]) && oneOf("log.paFormat", + ["CEF", "LEEF-legacy"]) && !exists("log.client_os") + - grok: + source: log.panOSEndpointOSType + patterns: + - fieldName: log.client_os + pattern: (?s)^.+$ + where: exists("log.panOSEndpointOSType") && !oneOf("log.panOSEndpointOSType", ["", "-", "N/A"]) && oneOf("log.paFormat", + ["CEF", "LEEF-legacy"]) && !exists("log.client_os") + - grok: + source: log.PanOSThreatCategory + patterns: + - fieldName: log.thr_category + pattern: (?s)^.+$ + where: exists("log.PanOSThreatCategory") && !oneOf("log.PanOSThreatCategory", ["", "-", "N/A"]) && oneOf("log.paFormat", + ["CEF", "LEEF-legacy"]) && !exists("log.thr_category") + - grok: + source: log.panOSThreatCategory + patterns: + - fieldName: log.thr_category + pattern: (?s)^.+$ + where: exists("log.panOSThreatCategory") && !oneOf("log.panOSThreatCategory", ["", "-", "N/A"]) && oneOf("log.paFormat", + ["CEF", "LEEF-legacy"]) && !exists("log.thr_category") + - grok: + source: log.PanOSPacketsSent + patterns: + - fieldName: log.pkts_sent + pattern: (?s)^.+$ + where: exists("log.PanOSPacketsSent") && !oneOf("log.PanOSPacketsSent", ["", "-", "N/A"]) && oneOf("log.paFormat", + ["CEF", "LEEF-legacy"]) && !exists("log.pkts_sent") + - grok: + source: log.panOSPacketsSent + patterns: + - fieldName: log.pkts_sent + pattern: (?s)^.+$ + where: exists("log.panOSPacketsSent") && !oneOf("log.panOSPacketsSent", ["", "-", "N/A"]) && oneOf("log.paFormat", + ["CEF", "LEEF-legacy"]) && !exists("log.pkts_sent") + - grok: + source: log.PanOSPacketsReceived + patterns: + - fieldName: log.pkts_received + pattern: (?s)^.+$ + where: exists("log.PanOSPacketsReceived") && !oneOf("log.PanOSPacketsReceived", ["", "-", "N/A"]) && oneOf("log.paFormat", + ["CEF", "LEEF-legacy"]) && !exists("log.pkts_received") + - grok: + source: log.panOSPacketsReceived + patterns: + - fieldName: log.pkts_received + pattern: (?s)^.+$ + where: exists("log.panOSPacketsReceived") && !oneOf("log.panOSPacketsReceived", ["", "-", "N/A"]) && oneOf("log.paFormat", + ["CEF", "LEEF-legacy"]) && !exists("log.pkts_received") + - grok: + source: log.PanSrcHostname + patterns: + - fieldName: log.src_host + pattern: (?s)^.+$ + where: exists("log.PanSrcHostname") && !oneOf("log.PanSrcHostname", ["", "-", "N/A"]) && oneOf("log.paFormat", + ["CEF", "LEEF-legacy"]) && !exists("log.src_host") + - grok: + source: log.panSrcHostname + patterns: + - fieldName: log.src_host + pattern: (?s)^.+$ + where: exists("log.panSrcHostname") && !oneOf("log.panSrcHostname", ["", "-", "N/A"]) && oneOf("log.paFormat", + ["CEF", "LEEF-legacy"]) && !exists("log.src_host") + - grok: + source: log.PanDstHostname + patterns: + - fieldName: log.dst_host + pattern: (?s)^.+$ + where: exists("log.PanDstHostname") && !oneOf("log.PanDstHostname", ["", "-", "N/A"]) && oneOf("log.paFormat", + ["CEF", "LEEF-legacy"]) && !exists("log.dst_host") + - grok: + source: log.panDstHostname + patterns: + - fieldName: log.dst_host + pattern: (?s)^.+$ + where: exists("log.panDstHostname") && !oneOf("log.panDstHostname", ["", "-", "N/A"]) && oneOf("log.paFormat", + ["CEF", "LEEF-legacy"]) && !exists("log.dst_host") + - grok: + source: log.PanSrcMac + patterns: + - fieldName: log.src_mac + pattern: (?s)^.+$ + where: exists("log.PanSrcMac") && !oneOf("log.PanSrcMac", ["", "-", "N/A"]) && oneOf("log.paFormat", ["CEF", + "LEEF-legacy"]) && !exists("log.src_mac") + - grok: + source: log.panSrcMac + patterns: + - fieldName: log.src_mac + pattern: (?s)^.+$ + where: exists("log.panSrcMac") && !oneOf("log.panSrcMac", ["", "-", "N/A"]) && oneOf("log.paFormat", ["CEF", + "LEEF-legacy"]) && !exists("log.src_mac") + - grok: + source: log.PanDstMac + patterns: + - fieldName: log.dst_mac + pattern: (?s)^.+$ + where: exists("log.PanDstMac") && !oneOf("log.PanDstMac", ["", "-", "N/A"]) && oneOf("log.paFormat", ["CEF", + "LEEF-legacy"]) && !exists("log.dst_mac") + - grok: + source: log.panDstMac + patterns: + - fieldName: log.dst_mac + pattern: (?s)^.+$ + where: exists("log.panDstMac") && !oneOf("log.panDstMac", ["", "-", "N/A"]) && oneOf("log.paFormat", ["CEF", + "LEEF-legacy"]) && !exists("log.dst_mac") + - grok: + source: log.PanSrcDeviceOS + patterns: + - fieldName: log.src_osfamily + pattern: (?s)^.+$ + where: exists("log.PanSrcDeviceOS") && !oneOf("log.PanSrcDeviceOS", ["", "-", "N/A"]) && oneOf("log.paFormat", + ["CEF", "LEEF-legacy"]) && !exists("log.src_osfamily") + - grok: + source: log.panSrcDeviceOS + patterns: + - fieldName: log.src_osfamily + pattern: (?s)^.+$ + where: exists("log.panSrcDeviceOS") && !oneOf("log.panSrcDeviceOS", ["", "-", "N/A"]) && oneOf("log.paFormat", + ["CEF", "LEEF-legacy"]) && !exists("log.src_osfamily") + - grok: + source: log.PanDstDeviceOS + patterns: + - fieldName: log.dst_osfamily + pattern: (?s)^.+$ + where: exists("log.PanDstDeviceOS") && !oneOf("log.PanDstDeviceOS", ["", "-", "N/A"]) && oneOf("log.paFormat", + ["CEF", "LEEF-legacy"]) && !exists("log.dst_osfamily") + - grok: + source: log.panDstDeviceOS + patterns: + - fieldName: log.dst_osfamily + pattern: (?s)^.+$ + where: exists("log.panDstDeviceOS") && !oneOf("log.panDstDeviceOS", ["", "-", "N/A"]) && oneOf("log.paFormat", + ["CEF", "LEEF-legacy"]) && !exists("log.dst_osfamily") + - grok: + source: log.PanTimeHighRes + patterns: + - fieldName: log.high_res_timestamp + pattern: (?s)^.+$ + where: exists("log.PanTimeHighRes") && !oneOf("log.PanTimeHighRes", ["", "-", "N/A"]) && oneOf("log.paFormat", + ["CEF", "LEEF-legacy"]) && !exists("log.high_res_timestamp") + - grok: + source: log.panTimeHighRes + patterns: + - fieldName: log.high_res_timestamp + pattern: (?s)^.+$ + where: exists("log.panTimeHighRes") && !oneOf("log.panTimeHighRes", ["", "-", "N/A"]) && oneOf("log.paFormat", + ["CEF", "LEEF-legacy"]) && !exists("log.high_res_timestamp") + - grok: + source: log.PanOSTimeGeneratedHighResolution + patterns: + - fieldName: log.high_res_timestamp + pattern: (?s)^.+$ + where: exists("log.PanOSTimeGeneratedHighResolution") && !oneOf("log.PanOSTimeGeneratedHighResolution", ["", + "-", "N/A"]) && oneOf("log.paFormat", ["CEF", "LEEF-legacy"]) && !exists("log.high_res_timestamp") + - grok: + source: log.panOSTimeGeneratedHighResolution + patterns: + - fieldName: log.high_res_timestamp + pattern: (?s)^.+$ + where: exists("log.panOSTimeGeneratedHighResolution") && !oneOf("log.panOSTimeGeneratedHighResolution", ["", + "-", "N/A"]) && oneOf("log.paFormat", ["CEF", "LEEF-legacy"]) && !exists("log.high_res_timestamp") + - grok: + source: log.anOSTimeGeneratedHighResolution + patterns: + - fieldName: log.high_res_timestamp + pattern: (?s)^.+$ + where: exists("log.anOSTimeGeneratedHighResolution") && !oneOf("log.anOSTimeGeneratedHighResolution", ["", + "-", "N/A"]) && oneOf("log.paFormat", ["CEF", "LEEF-legacy"]) && !exists("log.high_res_timestamp") + - grok: + source: log.anOSTimeGeneratedHighResolution + patterns: + - fieldName: log.high_res_timestamp + pattern: (?s)^.+$ + where: exists("log.anOSTimeGeneratedHighResolution") && !oneOf("log.anOSTimeGeneratedHighResolution", ["", + "-", "N/A"]) && oneOf("log.paFormat", ["CEF", "LEEF-legacy"]) && !exists("log.high_res_timestamp") + - grok: + source: log.cs3 + patterns: + - fieldName: log.vsys + pattern: (?s)^.+$ + where: exists("log.cs3") && !oneOf("log.cs3", ["", "-", "N/A"]) && oneOf("log.paFormat", ["CEF", "LEEF-legacy"]) + && equals("log.cs3Label", "Virtual System") + - grok: + source: log.flexString2 + patterns: + - fieldName: log.direction + pattern: (?s)^.+$ + where: exists("log.flexString2") && !oneOf("log.flexString2", ["", "-", "N/A"]) && oneOf("log.paFormat", ["CEF", + "LEEF-legacy"]) && equals("log.flexString2Label", "Direction") + - grok: + source: log.cs2 + patterns: + - fieldName: log.category + pattern: (?s)^.+$ + where: exists("log.cs2") && !oneOf("log.cs2", ["", "-", "N/A"]) && oneOf("log.paFormat", ["CEF", "LEEF-legacy"]) + && equals("log.cs2Label", "URL Category") + - grok: + source: log.paCefSignature + patterns: + - fieldName: log.result + pattern: (?s)^.+$ + where: exists("log.paCefSignature") && !oneOf("log.paCefSignature", ["", "-", "N/A"]) && oneOf("log.paFormat", + ["CEF", "LEEF-legacy"]) && equals("log.pa_type", "CONFIG") + - grok: + source: log.shost + patterns: + - fieldName: log.host + pattern: (?s)^.+$ + where: exists("log.shost") && !oneOf("log.shost", ["", "-", "N/A"]) && oneOf("log.paFormat", ["CEF", "LEEF-legacy"]) + && equals("log.pa_type", "CONFIG") + - grok: + source: log.duser + patterns: + - fieldName: log.admin + pattern: (?s)^.+$ + where: exists("log.duser") && !oneOf("log.duser", ["", "-", "N/A"]) && oneOf("log.paFormat", ["CEF", "LEEF-legacy"]) + && equals("log.pa_type", "CONFIG") + - grok: + source: log.act + patterns: + - fieldName: log.cmd + pattern: (?s)^.+$ + where: exists("log.act") && !oneOf("log.act", ["", "-", "N/A"]) && oneOf("log.paFormat", ["CEF", "LEEF-legacy"]) + && equals("log.pa_type", "CONFIG") + - grok: + source: log.msg + patterns: + - fieldName: log.opaque + pattern: (?s)^.+$ + where: exists("log.msg") && !oneOf("log.msg", ["", "-", "N/A"]) && oneOf("log.paFormat", ["CEF", "LEEF-legacy"]) + && equals("log.pa_type", "SYSTEM") + - grok: + source: log.msg + patterns: + - fieldName: log.event + pattern: (?s)^.+$ + where: exists("log.msg") && !oneOf("log.msg", ["", "-", "N/A"]) && oneOf("log.paFormat", ["CEF", "LEEF-legacy"]) + && equals("log.pa_type", "AUTHENTICATION") + - grok: + source: log.reason + patterns: + - fieldName: log.session_end_reason + pattern: (?s)^.+$ + where: exists("log.reason") && !oneOf("log.reason", ["", "-", "N/A"]) && oneOf("log.paFormat", ["CEF", "LEEF-legacy"]) + && equals("log.pa_type", "TRAFFIC") + - grok: + source: log.cs2 + patterns: + - fieldName: log.os + pattern: (?s)^.+$ + where: exists("log.cs2") && !oneOf("log.cs2", ["", "-", "N/A"]) && oneOf("log.paFormat", ["CEF", "LEEF-legacy"]) + && equals("log.pa_type", "HIP-MATCH") && equals("log.cs2Label", "Operating System") + - grok: + source: log.cat + patterns: + - fieldName: log.eventid + pattern: (?s)^.+$ + where: exists("log.cat") && !oneOf("log.cat", ["", "-", "N/A"]) && oneOf("log.paFormat", ["CEF", "LEEF-legacy"]) + && oneOf("log.pa_type", ["SYSTEM", "USERID", "IPTAG"]) + - grok: + source: log.paCefSignature + patterns: + - fieldName: log.pa_subtype + pattern: (?s)^.+$ + where: exists("log.paCefSignature") && !oneOf("log.paCefSignature", ["", "-", "N/A"]) && oneOf("log.paFormat", + ["CEF", "LEEF-legacy"]) && !oneOf("log.pa_type", ["THREAT", "CONFIG"]) + - grok: + source: log.cat + patterns: + - fieldName: log.pa_subtype + pattern: (?s)^.+$ + where: exists("log.cat") && !oneOf("log.cat", ["", "-", "N/A"]) && oneOf("log.paFormat", ["CEF", "LEEF-legacy"]) + && equals("log.pa_type", "THREAT") && oneOf("log.cat", ["url", "data", "file", "wildfire", "wildfire-virus", + "virus", "ml-virus", "spyware", "vulnerability", "flood", "packet", "scan"]) + - grok: + source: log.paCefSignature + patterns: + - fieldName: log.pa_threatid + pattern: (?s)^.+$ + where: exists("log.paCefSignature") && !oneOf("log.paCefSignature", ["", "-", "N/A"]) && oneOf("log.paFormat", + ["CEF", "LEEF-legacy"]) && equals("log.pa_type", "THREAT") && oneOf("log.cat", ["url", "data", "file", "wildfire", + "wildfire-virus", "virus", "ml-virus", "spyware", "vulnerability", "flood", "packet", "scan"]) + - grok: + source: log.paCefSignature + patterns: + - fieldName: log.pa_subtype + pattern: (?s)^.+$ + where: exists("log.paCefSignature") && !oneOf("log.paCefSignature", ["", "-", "N/A"]) && oneOf("log.paFormat", + ["CEF", "LEEF-legacy"]) && equals("log.pa_type", "THREAT") && !exists("log.pa_subtype") && oneOf("log.paCefSignature", + ["url", "data", "file", "wildfire", "wildfire-virus", "virus", "ml-virus", "spyware", "vulnerability", "flood", + "packet", "scan"]) + - grok: + source: log.cat + patterns: + - fieldName: log.pa_threatid + pattern: (?s)^.+$ + where: exists("log.cat") && !oneOf("log.cat", ["", "-", "N/A"]) && oneOf("log.paFormat", ["CEF", "LEEF-legacy"]) + && equals("log.pa_type", "THREAT") && !exists("log.pa_threatid") && exists("log.pa_subtype") + - grok: + source: log.pa_type + patterns: + - fieldName: log.paType + pattern: (?s)^.+$ + where: exists("log.pa_type") && !oneOf("log.pa_type", ["", "-", "N/A"]) && oneOf("log.paFormat", ["CEF", "LEEF-legacy"]) + - grok: + source: log.pa_subtype + patterns: + - fieldName: log.paSubtype + pattern: (?s)^.+$ + where: exists("log.pa_subtype") && !oneOf("log.pa_subtype", ["", "-", "N/A"]) && oneOf("log.paFormat", ["CEF", + "LEEF-legacy"]) + - add: + function: string + params: + key: log.embDeviceVendor + value: Palo Alto Networks + where: oneOf("log.paFormat", ["CEF", "LEEF-legacy"]) && exists("log.pa_type") + - add: + function: string + params: + key: log.embDeviceProduct + value: PAN-OS + where: oneOf("log.paFormat", ["CEF", "LEEF-legacy"]) && exists("log.pa_type") + - add: + function: string + params: + key: log.formatType + value: CEF + where: equals("log.paFormat", "CEF") + - add: + function: string + params: + key: log.formatType + value: LEEF + where: equals("log.paFormat", "LEEF-legacy") + - grok: + source: log.paPayload + patterns: + - fieldName: log.paIgnored + pattern: '^(?:CEF|LEEF):' + - fieldName: log.formatVersion + pattern: '[0-9]+' + - fieldName: log.paSuffix + pattern: \| + where: oneOf("log.paFormat", ["CEF", "LEEF-legacy"]) + - grok: + source: log.opaque + patterns: + - fieldName: log.paAuthPrefix + pattern: ^(?:failed authentication|authenticated) for user ' + - fieldName: log.paAuthUser + pattern: '[^'']+' + - fieldName: log.paAuthMiddle + pattern: '''\. .*? From: ' + - fieldName: log.paAuthIP + pattern: '[0-9A-Fa-f:.]+' + - fieldName: log.paAuthSuffix + pattern: \.$ + where: equals("log.pa_type", "SYSTEM") && oneOf("log.eventid", ["auth-fail", "auth-success"]) + - grok: + source: log.host + patterns: + - fieldName: log.src + pattern: (?s)^.+$ + where: exists("log.host") && !oneOf("log.host", ["", "-", "N/A"]) && equals("log.pa_type", "CONFIG") + - grok: + source: log.admin + patterns: + - fieldName: log.srcuser + pattern: (?s)^.+$ + where: exists("log.admin") && !oneOf("log.admin", ["", "-", "N/A"]) && equals("log.pa_type", "CONFIG") + - grok: + source: log.user + patterns: + - fieldName: log.srcuser + pattern: (?s)^.+$ + where: exists("log.user") && !oneOf("log.user", ["", "-", "N/A"]) && oneOf("log.pa_type", ["AUTHENTICATION", + "USERID"]) + - grok: + source: log.duser + patterns: + - fieldName: log.srcuser + pattern: (?s)^.+$ + where: exists("log.duser") && !oneOf("log.duser", ["", "-", "N/A"]) && oneOf("log.paFormat", ["CEF", "LEEF-legacy"]) + && oneOf("log.pa_type", ["AUTHENTICATION", "USERID"]) + - grok: + source: log.paAuthIP + patterns: + - fieldName: log.src + pattern: (?s)^.+$ + where: exists("log.paAuthIP") && !oneOf("log.paAuthIP", ["", "-", "N/A"]) && equals("log.pa_type", "SYSTEM") + && oneOf("log.eventid", ["auth-fail", "auth-success"]) + - grok: + source: log.paAuthUser + patterns: + - fieldName: log.srcuser + pattern: (?s)^.+$ + where: exists("log.paAuthUser") && !oneOf("log.paAuthUser", ["", "-", "N/A"]) && equals("log.pa_type", "SYSTEM") + && oneOf("log.eventid", ["auth-fail", "auth-success"]) + - grok: + source: log.public_ip + patterns: + - fieldName: log.src + pattern: (?s)^.+$ + where: exists("log.public_ip") && !oneOf("log.public_ip", ["", "-", "N/A"]) && equals("log.pa_type", "GLOBALPROTECT") + - grok: + source: log.public_ipv6 + patterns: + - fieldName: log.src + pattern: (?s)^.+$ + where: exists("log.public_ipv6") && !oneOf("log.public_ipv6", ["", "-", "N/A"]) && equals("log.pa_type", "GLOBALPROTECT") + && !((inCIDR("log.src", "0.0.0.0/0") || inCIDR("log.src", "::/0")) && !inCIDR("log.src", "0.0.0.0/32") && + !inCIDR("log.src", "::/128")) + - grok: + source: log.srcipv6 + patterns: + - fieldName: log.src + pattern: (?s)^.+$ + where: exists("log.srcipv6") && !oneOf("log.srcipv6", ["", "-", "N/A"]) && equals("log.pa_type", "HIP-MATCH") + && !((inCIDR("log.src", "0.0.0.0/0") || inCIDR("log.src", "::/0")) && !inCIDR("log.src", "0.0.0.0/32") && + !inCIDR("log.src", "::/128")) + - grok: + source: log.c6a2 + patterns: + - fieldName: log.src + pattern: (?s)^.+$ + where: exists("log.c6a2") && !oneOf("log.c6a2", ["", "-", "N/A"]) && oneOf("log.paFormat", ["CEF", "LEEF-legacy"]) + && equals("log.pa_type", "HIP-MATCH") && !((inCIDR("log.src", "0.0.0.0/0") || inCIDR("log.src", "::/0")) + && !inCIDR("log.src", "0.0.0.0/32") && !inCIDR("log.src", "::/128")) + - grok: + source: log.src + patterns: + - fieldName: origin.ip + pattern: (?s)^.+$ + where: exists("log.src") && !oneOf("log.src", ["", "-", "N/A"]) && (inCIDR("log.src", "0.0.0.0/0") || inCIDR("log.src", + "::/0")) && !inCIDR("log.src", "0.0.0.0/32") && !inCIDR("log.src", "::/128") + - grok: + source: log.dst + patterns: + - fieldName: target.ip + pattern: (?s)^.+$ + where: exists("log.dst") && !oneOf("log.dst", ["", "-", "N/A"]) && (inCIDR("log.dst", "0.0.0.0/0") || inCIDR("log.dst", + "::/0")) && !inCIDR("log.dst", "0.0.0.0/32") && !inCIDR("log.dst", "::/128") + - add: + function: string + params: + key: log.paDirection + value: client-to-server + where: equals("log.pa_type", "THREAT") && equals("log.direction", "client-to-server") + - add: + function: string + params: + key: log.paDirection + value: client-to-server + where: equals("log.pa_type", "THREAT") && equals("log.direction", "0") + - add: + function: string + params: + key: log.paDirection + value: server-to-client + where: equals("log.pa_type", "THREAT") && equals("log.direction", "server-to-client") + - add: + function: string + params: + key: log.paDirection + value: server-to-client + where: equals("log.pa_type", "THREAT") && equals("log.direction", "1") + - grok: + source: log.srcuser + patterns: + - fieldName: origin.user + pattern: (?s)^.+$ + where: exists("log.srcuser") && !oneOf("log.srcuser", ["", "-", "N/A"]) + - grok: + source: log.dstuser + patterns: + - fieldName: target.user + pattern: (?s)^.+$ + where: exists("log.dstuser") && !oneOf("log.dstuser", ["", "-", "N/A"]) && !oneOf("log.pa_type", ["CONFIG", + "AUTHENTICATION", "USERID"]) + - grok: + source: log.src_host + patterns: + - fieldName: origin.host + pattern: (?s)^.+$ + where: exists("log.src_host") && !oneOf("log.src_host", ["", "-", "N/A"]) + - grok: + source: log.dst_host + patterns: + - fieldName: target.host + pattern: (?s)^.+$ + where: exists("log.dst_host") && !oneOf("log.dst_host", ["", "-", "N/A"]) + - grok: + source: log.src_mac + patterns: + - fieldName: origin.mac + pattern: (?s)^.+$ + where: exists("log.src_mac") && !oneOf("log.src_mac", ["", "-", "N/A"]) && regexMatch("log.src_mac", "^(?:[0-9A-Fa-f]{2}[:-]){5}[0-9A-Fa-f]{2}$") + - grok: + source: log.dst_mac + patterns: + - fieldName: target.mac + pattern: (?s)^.+$ + where: exists("log.dst_mac") && !oneOf("log.dst_mac", ["", "-", "N/A"]) && regexMatch("log.dst_mac", "^(?:[0-9A-Fa-f]{2}[:-]){5}[0-9A-Fa-f]{2}$") + - grok: + source: log.src_osfamily + patterns: + - fieldName: origin.operatingSystem + pattern: (?s)^.+$ + where: exists("log.src_osfamily") && !oneOf("log.src_osfamily", ["", "-", "N/A"]) + - grok: + source: log.dst_osfamily + patterns: + - fieldName: target.operatingSystem + pattern: (?s)^.+$ + where: exists("log.dst_osfamily") && !oneOf("log.dst_osfamily", ["", "-", "N/A"]) + - grok: + source: log.machinename + patterns: + - fieldName: origin.host + pattern: (?s)^.+$ + where: exists("log.machinename") && !oneOf("log.machinename", ["", "-", "N/A"]) && oneOf("log.pa_type", ["HIP-MATCH", + "GLOBALPROTECT"]) + - grok: + source: log.os + patterns: + - fieldName: origin.operatingSystem + pattern: (?s)^.+$ + where: exists("log.os") && !oneOf("log.os", ["", "-", "N/A"]) && equals("log.pa_type", "HIP-MATCH") + - grok: + source: log.client_os + patterns: + - fieldName: origin.operatingSystem + pattern: (?s)^.+$ + where: exists("log.client_os") && !oneOf("log.client_os", ["", "-", "N/A"]) && equals("log.pa_type", "GLOBALPROTECT") + - grok: + source: log.mac + patterns: + - fieldName: origin.mac + pattern: (?s)^.+$ + where: exists("log.mac") && !oneOf("log.mac", ["", "-", "N/A"]) && equals("log.pa_type", "HIP-MATCH") && regexMatch("log.mac", + "^(?:[0-9A-Fa-f]{2}[:-]){5}[0-9A-Fa-f]{2}$") + - grok: + source: log.host + patterns: + - fieldName: origin.host + pattern: (?s)^.+$ + where: exists("log.host") && !oneOf("log.host", ["", "-", "N/A"]) && equals("log.pa_type", "CONFIG") && !((inCIDR("log.host", + "0.0.0.0/0") || inCIDR("log.host", "::/0")) && !inCIDR("log.host", "0.0.0.0/32") && !inCIDR("log.host", + "::/128")) + - grok: + source: log.srchost + patterns: + - fieldName: origin.host + pattern: (?s)^.+$ + where: exists("log.srchost") && !oneOf("log.srchost", ["", "-", "N/A"]) && oneOf("log.paFormat", ["CEF", "LEEF-legacy"]) + && !equals("log.pa_type", "CONFIG") + - grok: + source: log.proto + patterns: + - fieldName: protocol + pattern: (?s)^.+$ + where: exists("log.proto") && !oneOf("log.proto", ["", "-", "N/A"]) + - grok: + source: log.act + patterns: + - fieldName: action + pattern: (?s)^.+$ + where: exists("log.act") && !oneOf("log.act", ["", "-", "N/A"]) + - grok: + source: log.cmd + patterns: + - fieldName: action + pattern: (?s)^.+$ + where: exists("log.cmd") && !oneOf("log.cmd", ["", "-", "N/A"]) && equals("log.pa_type", "CONFIG") + - grok: + source: log.eventid + patterns: + - fieldName: action + pattern: (?s)^.+$ + where: exists("log.eventid") && !oneOf("log.eventid", ["", "-", "N/A"]) && oneOf("log.pa_type", ["SYSTEM", + "GLOBALPROTECT", "IPTAG", "USERID"]) + - grok: + source: log.event + patterns: + - fieldName: action + pattern: (?s)^.+$ + where: exists("log.event") && !oneOf("log.event", ["", "-", "N/A"]) && equals("log.pa_type", "AUTHENTICATION") + - grok: + source: log.spt + patterns: + - fieldName: origin.port + pattern: (?s)^.+$ + where: exists("log.spt") && !oneOf("log.spt", ["", "-", "N/A"]) && regexMatch("log.spt", "^[0-9]{1,5}$") && + !greaterThan("log.spt", 65535) + - cast: + fields: + - origin.port + to: int + where: exists("origin.port") + - grok: + source: log.dpt + patterns: + - fieldName: target.port + pattern: (?s)^.+$ + where: exists("log.dpt") && !oneOf("log.dpt", ["", "-", "N/A"]) && regexMatch("log.dpt", "^[0-9]{1,5}$") && + !greaterThan("log.dpt", 65535) + - cast: + fields: + - target.port + to: int + where: exists("target.port") + - grok: + source: log.bytes_sent + patterns: + - fieldName: origin.bytesSent + pattern: (?s)^.+$ + where: exists("log.bytes_sent") && !oneOf("log.bytes_sent", ["", "-", "N/A"]) && regexMatch("log.bytes_sent", + "^[0-9]{1,16}$") && !greaterThan("log.bytes_sent", 9007199254740991) + - cast: + fields: + - origin.bytesSent + to: float + where: exists("origin.bytesSent") + - grok: + source: log.bytes_received + patterns: + - fieldName: origin.bytesReceived + pattern: (?s)^.+$ + where: exists("log.bytes_received") && !oneOf("log.bytes_received", ["", "-", "N/A"]) && regexMatch("log.bytes_received", + "^[0-9]{1,16}$") && !greaterThan("log.bytes_received", 9007199254740991) + - cast: + fields: + - origin.bytesReceived + to: float + where: exists("origin.bytesReceived") + - grok: + source: log.pkts_sent + patterns: + - fieldName: origin.packagesSent + pattern: (?s)^.+$ + where: exists("log.pkts_sent") && !oneOf("log.pkts_sent", ["", "-", "N/A"]) && regexMatch("log.pkts_sent", + "^[0-9]{1,16}$") && !greaterThan("log.pkts_sent", 9007199254740991) + - cast: + fields: + - origin.packagesSent + to: int + where: exists("origin.packagesSent") + - grok: + source: log.pkts_received + patterns: + - fieldName: origin.packagesReceived + pattern: (?s)^.+$ + where: exists("log.pkts_received") && !oneOf("log.pkts_received", ["", "-", "N/A"]) && regexMatch("log.pkts_received", + "^[0-9]{1,16}$") && !greaterThan("log.pkts_received", 9007199254740991) + - cast: + fields: + - origin.packagesReceived + to: int + where: exists("origin.packagesReceived") + - add: + function: string + params: + key: actionResult + value: success + where: equals("log.pa_type", "TRAFFIC") && equalsIgnoreCase("action", "allow") + - add: + function: string + params: + key: actionResult + value: denied + where: oneOf("log.pa_type", ["TRAFFIC", "THREAT", "DECRYPTION", "SCTP", "GTP", "TUNNEL", "START", "END"]) + && oneOf("action", ["deny", "drop", "drop-all-packets", "reset-client", "reset-server", "reset-both", "block-url", + "block-ip", "random-drop", "sinkhole", "block-continue", "block-override", "override-lockout"]) + - add: + function: string + params: + key: actionResult + value: denied + where: equals("log.pa_type", "THREAT") && equals("log.pa_type", "THREAT") && equals("log.pa_subtype", "wildfire") + && equals("action", "block") + - add: + function: string + params: + key: actionResult + value: success + where: equals("log.pa_type", "CONFIG") && equals("log.result", "Succeeded") + - add: + function: string + params: + key: actionResult + value: failure + where: equals("log.pa_type", "CONFIG") && equals("log.result", "Failed") + - add: + function: string + params: + key: actionResult + value: denied + where: equals("log.pa_type", "CONFIG") && equals("log.result", "Unauthorized") + - add: + function: string + params: + key: actionResult + value: failure + where: equals("log.pa_type", "SYSTEM") && equals("log.eventid", "auth-fail") + - add: + function: string + params: + key: actionResult + value: success + where: equals("log.pa_type", "SYSTEM") && equals("log.eventid", "auth-success") + - add: + function: string + params: + key: actionResult + value: success + where: equals("log.pa_type", "GLOBALPROTECT") && equals("log.status", "success") + - add: + function: string + params: + key: actionResult + value: failure + where: equals("log.pa_type", "GLOBALPROTECT") && equals("log.status", "failure") + - add: + function: string + params: + key: severity + value: info + where: equals("log.severityLabel", "informational") + - add: + function: string + params: + key: severity + value: info + where: equals("log.severityLabel", "low") + - add: + function: string + params: + key: severity + value: warning + where: equals("log.severityLabel", "medium") + - add: + function: string + params: + key: severity + value: error + where: equals("log.severityLabel", "high") + - add: + function: string + params: + key: severity + value: critical + where: equals("log.severityLabel", "critical") + - grok: + source: log.high_res_timestamp + patterns: + - fieldName: deviceTime + pattern: (?s)^.+$ + where: exists("log.high_res_timestamp") && !oneOf("log.high_res_timestamp", ["", "-", "N/A"]) && regexMatch("log.high_res_timestamp", + "^\\d{4}-\\d{2}-\\d{2}T\\d{2}:\\d{2}:\\d{2}(?:\\.\\d+)?(?:Z|[+-]\\d{2}:\\d{2})$") + - grok: + source: log.http_status_code + patterns: + - fieldName: statusCode + pattern: (?s)^.+$ + where: exists("log.http_status_code") && !oneOf("log.http_status_code", ["", "-", "N/A"]) && regexMatch("log.http_status_code", + "^[1-5][0-9]{2}$") + - cast: + fields: + - statusCode + to: int + where: exists("statusCode") + - grok: + source: log.misc + patterns: + - fieldName: target.url + pattern: (?s)^.+$ + where: exists("log.misc") && !oneOf("log.misc", ["", "-", "N/A"]) && equals("log.pa_type", "THREAT") && equals("log.pa_subtype", + "url") && regexMatch("log.misc", "(?i)^https?://[^/?#[:space:]]+(?:[/?#][^[:space:]]*)?$") + - grok: + source: log.filedigest + patterns: + - fieldName: target.md5 + pattern: (?s)^.+$ + where: exists("log.filedigest") && !oneOf("log.filedigest", ["", "-", "N/A"]) && equals("log.pa_type", "THREAT") + && equals("log.paDirection", "client-to-server") && regexMatch("log.filedigest", "^[A-Fa-f0-9]{32}$") + - grok: + source: log.filedigest + patterns: + - fieldName: target.sha1 + pattern: (?s)^.+$ + where: exists("log.filedigest") && !oneOf("log.filedigest", ["", "-", "N/A"]) && equals("log.pa_type", "THREAT") + && equals("log.paDirection", "client-to-server") && regexMatch("log.filedigest", "^[A-Fa-f0-9]{40}$") + - grok: + source: log.filedigest + patterns: + - fieldName: target.sha256 + pattern: (?s)^.+$ + where: exists("log.filedigest") && !oneOf("log.filedigest", ["", "-", "N/A"]) && equals("log.pa_type", "THREAT") + && equals("log.paDirection", "client-to-server") && regexMatch("log.filedigest", "^[A-Fa-f0-9]{64}$") + - grok: + source: log.filedigest + patterns: + - fieldName: origin.md5 + pattern: (?s)^.+$ + where: exists("log.filedigest") && !oneOf("log.filedigest", ["", "-", "N/A"]) && equals("log.pa_type", "THREAT") + && equals("log.paDirection", "server-to-client") && regexMatch("log.filedigest", "^[A-Fa-f0-9]{32}$") + - grok: + source: log.filedigest + patterns: + - fieldName: origin.sha1 + pattern: (?s)^.+$ + where: exists("log.filedigest") && !oneOf("log.filedigest", ["", "-", "N/A"]) && equals("log.pa_type", "THREAT") + && equals("log.paDirection", "server-to-client") && regexMatch("log.filedigest", "^[A-Fa-f0-9]{40}$") + - grok: + source: log.filedigest + patterns: + - fieldName: origin.sha256 + pattern: (?s)^.+$ + where: exists("log.filedigest") && !oneOf("log.filedigest", ["", "-", "N/A"]) && equals("log.pa_type", "THREAT") + && equals("log.paDirection", "server-to-client") && regexMatch("log.filedigest", "^[A-Fa-f0-9]{64}$") + - grok: + source: log.serial + patterns: + - fieldName: log.paScope + pattern: (?s)^.+$ + where: exists("log.serial") && !oneOf("log.serial", ["", "-", "N/A"]) + - add: + function: string + params: + key: log.paVsys + value: none + where: '!(exists("log.vsys") && !oneOf("log.vsys", ["", "-", "N/A"]))' + - grok: + source: log.vsys + patterns: + - fieldName: log.paVsys + pattern: (?s)^.+$ + where: exists("log.vsys") && !oneOf("log.vsys", ["", "-", "N/A"]) + - grok: + source: log.device_name + patterns: + - fieldName: target.host + pattern: (?s)^.+$ + where: exists("log.device_name") && !oneOf("log.device_name", ["", "-", "N/A"]) && ((equals("log.pa_type", "SYSTEM") + && oneOf("log.eventid", ["auth-fail", "auth-success"])) || equals("log.pa_type", "CONFIG")) + - add: + function: string + params: + key: actionResult + value: denied + where: equals("log.pa_type", "TRAFFIC") && oneOf("log.session_end_reason", ["threat", "policy-deny", "decrypt-cert-validation", + "decrypt-unsupport-param", "decrypt-error"]) + - add: + function: string + params: + key: actionResult + value: failure + where: equals("log.pa_type", "TRAFFIC") && equals("log.session_end_reason", "resources-unavailable") + - dynamic: + plugin: com.utmstack.geolocation + params: + source: origin.ip + destination: origin.geolocation + where: exists("origin.ip") + - dynamic: + plugin: com.utmstack.geolocation + params: + source: target.ip + destination: target.geolocation + where: exists("target.ip") + - delete: + fields: + - log.paEnvelope + - log.paPayload + - log.paCefPrefix + - log.paSep1 + - log.paSep2 + - log.paSep3 + - log.paSep4 + - log.paCefExtensions + - log.paIgnored + - log.paSuffix + - log.paAuthPrefix + - log.paAuthMiddle + - log.paAuthSuffix + - add: + function: string + params: + key: log.correlationCandidate.paloalto.authFailure + value: match + where: equals("log.pa_type", "SYSTEM") && equals("log.eventid", "auth-fail") && equals("actionResult", "failure") + && exists("origin.ip") && exists("dataSource") && !equals("dataSource", "") && exists("log.paScope") && + exists("log.paVsys") + - add: + function: string + params: + key: log.correlationCandidate.paloalto.dns + value: match + where: equals("log.pa_type", "THREAT") && (equals("log.pa_subtype", "dns") || (equals("log.pa_subtype", "spyware") + && (equals("action", "sinkhole") || oneOf("log.thr_category", ["dns-c2", "dns-malware"])))) && oneOf("action", + ["sinkhole", "block-url", "alert", "drop", "reset-both", "reset-client", "reset-server", "block-ip"]) && + exists("origin.ip") && exists("dataSource") && !equals("dataSource", "") && exists("log.paScope") && exists("log.paVsys") + - add: + function: string + params: + key: log.correlationCandidate.paloalto.url + value: match + where: equals("log.pa_type", "THREAT") && equals("log.pa_subtype", "url") && oneOf("action", ["block-url", + "block-page", "block-continue", "block-override", "alert"]) && oneOf("log.category", ["malware", "phishing", + "command-and-control", "grayware", "hacking"]) && exists("origin.ip") && exists("dataSource") && !equals("dataSource", + "") && exists("log.paScope") && exists("log.paVsys") + - add: + function: string + params: + key: log.correlationCandidate.paloalto.vulnerability + value: match + where: equals("log.pa_type", "THREAT") && oneOf("log.pa_subtype", ["vulnerability", "exploit"]) && oneOf("log.severityLabel", + ["high", "critical"]) && (contains("log.pa_threatid", "CVE") || equals("log.category", "unknown")) && exists("target.ip") + && exists("origin.ip") && exists("dataSource") && !equals("dataSource", "") && exists("log.paScope") && + exists("log.paVsys") && oneOf("log.paDirection", ["client-to-server", "server-to-client"]) diff --git a/plugins/alerts/paloalto_contract_test.go b/plugins/alerts/paloalto_contract_test.go new file mode 100644 index 000000000..740703f62 --- /dev/null +++ b/plugins/alerts/paloalto_contract_test.go @@ -0,0 +1,483 @@ +package main + +// Offline Palo Alto extraction model, not the closed EventProcessor. +// Explicit YAML grok/CSV/rename/cast/trim/add/delete operations are +// modeled. CEL, Event serialization, placeholder expansion, query creation and +// history thresholds use SDK v1.1.33. External geolocation is not executed. +import ( + "bytes" + "encoding/csv" + "encoding/json" + "fmt" + "io" + "net" + "os" + "path/filepath" + "reflect" + "regexp" + "strings" + "testing" + "text/template" + "time" + + "github.com/threatwinds/go-sdk/plugins" + "github.com/threatwinds/go-sdk/utils" + "github.com/tidwall/gjson" + "google.golang.org/protobuf/encoding/protojson" +) + +type paloaltoFixture struct { + Name string `json:"name"` + DataSource string `json:"dataSource"` + Raw string `json:"raw"` + Expected map[string]any `json:"expected"` + Absent []string `json:"absent"` + Matches []string `json:"matches"` + AlertSides map[string][]string `json:"alertSides"` +} + +func paloaltoPut(m map[string]any, path string, value any, remove bool) { + p := strings.Split(path, ".") + for _, k := range p[:len(p)-1] { + n, ok := m[k].(map[string]any) + if !ok { + if remove { + return + } + n = map[string]any{} + m[k] = n + } + m = n + } + if remove { + delete(m, p[len(p)-1]) + } else { + m[p[len(p)-1]] = value + } +} +func paloaltoGet(m map[string]any, p string) (any, bool) { + var v any = m + for _, k := range strings.Split(p, ".") { + n, ok := v.(map[string]any) + if !ok { + return nil, false + } + v, ok = n[k] + if !ok { + return nil, false + } + } + return v, true +} +func paloaltoConfig(t *testing.T) *plugins.Config { + t.Helper() + b, e := utils.ReadPbYaml("../../filters/paloalto/pa_firewall.yml") + if e != nil { + t.Fatal(e) + } + c := new(plugins.Config) + if e = protojson.Unmarshal(b, c); e != nil { + t.Fatal(e) + } + return c +} +func paloaltoRegex(t *testing.T, g *plugins.Grok, cfg *plugins.Config) *regexp.Regexp { + t.Helper() + var pattern strings.Builder + for i, p := range g.Patterns { + if p.FieldName != "" { + fmt.Fprintf(&pattern, "(?P%s)", i, p.Pattern) + } else { + pattern.WriteString("(?:" + p.Pattern + ")") + } + } + pats := map[string]string{"greedy": ".*", "data": ".*?", "word": "[A-Za-z0-9_-]+", "space": "\\s+"} + for k, v := range cfg.Patterns { + pats[k] = v + } + tmpl, e := template.New("grok").Option("missingkey=error").Parse(pattern.String()) + if e != nil { + t.Fatal(e) + } + var b bytes.Buffer + if e = tmpl.Execute(&b, pats); e != nil { + t.Fatal(e) + } + r, e := regexp.Compile(b.String()) + if e != nil { + t.Fatal(e) + } + return r +} +func paloaltoParse(t *testing.T, cfg *plugins.Config, raw string, dataSource string, cache *plugins.CELCache) string { + t.Helper() + draft := map[string]any{"raw": raw, "dataType": "firewall-paloalto", "dataSource": dataSource, "log": map[string]any{}} + for _, stage := range cfg.Pipeline { + matched := false + for _, dataType := range stage.DataTypes { + if dataType == "firewall-paloalto" { + matched = true + } + } + if !matched { + continue + } + for _, s := range stage.Steps { + b, e := protojson.Marshal(s) + if e != nil { + t.Fatal(e) + } + var step map[string]map[string]any + if e = json.Unmarshal(b, &step); e != nil { + t.Fatal(e) + } + for kind, body := range step { + if w, ok := body["where"].(string); ok && w != "" { + snapshot, err := json.Marshal(draft) + if err != nil { + t.Fatal(err) + } + match, e := cache.Eval(w, string(snapshot)) + if e != nil { + t.Fatal(e) + } + if !match { + continue + } + } + switch kind { + case "grok": + g := s.Grok + src := g.Source + if src == "" { + src = "raw" + } + v, ok := paloaltoGet(draft, src) + if !ok { + continue + } + str, ok := v.(string) + if !ok { + t.Fatalf("non-string grok source %s", src) + } + r := paloaltoRegex(t, g, cfg) + m := r.FindStringSubmatch(str) + if m == nil { + continue + } + for i, p := range g.Patterns { + if p.FieldName != "" { + paloaltoPut(draft, p.FieldName, m[r.SubexpIndex(fmt.Sprintf("f%d", i))], false) + } + } + case "csv": + v, ok := paloaltoGet(draft, s.Csv.Source) + if !ok { + continue + } + reader := csv.NewReader(strings.NewReader(fmt.Sprint(v))) + reader.FieldsPerRecord = -1 + reader.Comma = []rune(s.Csv.Separator)[0] + record, err := reader.Read() + if err != nil { + t.Fatalf("CSV: %v", err) + } + if _, err = reader.Read(); err != io.EOF { + t.Fatalf("multiple CSV records: %v", err) + } + for i, field := range s.Csv.Headers { + if i < len(record) { + paloaltoPut(draft, field, record[i], false) + } + } + case "rename": + for _, p := range s.Rename.From { + if v, ok := paloaltoGet(draft, p); ok { + paloaltoPut(draft, s.Rename.To, v, false) + paloaltoPut(draft, p, nil, true) + break + } + } + case "trim": + for _, p := range s.Trim.Fields { + if v, ok := paloaltoGet(draft, p); ok { + str, ok := v.(string) + if !ok { + continue + } + switch s.Trim.Function { + case "prefix": + str = strings.TrimPrefix(str, s.Trim.Substring) + case "suffix": + str = strings.TrimSuffix(str, s.Trim.Substring) + default: + t.Fatalf("unsupported trim %s", s.Trim.Function) + } + paloaltoPut(draft, p, str, false) + } + } + case "add": + if s.Add.Function != "string" { + t.Fatalf("unsupported add function %s", s.Add.Function) + } + paloaltoPut(draft, s.Add.Params["key"].GetStringValue(), s.Add.Params["value"].AsInterface(), false) + case "delete": + for _, p := range s.Delete.Fields { + paloaltoPut(draft, p, nil, true) + } + case "kv": + v, ok := paloaltoGet(draft, s.Kv.Source) + if !ok { + continue + } + // Observed KV output splits quoted multiword values. + // Explicit YAML grok steps rebuild consumed fields afterward. + for _, item := range strings.Split(v.(string), s.Kv.FieldSplit) { + pair := strings.SplitN(item, s.Kv.ValueSplit, 2) + if len(pair) != 2 { + continue + } + key := pair[0] + utils.SanitizeField(&key) + if key != "" { + paloaltoPut(draft, "log."+key, pair[1], false) + } + } + case "dynamic": + if s.Dynamic.Plugin != "com.utmstack.geolocation" { + t.Fatalf("unsupported dynamic plugin %s", s.Dynamic.Plugin) + } + field := s.Dynamic.Params["source"].GetStringValue() + v, ok := paloaltoGet(draft, field) + if !ok { + t.Fatalf("missing dynamic source %s", field) + } + ip := net.ParseIP(fmt.Sprint(v)) + if ip == nil || ip.IsUnspecified() { + t.Fatalf("invalid address reaches geolocation: %s", field) + } + // The external geolocation service is not executed. + case "json": + source, ok := paloaltoGet(draft, s.Json.Source) + if !ok { + continue + } + str, ok := source.(string) + if !ok { + t.Fatalf("JSON source is not a string") + } + var parsed map[string]any + if e := json.Unmarshal([]byte(str), &parsed); e != nil { + t.Fatal(e) + } + for key, value := range paloaltoSanitizeJSON(parsed) { + paloaltoPut(draft, "log."+key, value, false) + } + case "reformat": + for _, field := range s.Reformat.Fields { + value, ok := paloaltoGet(draft, field) + if !ok { + continue + } + stamp, err := time.Parse(s.Reformat.FromFormat, fmt.Sprint(value)) + if err != nil { + t.Fatalf("time conversion %s: %v", field, err) + } + paloaltoPut(draft, field, stamp.Format(s.Reformat.ToFormat), false) + } + case "cast": + for _, field := range s.Cast.Fields { + if value, ok := paloaltoGet(draft, field); ok { + switch s.Cast.To { + case "string": + paloaltoPut(draft, field, utils.CastString(value), false) + case "float": + paloaltoPut(draft, field, utils.CastFloat64(value), false) + case "int": + paloaltoPut(draft, field, utils.CastInt64(value), false) + default: + t.Fatalf("unsupported cast %s", s.Cast.To) + } + } + } + case "drop": + return "" + default: + t.Fatalf("unsupported filter step %s", kind) + } + } + } + } + b, e := json.Marshal(draft) + if e != nil { + t.Fatal(e) + } + in := string(b) + ev := new(plugins.Event) + if e = protojson.Unmarshal([]byte(in), ev); e != nil { + t.Fatal(e) + } + out, e := utils.ProtoMessageToString(ev) + if e != nil { + t.Fatal(e) + } + return *out +} +func paloaltoRules(t *testing.T) map[string]*plugins.Rule { + t.Helper() + paths, e := filepath.Glob("../../rules/paloalto/pa_firewall/*.yml") + if e != nil { + t.Fatal(e) + } + out := map[string]*plugins.Rule{} + for _, p := range paths { + b, e := utils.ReadPbYaml(p) + if e != nil { + t.Fatal(e) + } + r := new(plugins.Rule) + if e = protojson.Unmarshal(b, r); e != nil { + t.Fatal(e) + } + r.Normalize() + out[strings.TrimSuffix(filepath.Base(p), ".yml")] = r + } + return out +} + +func paloaltoSanitizeJSON(input map[string]any) map[string]any { + out := map[string]any{} + for key, value := range input { + utils.SanitizeField(&key) + if nested, ok := value.(map[string]any); ok { + value = paloaltoSanitizeJSON(nested) + } + out[key] = value + } + return out +} + +func paloaltoFixtures(t *testing.T) []paloaltoFixture { + t.Helper() + b, e := os.ReadFile("testdata/paloalto_raw.json") + if e != nil { + t.Fatal(e) + } + var cases []paloaltoFixture + if e = json.Unmarshal(b, &cases); e != nil { + t.Fatal(e) + } + return cases +} + +func paloaltoCheck(t *testing.T, fixtures []paloaltoFixture) { + cfg, rules, cache := paloaltoConfig(t), paloaltoRules(t), plugins.NewCELCache("paloalto") + if len(rules) != 11 { + t.Fatalf("rules: %d", len(rules)) + } + coverage := map[string]int{} + for _, f := range fixtures { + for _, name := range f.Matches { + coverage[name]++ + } + } + if len(fixtures) > 60 { + for name := range rules { + if coverage[name] == 0 || coverage[name] == len(fixtures) { + t.Fatalf("missing positive/negative coverage for %s", name) + } + } + } + for _, f := range fixtures { + t.Run(f.Name, func(t *testing.T) { + out := paloaltoParse(t, cfg, f.Raw, f.DataSource, cache) + for field, want := range f.Expected { + got := gjson.Get(out, field) + if !got.Exists() || !reflect.DeepEqual(got.Value(), want) { + t.Errorf("%s got %v want %v", field, got.Value(), want) + } + } + for _, field := range f.Absent { + if gjson.Get(out, field).Exists() { + t.Errorf("unexpected %s", field) + } + } + if gjson.Get(out, "raw").String() != f.Raw { + t.Error("raw changed") + } + expect := map[string]bool{} + for _, n := range f.Matches { + expect[n] = true + } + for name, r := range rules { + matched, err := cache.Eval(r.Where, out) + if err != nil { + t.Fatal(err) + } + if matched != expect[name] { + t.Errorf("%s matched %v want %v", name, matched, expect[name]) + } + if !matched { + continue + } + event := new(plugins.Event) + if err := protojson.Unmarshal([]byte(out), event); err != nil { + t.Fatal(err) + } + alert := &plugins.Alert{Events: []*plugins.Event{event}} + switch r.Adversary { + case "origin": + alert.Adversary, alert.Target = event.Origin, event.Target + case "target": + alert.Adversary, alert.Target = event.Target, event.Origin + default: + t.Fatalf("unsupported adversary %s", r.Adversary) + } + if sides, ok := f.AlertSides[name]; ok { + if len(sides) != 2 || alert.GetAdversary().GetIp() != sides[0] || alert.GetTarget().GetIp() != sides[1] { + t.Errorf("%s alert endpoints do not match independent expectation %v", name, sides) + } + } else if strings.HasPrefix(f.DataSource, "synthetic-") { + t.Errorf("missing independent alert sides for %s", name) + } + wire, err := utils.ProtoMessageToString(alert) + if err != nil { + t.Fatal(err) + } + for _, field := range r.GroupBy { + path := strings.Replace(field, "lastEvent.", "events.0.", 1) + if (field == "lastEvent.dataSource" || field == "lastEvent.log.paScope" || field == "lastEvent.log.paVsys") && !gjson.Get(*wire, path).Exists() { + t.Errorf("grouping scope missing: %s", field) + } + } + for _, search := range r.Correlation { + for _, term := range search.With { + v := term.Value.GetStringValue() + if strings.HasPrefix(v, "{{.") { + field := strings.TrimSuffix(strings.TrimPrefix(v, "{{."), "}}") + if !gjson.Get(out, field).Exists() { + t.Errorf("unresolved %s", field) + } + } + } + } + } + }) + } +} +func TestPaloAltoRawContracts(t *testing.T) { paloaltoCheck(t, paloaltoFixtures(t)) } +func TestPaloAltoPrivateContracts(t *testing.T) { + path := os.Getenv("PALOALTO_PRIVATE_FIXTURES") + if path == "" { + t.Skip("private fixtures not supplied") + } + b, e := os.ReadFile(path) + if e != nil { + t.Fatal(e) + } + var f []paloaltoFixture + if e = json.Unmarshal(b, &f); e != nil { + t.Fatal(e) + } + paloaltoCheck(t, f) +} diff --git a/plugins/alerts/paloalto_history_test.go b/plugins/alerts/paloalto_history_test.go new file mode 100644 index 000000000..c980be7e8 --- /dev/null +++ b/plugins/alerts/paloalto_history_test.go @@ -0,0 +1,204 @@ +package main + +// SDK history contracts for synthetic PaloAlto events. Extraction uses the +// documented offline model in paloalto_contract_test.go; all search requests, +// placeholder expansion, mapping lookup and count decisions use the pinned SDK. +// The HTTP server below is loopback-only and never queries a customer instance. +import ( + "encoding/json" + "fmt" + "io" + "net/http" + "net/http/httptest" + "os" + "os/exec" + "strings" + "testing" + "time" + + sdkos "github.com/threatwinds/go-sdk/os" + "github.com/threatwinds/go-sdk/plugins" + "github.com/tidwall/gjson" +) + +func TestPaloAltoSDKHistory(t *testing.T) { + // The SDK owns a process-wide OpenSearch singleton. Isolate this local mock + // so other technology tests can initialize their own clients in this suite. + if os.Getenv("UTM_PALOALTO_HISTORY_CHILD") != "1" { + command := exec.Command(os.Args[0], "-test.run=^TestPaloAltoSDKHistory$") + command.Env = append(os.Environ(), "UTM_PALOALTO_HISTORY_CHILD=1") + if out, e := command.CombinedOutput(); e != nil { + t.Fatalf("isolated history test: %v\n%s", e, out) + } + return + } + + cfg, rules, cache := paloaltoConfig(t), paloaltoRules(t), plugins.NewCELCache("paloalto-history") + var history []string + var expectedClauses int + server := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) { + w.Header().Set("Content-Type", "application/json") + if strings.HasSuffix(r.URL.Path, "/_mapping") { + // Text fields exercise the SDK's .keyword mapping resolution; IP and + // keyword fields exercise exact mappings without that suffix. + _, _ = io.WriteString(w, `{"v11-log-firewall-paloalto-test":{"mappings":{"properties":{"@timestamp":{"type":"date"},"dataSource":{"type":"text","fields":{"keyword":{"type":"keyword"}}},"origin":{"properties":{"ip":{"type":"ip"}}},"target":{"properties":{"ip":{"type":"ip"}}},"log":{"properties":{"paScope":{"type":"keyword"},"paVsys":{"type":"keyword"},"paDirection":{"type":"keyword"},"correlationCandidate":{"properties":{"paloalto":{"properties":{"authFailure":{"type":"keyword"},"dns":{"type":"keyword"},"url":{"type":"keyword"},"vulnerability":{"type":"keyword"}}}}}}}}}}}`) + return + } + if r.URL.Path != "/v11-log-firewall-paloalto-*/_search" { + t.Errorf("unexpected path %s", r.URL.Path) + http.Error(w, "unsupported request", http.StatusBadRequest) + return + } + b, e := io.ReadAll(r.Body) + if e != nil { + t.Error(e) + return + } + query := string(b) + clauses := append(gjson.Get(query, "query.bool.must").Array(), gjson.Get(query, "query.bool.filter").Array()...) + if len(clauses) != expectedClauses { + t.Errorf("history clauses: got %d want %d: %s", len(clauses), expectedClauses, query) + } + hits := []map[string]any{} + for _, doc := range history { + yes := true + for _, clause := range clauses { + if term := clause.Get("term"); term.Exists() { + for field, v := range term.Map() { + value := gjson.Get(doc, strings.TrimSuffix(field, ".keyword")) + if !value.Exists() || value.String() != v.Get("value").String() { + yes = false + } + } + } else if span := clause.Get("range"); span.Exists() { + for field, limits := range span.Map() { + stamp, e := time.Parse(time.RFC3339Nano, gjson.Get(doc, field).String()) + if e != nil { + t.Error(e) + } + cutoff, e := time.Parse(time.RFC3339Nano, limits.Get("gte").String()) + if e != nil { + t.Error(e) + } + if stamp.Before(cutoff) { + yes = false + } + } + } else { + t.Errorf("unsupported clause %s", clause.Raw) + yes = false + } + } + if yes { + hits = append(hits, map[string]any{"_id": fmt.Sprint(len(hits)), "_index": "v11-log-firewall-paloalto-test", "_source": map[string]any{}}) + } + } + _ = json.NewEncoder(w).Encode(map[string]any{"took": 1, "hits": map[string]any{"total": map[string]any{"value": len(hits), "relation": "eq"}, "hits": hits}}) + })) + defer server.Close() + if e := sdkos.Connect([]string{server.URL}, "", ""); e != nil { + t.Fatal(e) + } + mutate := func(doc, field string, value any) string { + var m map[string]any + if e := json.Unmarshal([]byte(doc), &m); e != nil { + t.Fatal(e) + } + paloaltoPut(m, field, value, value == nil) + b, e := json.Marshal(m) + if e != nil { + t.Fatal(e) + } + return string(b) + } + + // All fixture names refer to fabricated documentation-shaped raw logs. + // Require each named case so a missing fixture cannot silently skip a rule. + fixtures := map[string]paloaltoFixture{} + for _, fixture := range paloaltoFixtures(t) { + fixtures[fixture.Name] = fixture + } + + cases := []struct { + name, marker, benign string + count uint64 + within string + }{ + {"panos_admin_brute_force", "authFailure", "successful-auth", 10, "15m"}, + {"panos_dns_security_alerts", "dns", "ordinary-spyware-not-dns-history-candidate", 3, "30m"}, + {"panos_url_filtering_blocks", "url", "benign-url-block-not-history-candidate", 5, "30m"}, + {"zero_day_exploit_prevention", "vulnerability", "low-vulnerability-not-history-candidate", 2, "30m"}, + {"zero_day_exploit_prevention_server_to_client", "vulnerability", "low-vulnerability-not-history-candidate", 2, "30m"}, + } + for _, c := range cases { + t.Run(c.name, func(t *testing.T) { + fixture, ok := fixtures["positive-"+c.name] + if !ok { + t.Fatal("missing positive fixture") + } + rule := rules[c.name] + if rule == nil || len(rule.Correlation) != 1 { + t.Fatal("missing history") + } + search := rule.Correlation[0] + if search.Count != c.count || search.Within != c.within { + t.Fatal("threshold changed") + } + expectedClauses = len(search.With) + 1 + out := paloaltoParse(t, cfg, fixture.Raw, fixture.DataSource, cache) + marker := "log.correlationCandidate.paloalto." + c.marker + if match, e := cache.Eval(rule.Where, out); e != nil || !match || gjson.Get(out, marker).String() != "match" { + t.Fatal("positive predicate/marker mismatch") + } + prior := mutate(out, "@timestamp", time.Now().Add(-time.Minute).UTC().Format(time.RFC3339Nano)) + check := func(name, doc string, count uint64, want bool) { + t.Run(name, func(t *testing.T) { + history = nil + for i := uint64(0); i < count; i++ { + history = append(history, doc) + } + yes, _, err := search.Execute(&out) + if err != nil || yes != want { + t.Fatalf("history got %v want %v: %v", yes, want, err) + } + }) + } + check("below_threshold", prior, c.count-1, false) + check("at_threshold", prior, c.count, true) + duration, e := time.ParseDuration(c.within) + if e != nil { + t.Fatal(e) + } + check("expired", mutate(prior, "@timestamp", time.Now().Add(-duration-time.Minute).UTC().Format(time.RFC3339Nano)), c.count, false) + check("unmarked", mutate(prior, marker, nil), c.count, false) + for _, term := range search.With { + if !strings.HasPrefix(term.Value.GetStringValue(), "{{.") { + continue + } + field := term.Field + check("different_"+field, mutate(prior, field, "203.0.113.99"), c.count, false) + t.Run("missing_"+field, func(t *testing.T) { + missing := mutate(out, field, nil) + if match, e := cache.Eval(rule.Where, missing); e != nil || match { + t.Fatal("predicate allows unresolved identity") + } + if yes, _, e := search.Execute(&missing); e == nil || yes { + t.Fatal("expected SDK missing-placeholder error") + } + }) + } + benign, ok := fixtures[c.benign] + if !ok { + t.Fatal("missing noncandidate fixture") + } + normalized := paloaltoParse(t, cfg, benign.Raw, fixture.DataSource, cache) + if gjson.Get(normalized, "origin.ip").String() != gjson.Get(out, "origin.ip").String() { + t.Fatal("benign comparison must retain source address") + } + if match, e := cache.Eval(rule.Where, normalized); e != nil || match || gjson.Get(normalized, marker).Exists() { + t.Fatal("noncandidate contributes marker") + } + check("benign_raw_history", mutate(normalized, "@timestamp", time.Now().Add(-time.Minute).UTC().Format(time.RFC3339Nano)), c.count, false) + }) + } +} diff --git a/plugins/alerts/testdata/filter-contracts/paloalto.json b/plugins/alerts/testdata/filter-contracts/paloalto.json new file mode 100644 index 000000000..d677bd0cb --- /dev/null +++ b/plugins/alerts/testdata/filter-contracts/paloalto.json @@ -0,0 +1,65 @@ +{ + "technology": "Palo Alto PAN-OS", + "filters": [ + "filters/paloalto/pa_firewall.yml" + ], + "rules": [ + "rules/paloalto/pa_firewall/ioc_threat_intel_match.yml", + "rules/paloalto/pa_firewall/ioc_threat_intel_match_server_to_client.yml", + "rules/paloalto/pa_firewall/panos_admin_brute_force.yml", + "rules/paloalto/pa_firewall/panos_dns_security_alerts.yml", + "rules/paloalto/pa_firewall/panos_spyware_vulnerability.yml", + "rules/paloalto/pa_firewall/panos_spyware_vulnerability_server_to_client.yml", + "rules/paloalto/pa_firewall/panos_url_filtering_blocks.yml", + "rules/paloalto/pa_firewall/wildfire_malware_detection.yml", + "rules/paloalto/pa_firewall/wildfire_malware_detection_server_to_client.yml", + "rules/paloalto/pa_firewall/zero_day_exploit_prevention.yml", + "rules/paloalto/pa_firewall/zero_day_exploit_prevention_server_to_client.yml" + ], + "fixtures": [ + { + "name": "paloalto-reject-input-supplied-correlation-scope", + "filter": "paloalto/pa_firewall.yml", + "input": { + "log": { + "paScope": "forged", + "paVsys": "forged", + "pa_type": "SYSTEM", + "pa_subtype": "auth", + "correlationCandidate": { + "paloalto": { + "authFailure": "match", + "dns": "match", + "url": "match", + "vulnerability": "match" + } + } + } + }, + "expected": { + "log.paVsys": "none" + }, + "absent": [ + "log.paScope", + "log.pa_type", + "log.correlationCandidate.paloalto", + "origin.ip", + "target.ip", + "actionResult" + ], + "rules": { + "rules/paloalto/pa_firewall/ioc_threat_intel_match.yml": false, + "rules/paloalto/pa_firewall/ioc_threat_intel_match_server_to_client.yml": false, + "rules/paloalto/pa_firewall/panos_admin_brute_force.yml": false, + "rules/paloalto/pa_firewall/panos_dns_security_alerts.yml": false, + "rules/paloalto/pa_firewall/panos_spyware_vulnerability.yml": false, + "rules/paloalto/pa_firewall/panos_spyware_vulnerability_server_to_client.yml": false, + "rules/paloalto/pa_firewall/panos_url_filtering_blocks.yml": false, + "rules/paloalto/pa_firewall/wildfire_malware_detection.yml": false, + "rules/paloalto/pa_firewall/wildfire_malware_detection_server_to_client.yml": false, + "rules/paloalto/pa_firewall/zero_day_exploit_prevention.yml": false, + "rules/paloalto/pa_firewall/zero_day_exploit_prevention_server_to_client.yml": false + } + } + ] +} diff --git a/plugins/alerts/testdata/paloalto_raw.json b/plugins/alerts/testdata/paloalto_raw.json new file mode 100644 index 000000000..1bef65a18 --- /dev/null +++ b/plugins/alerts/testdata/paloalto_raw.json @@ -0,0 +1,2106 @@ +[ + { + "name": "positive-panos_admin_brute_force", + "dataSource": "synthetic-collector", + "raw": "<14>Sep 17 12:00:00 synthetic-fw 1,2026/09/17 12:00:00,SYNTH-FW,SYSTEM,auth,2817,2026/09/17 12:00:00,vsys1,auth-fail,,,,general,informational,\"failed authentication for user 'testuser'. Reason: User is not in allowlist. auth profile 'Local', vsys 'vsys1', From: 192.0.2.25.\",1001,,,,,,,synthetic-fw,,,2026-09-17T12:00:00.000-04:00", + "expected": { + "origin.ip": "192.0.2.25", + "origin.user": "testuser", + "target.host": "synthetic-fw", + "action": "auth-fail", + "actionResult": "failure", + "severity": "info", + "deviceTime": "2026-09-17T12:00:00.000-04:00" + }, + "matches": [ + "panos_admin_brute_force" + ], + "absent": [ + "target.ip", + "connectionStatus" + ], + "alertSides": { + "panos_admin_brute_force": [ + "192.0.2.25", + "" + ] + } + }, + { + "name": "successful-auth", + "dataSource": "synthetic-collector", + "raw": "<14>Sep 17 12:00:00 synthetic-fw 1,2026/09/17 12:00:00,SYNTH-FW,SYSTEM,auth,2817,2026/09/17 12:00:00,vsys1,auth-success,,,,general,informational,authenticated for user 'testuser'. From: 192.0.2.25.,1001,,,,,,,synthetic-fw,,,2026-09-17T12:00:00.000-04:00", + "expected": { + "actionResult": "success", + "origin.ip": "192.0.2.25" + }, + "matches": [], + "absent": [ + "connectionStatus" + ], + "alertSides": {} + }, + { + "name": "vpn-negotiation-not-auth-fail", + "dataSource": "synthetic-collector", + "raw": "<14>Sep 17 12:00:00 synthetic-fw 1,2026/09/17 12:00:00,SYNTH-FW,SYSTEM,auth,2817,2026/09/17 12:00:00,vsys1,ike-nego-p1-fail-common,,,,general,informational,IKE negotiation failed with 192.0.2.25.,1001,,,,,,,synthetic-fw,,,2026-09-17T12:00:00.000-04:00", + "expected": { + "action": "ike-nego-p1-fail-common" + }, + "matches": [], + "absent": [ + "origin.ip", + "origin.user", + "actionResult" + ], + "alertSides": {} + }, + { + "name": "message-mentions-auth-fail-with-other-event", + "dataSource": "synthetic-collector", + "raw": "<14>Sep 17 12:00:00 synthetic-fw 1,2026/09/17 12:00:00,SYNTH-FW,SYSTEM,auth,2817,2026/09/17 12:00:00,vsys1,general,,,,general,informational,auth-fail failed authentication for user 'testuser'. From: 192.0.2.25.,1001,,,,,,,synthetic-fw,,,2026-09-17T12:00:00.000-04:00", + "expected": {}, + "matches": [], + "absent": [ + "origin.ip", + "actionResult" + ], + "alertSides": {} + }, + { + "name": "unstructured-auth-source-not-guessed", + "dataSource": "synthetic-collector", + "raw": "<14>Sep 17 12:00:00 synthetic-fw 1,2026/09/17 12:00:00,SYNTH-FW,SYSTEM,auth,2817,2026/09/17 12:00:00,vsys1,auth-fail,,,,general,informational,Authentication failed. Server address 192.0.2.25.,1001,,,,,,,synthetic-fw,,,2026-09-17T12:00:00.000-04:00", + "expected": { + "actionResult": "failure" + }, + "matches": [], + "absent": [ + "origin.ip", + "origin.user" + ], + "alertSides": {} + }, + { + "name": "system-bare", + "dataSource": "synthetic-collector", + "raw": "1,2026/09/17 12:00:00,SYNTH-FW,SYSTEM,auth,2817,2026/09/17 12:00:00,vsys1,auth-fail,,,,general,informational,\"failed authentication for user 'testuser'. Reason: User is not in allowlist. auth profile 'Local', vsys 'vsys1', From: 192.0.2.25.\",1001,,,,,,,synthetic-fw,,,2026-09-17T12:00:00.000-04:00", + "expected": { + "origin.ip": "192.0.2.25", + "actionResult": "failure" + }, + "matches": [ + "panos_admin_brute_force" + ], + "absent": [], + "alertSides": { + "panos_admin_brute_force": [ + "192.0.2.25", + "" + ] + } + }, + { + "name": "system-pri", + "dataSource": "synthetic-collector", + "raw": "<14>1,2026/09/17 12:00:00,SYNTH-FW,SYSTEM,auth,2817,2026/09/17 12:00:00,vsys1,auth-fail,,,,general,informational,\"failed authentication for user 'testuser'. Reason: User is not in allowlist. auth profile 'Local', vsys 'vsys1', From: 192.0.2.25.\",1001,,,,,,,synthetic-fw,,,2026-09-17T12:00:00.000-04:00", + "expected": { + "origin.ip": "192.0.2.25", + "actionResult": "failure" + }, + "matches": [ + "panos_admin_brute_force" + ], + "absent": [], + "alertSides": { + "panos_admin_brute_force": [ + "192.0.2.25", + "" + ] + } + }, + { + "name": "system-rfc5424", + "dataSource": "synthetic-collector", + "raw": "<14>1 2026-09-17T12:00:00Z synthetic-fw PAN-OS - - - 1,2026/09/17 12:00:00,SYNTH-FW,SYSTEM,auth,2817,2026/09/17 12:00:00,vsys1,auth-fail,,,,general,informational,\"failed authentication for user 'testuser'. Reason: User is not in allowlist. auth profile 'Local', vsys 'vsys1', From: 192.0.2.25.\",1001,,,,,,,synthetic-fw,,,2026-09-17T12:00:00.000-04:00", + "expected": { + "origin.ip": "192.0.2.25", + "actionResult": "failure" + }, + "matches": [ + "panos_admin_brute_force" + ], + "absent": [], + "alertSides": { + "panos_admin_brute_force": [ + "192.0.2.25", + "" + ] + } + }, + { + "name": "system-rfc5424-structured", + "dataSource": "synthetic-collector", + "raw": "<14>1 2026-09-17T12:00:00Z synthetic-fw PAN-OS 123 ID47 [meta@123 source=\"test\"] 1,2026/09/17 12:00:00,SYNTH-FW,SYSTEM,auth,2817,2026/09/17 12:00:00,vsys1,auth-fail,,,,general,informational,\"failed authentication for user 'testuser'. Reason: User is not in allowlist. auth profile 'Local', vsys 'vsys1', From: 192.0.2.25.\",1001,,,,,,,synthetic-fw,,,2026-09-17T12:00:00.000-04:00", + "expected": { + "origin.ip": "192.0.2.25", + "actionResult": "failure" + }, + "matches": [ + "panos_admin_brute_force" + ], + "absent": [], + "alertSides": { + "panos_admin_brute_force": [ + "192.0.2.25", + "" + ] + } + }, + { + "name": "csv-description-content-never-selects-layout", + "dataSource": "synthetic-collector", + "raw": "<14>Sep 17 12:00:00 synthetic-fw 1,2026/09/17 12:00:00,SYNTH-FW,SYSTEM,auth,2817,2026/09/17 12:00:00,vsys1,general,,,,general,informational,\"quoted, TRAFFIC, THREAT, GLOBALPROTECT, AUTHENTICATION, \"\"src=198.51.100.66\"\"\",1001,,,,,,,synthetic-fw,,,2026-09-17T12:00:00.000-04:00", + "expected": { + "log.pa_type": "SYSTEM", + "log.opaque": "quoted, TRAFFIC, THREAT, GLOBALPROTECT, AUTHENTICATION, \"src=198.51.100.66\"" + }, + "matches": [], + "absent": [ + "origin.ip", + "target.ip", + "actionResult" + ], + "alertSides": {} + }, + { + "name": "traffic-fields", + "dataSource": "synthetic-collector", + "raw": "<14>Sep 17 12:00:00 synthetic-fw 1,2026/09/17 12:00:00,SYNTH-FW,TRAFFIC,end,2817,2026/09/17 12:00:00,192.0.2.25,198.51.100.40,203.0.113.25,203.0.113.40,test-rule,testuser,server-user,ssl,vsys1,,,,,,,,,45678,443,,,,tcp,allow,300,200,100,12,,,,,,,,,,8,4,tcp-fin,11,22,33,44,virtual-system-name,synthetic-fw,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,client.example,00:11:22:33:44:55,,,,,,,server.example,aa:bb:cc:dd:ee:ff,,,,,,,,,,,2026-09-17T12:00:00.000-04:00", + "expected": { + "origin.ip": "192.0.2.25", + "target.ip": "198.51.100.40", + "origin.user": "testuser", + "target.user": "server-user", + "origin.port": 45678, + "target.port": 443, + "origin.bytesSent": 200, + "origin.bytesReceived": 100, + "origin.packagesSent": "8", + "origin.packagesReceived": "4", + "log.vsys_name": "virtual-system-name", + "log.device_name": "synthetic-fw", + "origin.host": "client.example", + "target.host": "server.example", + "origin.mac": "00:11:22:33:44:55", + "target.mac": "aa:bb:cc:dd:ee:ff", + "actionResult": "success", + "log.natsrc": "203.0.113.25" + }, + "matches": [], + "absent": [ + "connectionStatus", + "target.bytesSent" + ], + "alertSides": {} + }, + { + "name": "traffic-deny", + "dataSource": "synthetic-collector", + "raw": "<14>Sep 17 12:00:00 synthetic-fw 1,2026/09/17 12:00:00,SYNTH-FW,TRAFFIC,end,2817,2026/09/17 12:00:00,192.0.2.25,198.51.100.40,203.0.113.25,203.0.113.40,test-rule,testuser,server-user,ssl,vsys1,,,,,,,,,45678,443,,,,tcp,deny,300,200,100,12,,,,,,,,,,8,4,tcp-fin,11,22,33,44,virtual-system-name,synthetic-fw,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,client.example,00:11:22:33:44:55,,,,,,,server.example,aa:bb:cc:dd:ee:ff,,,,,,,,,,,2026-09-17T12:00:00.000-04:00", + "expected": { + "actionResult": "denied" + }, + "matches": [], + "absent": [ + "connectionStatus" + ], + "alertSides": {} + }, + { + "name": "traffic-drop", + "dataSource": "synthetic-collector", + "raw": "<14>Sep 17 12:00:00 synthetic-fw 1,2026/09/17 12:00:00,SYNTH-FW,TRAFFIC,end,2817,2026/09/17 12:00:00,192.0.2.25,198.51.100.40,203.0.113.25,203.0.113.40,test-rule,testuser,server-user,ssl,vsys1,,,,,,,,,45678,443,,,,tcp,drop,300,200,100,12,,,,,,,,,,8,4,tcp-fin,11,22,33,44,virtual-system-name,synthetic-fw,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,client.example,00:11:22:33:44:55,,,,,,,server.example,aa:bb:cc:dd:ee:ff,,,,,,,,,,,2026-09-17T12:00:00.000-04:00", + "expected": { + "actionResult": "denied" + }, + "matches": [], + "absent": [ + "connectionStatus" + ], + "alertSides": {} + }, + { + "name": "traffic-reset-client", + "dataSource": "synthetic-collector", + "raw": "<14>Sep 17 12:00:00 synthetic-fw 1,2026/09/17 12:00:00,SYNTH-FW,TRAFFIC,end,2817,2026/09/17 12:00:00,192.0.2.25,198.51.100.40,203.0.113.25,203.0.113.40,test-rule,testuser,server-user,ssl,vsys1,,,,,,,,,45678,443,,,,tcp,reset-client,300,200,100,12,,,,,,,,,,8,4,tcp-fin,11,22,33,44,virtual-system-name,synthetic-fw,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,client.example,00:11:22:33:44:55,,,,,,,server.example,aa:bb:cc:dd:ee:ff,,,,,,,,,,,2026-09-17T12:00:00.000-04:00", + "expected": { + "actionResult": "denied" + }, + "matches": [], + "absent": [ + "connectionStatus" + ], + "alertSides": {} + }, + { + "name": "traffic-reset-server", + "dataSource": "synthetic-collector", + "raw": "<14>Sep 17 12:00:00 synthetic-fw 1,2026/09/17 12:00:00,SYNTH-FW,TRAFFIC,end,2817,2026/09/17 12:00:00,192.0.2.25,198.51.100.40,203.0.113.25,203.0.113.40,test-rule,testuser,server-user,ssl,vsys1,,,,,,,,,45678,443,,,,tcp,reset-server,300,200,100,12,,,,,,,,,,8,4,tcp-fin,11,22,33,44,virtual-system-name,synthetic-fw,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,client.example,00:11:22:33:44:55,,,,,,,server.example,aa:bb:cc:dd:ee:ff,,,,,,,,,,,2026-09-17T12:00:00.000-04:00", + "expected": { + "actionResult": "denied" + }, + "matches": [], + "absent": [ + "connectionStatus" + ], + "alertSides": {} + }, + { + "name": "traffic-reset-both", + "dataSource": "synthetic-collector", + "raw": "<14>Sep 17 12:00:00 synthetic-fw 1,2026/09/17 12:00:00,SYNTH-FW,TRAFFIC,end,2817,2026/09/17 12:00:00,192.0.2.25,198.51.100.40,203.0.113.25,203.0.113.40,test-rule,testuser,server-user,ssl,vsys1,,,,,,,,,45678,443,,,,tcp,reset-both,300,200,100,12,,,,,,,,,,8,4,tcp-fin,11,22,33,44,virtual-system-name,synthetic-fw,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,client.example,00:11:22:33:44:55,,,,,,,server.example,aa:bb:cc:dd:ee:ff,,,,,,,,,,,2026-09-17T12:00:00.000-04:00", + "expected": { + "actionResult": "denied" + }, + "matches": [], + "absent": [ + "connectionStatus" + ], + "alertSides": {} + }, + { + "name": "traffic-allow-ended-threat", + "dataSource": "synthetic-collector", + "raw": "<14>Sep 17 12:00:00 synthetic-fw 1,2026/09/17 12:00:00,SYNTH-FW,TRAFFIC,end,2817,2026/09/17 12:00:00,192.0.2.25,198.51.100.40,203.0.113.25,203.0.113.40,test-rule,testuser,server-user,ssl,vsys1,,,,,,,,,45678,443,,,,tcp,allow,300,200,100,12,,,,,,,,,,8,4,threat,11,22,33,44,virtual-system-name,synthetic-fw,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,client.example,00:11:22:33:44:55,,,,,,,server.example,aa:bb:cc:dd:ee:ff,,,,,,,,,,,2026-09-17T12:00:00.000-04:00", + "expected": { + "action": "allow", + "actionResult": "denied" + }, + "matches": [], + "absent": [ + "connectionStatus" + ], + "alertSides": {} + }, + { + "name": "traffic-allow-ended-policy-deny", + "dataSource": "synthetic-collector", + "raw": "<14>Sep 17 12:00:00 synthetic-fw 1,2026/09/17 12:00:00,SYNTH-FW,TRAFFIC,end,2817,2026/09/17 12:00:00,192.0.2.25,198.51.100.40,203.0.113.25,203.0.113.40,test-rule,testuser,server-user,ssl,vsys1,,,,,,,,,45678,443,,,,tcp,allow,300,200,100,12,,,,,,,,,,8,4,policy-deny,11,22,33,44,virtual-system-name,synthetic-fw,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,client.example,00:11:22:33:44:55,,,,,,,server.example,aa:bb:cc:dd:ee:ff,,,,,,,,,,,2026-09-17T12:00:00.000-04:00", + "expected": { + "action": "allow", + "actionResult": "denied" + }, + "matches": [], + "absent": [ + "connectionStatus" + ], + "alertSides": {} + }, + { + "name": "traffic-allow-ended-decrypt-cert-validation", + "dataSource": "synthetic-collector", + "raw": "<14>Sep 17 12:00:00 synthetic-fw 1,2026/09/17 12:00:00,SYNTH-FW,TRAFFIC,end,2817,2026/09/17 12:00:00,192.0.2.25,198.51.100.40,203.0.113.25,203.0.113.40,test-rule,testuser,server-user,ssl,vsys1,,,,,,,,,45678,443,,,,tcp,allow,300,200,100,12,,,,,,,,,,8,4,decrypt-cert-validation,11,22,33,44,virtual-system-name,synthetic-fw,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,client.example,00:11:22:33:44:55,,,,,,,server.example,aa:bb:cc:dd:ee:ff,,,,,,,,,,,2026-09-17T12:00:00.000-04:00", + "expected": { + "action": "allow", + "actionResult": "denied" + }, + "matches": [], + "absent": [ + "connectionStatus" + ], + "alertSides": {} + }, + { + "name": "traffic-allow-ended-decrypt-unsupport-param", + "dataSource": "synthetic-collector", + "raw": "<14>Sep 17 12:00:00 synthetic-fw 1,2026/09/17 12:00:00,SYNTH-FW,TRAFFIC,end,2817,2026/09/17 12:00:00,192.0.2.25,198.51.100.40,203.0.113.25,203.0.113.40,test-rule,testuser,server-user,ssl,vsys1,,,,,,,,,45678,443,,,,tcp,allow,300,200,100,12,,,,,,,,,,8,4,decrypt-unsupport-param,11,22,33,44,virtual-system-name,synthetic-fw,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,client.example,00:11:22:33:44:55,,,,,,,server.example,aa:bb:cc:dd:ee:ff,,,,,,,,,,,2026-09-17T12:00:00.000-04:00", + "expected": { + "action": "allow", + "actionResult": "denied" + }, + "matches": [], + "absent": [ + "connectionStatus" + ], + "alertSides": {} + }, + { + "name": "traffic-allow-ended-decrypt-error", + "dataSource": "synthetic-collector", + "raw": "<14>Sep 17 12:00:00 synthetic-fw 1,2026/09/17 12:00:00,SYNTH-FW,TRAFFIC,end,2817,2026/09/17 12:00:00,192.0.2.25,198.51.100.40,203.0.113.25,203.0.113.40,test-rule,testuser,server-user,ssl,vsys1,,,,,,,,,45678,443,,,,tcp,allow,300,200,100,12,,,,,,,,,,8,4,decrypt-error,11,22,33,44,virtual-system-name,synthetic-fw,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,client.example,00:11:22:33:44:55,,,,,,,server.example,aa:bb:cc:dd:ee:ff,,,,,,,,,,,2026-09-17T12:00:00.000-04:00", + "expected": { + "action": "allow", + "actionResult": "denied" + }, + "matches": [], + "absent": [ + "connectionStatus" + ], + "alertSides": {} + }, + { + "name": "traffic-allow-ended-resources-unavailable", + "dataSource": "synthetic-collector", + "raw": "<14>Sep 17 12:00:00 synthetic-fw 1,2026/09/17 12:00:00,SYNTH-FW,TRAFFIC,end,2817,2026/09/17 12:00:00,192.0.2.25,198.51.100.40,203.0.113.25,203.0.113.40,test-rule,testuser,server-user,ssl,vsys1,,,,,,,,,45678,443,,,,tcp,allow,300,200,100,12,,,,,,,,,,8,4,resources-unavailable,11,22,33,44,virtual-system-name,synthetic-fw,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,client.example,00:11:22:33:44:55,,,,,,,server.example,aa:bb:cc:dd:ee:ff,,,,,,,,,,,2026-09-17T12:00:00.000-04:00", + "expected": { + "action": "allow", + "actionResult": "failure" + }, + "matches": [], + "absent": [ + "connectionStatus" + ], + "alertSides": {} + }, + { + "name": "positive-panos_spyware_vulnerability", + "dataSource": "synthetic-collector", + "raw": "<14>Sep 17 12:00:00 synthetic-fw 1,2026/09/17 12:00:00,SYNTH-FW,THREAT,vulnerability,2817,2026/09/17 12:00:00,192.0.2.25,198.51.100.40,203.0.113.25,203.0.113.40,test-rule,testuser,server-user,web-browsing,vsys1,,,,,,,,,45678,443,,,,tcp,alert,example.test/download.exe,Example signature(30001),any,high,client-to-server,,,,,,,,aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa,public-cloud,,,,,,,,,,,,,,,synthetic-fw,,,,,,,,,,code-execution,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,", + "expected": { + "origin.ip": "192.0.2.25", + "target.ip": "198.51.100.40", + "log.paDirection": "client-to-server" + }, + "matches": [ + "panos_spyware_vulnerability" + ], + "absent": [ + "connectionStatus" + ], + "alertSides": { + "panos_spyware_vulnerability": [ + "192.0.2.25", + "198.51.100.40" + ] + } + }, + { + "name": "positive-zero_day_exploit_prevention", + "dataSource": "synthetic-collector", + "raw": "<14>Sep 17 12:00:00 synthetic-fw 1,2026/09/17 12:00:00,SYNTH-FW,THREAT,vulnerability,2817,2026/09/17 12:00:00,192.0.2.25,198.51.100.40,203.0.113.25,203.0.113.40,test-rule,testuser,server-user,web-browsing,vsys1,,,,,,,,,45678,443,,,,tcp,alert,example.test/download.exe,Synthetic CVE-2025-12345(30001),any,high,client-to-server,,,,,,,,aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa,public-cloud,,,,,,,,,,,,,,,synthetic-fw,,,,,,,,,,code-execution,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,", + "expected": { + "origin.ip": "192.0.2.25", + "target.ip": "198.51.100.40", + "log.paDirection": "client-to-server" + }, + "matches": [ + "zero_day_exploit_prevention", + "panos_spyware_vulnerability" + ], + "absent": [ + "connectionStatus" + ], + "alertSides": { + "zero_day_exploit_prevention": [ + "192.0.2.25", + "198.51.100.40" + ], + "panos_spyware_vulnerability": [ + "192.0.2.25", + "198.51.100.40" + ] + } + }, + { + "name": "positive-ioc_threat_intel_match", + "dataSource": "synthetic-collector", + "raw": "<14>Sep 17 12:00:00 synthetic-fw 1,2026/09/17 12:00:00,SYNTH-FW,THREAT,virus,2817,2026/09/17 12:00:00,192.0.2.25,198.51.100.40,203.0.113.25,203.0.113.40,test-rule,testuser,server-user,web-browsing,vsys1,,,,,,,,,45678,443,,,,tcp,drop,example.test/download.exe,Synthetic CVE-2025-12345(30001),any,high,client-to-server,,,,,,,,aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa,public-cloud,,,,,,,,,,,,,,,synthetic-fw,,,,,,,,,,malware,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,", + "expected": { + "origin.ip": "192.0.2.25", + "target.ip": "198.51.100.40", + "log.paDirection": "client-to-server", + "actionResult": "denied" + }, + "matches": [ + "ioc_threat_intel_match" + ], + "absent": [ + "connectionStatus" + ], + "alertSides": { + "ioc_threat_intel_match": [ + "192.0.2.25", + "198.51.100.40" + ] + } + }, + { + "name": "positive-wildfire_malware_detection", + "dataSource": "synthetic-collector", + "raw": "<14>Sep 17 12:00:00 synthetic-fw 1,2026/09/17 12:00:00,SYNTH-FW,THREAT,wildfire,2817,2026/09/17 12:00:00,192.0.2.25,198.51.100.40,203.0.113.25,203.0.113.40,test-rule,testuser,server-user,web-browsing,vsys1,,,,,,,,,45678,443,,,,tcp,alert,example.test/download.exe,Synthetic CVE-2025-12345(30001),malware,high,client-to-server,,,,,,,,aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa,public-cloud,,,,,,,,,,,,,,,synthetic-fw,,,,,,,,,,code-execution,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,", + "expected": { + "origin.ip": "192.0.2.25", + "target.ip": "198.51.100.40", + "log.paDirection": "client-to-server" + }, + "matches": [ + "wildfire_malware_detection" + ], + "absent": [ + "connectionStatus" + ], + "alertSides": { + "wildfire_malware_detection": [ + "192.0.2.25", + "198.51.100.40" + ] + } + }, + { + "name": "positive-panos_spyware_vulnerability_server_to_client", + "dataSource": "synthetic-collector", + "raw": "<14>Sep 17 12:00:00 synthetic-fw 1,2026/09/17 12:00:00,SYNTH-FW,THREAT,vulnerability,2817,2026/09/17 12:00:00,192.0.2.25,198.51.100.40,203.0.113.25,203.0.113.40,test-rule,testuser,server-user,web-browsing,vsys1,,,,,,,,,45678,443,,,,tcp,alert,example.test/download.exe,Example signature(30001),any,high,server-to-client,,,,,,,,aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa,public-cloud,,,,,,,,,,,,,,,synthetic-fw,,,,,,,,,,code-execution,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,", + "expected": { + "origin.ip": "192.0.2.25", + "target.ip": "198.51.100.40", + "log.paDirection": "server-to-client" + }, + "matches": [ + "panos_spyware_vulnerability_server_to_client" + ], + "absent": [ + "connectionStatus" + ], + "alertSides": { + "panos_spyware_vulnerability_server_to_client": [ + "198.51.100.40", + "192.0.2.25" + ] + } + }, + { + "name": "positive-zero_day_exploit_prevention_server_to_client", + "dataSource": "synthetic-collector", + "raw": "<14>Sep 17 12:00:00 synthetic-fw 1,2026/09/17 12:00:00,SYNTH-FW,THREAT,vulnerability,2817,2026/09/17 12:00:00,192.0.2.25,198.51.100.40,203.0.113.25,203.0.113.40,test-rule,testuser,server-user,web-browsing,vsys1,,,,,,,,,45678,443,,,,tcp,alert,example.test/download.exe,Synthetic CVE-2025-12345(30001),any,high,server-to-client,,,,,,,,aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa,public-cloud,,,,,,,,,,,,,,,synthetic-fw,,,,,,,,,,code-execution,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,", + "expected": { + "origin.ip": "192.0.2.25", + "target.ip": "198.51.100.40", + "log.paDirection": "server-to-client" + }, + "matches": [ + "zero_day_exploit_prevention_server_to_client", + "panos_spyware_vulnerability_server_to_client" + ], + "absent": [ + "connectionStatus" + ], + "alertSides": { + "zero_day_exploit_prevention_server_to_client": [ + "198.51.100.40", + "192.0.2.25" + ], + "panos_spyware_vulnerability_server_to_client": [ + "198.51.100.40", + "192.0.2.25" + ] + } + }, + { + "name": "positive-ioc_threat_intel_match_server_to_client", + "dataSource": "synthetic-collector", + "raw": "<14>Sep 17 12:00:00 synthetic-fw 1,2026/09/17 12:00:00,SYNTH-FW,THREAT,virus,2817,2026/09/17 12:00:00,192.0.2.25,198.51.100.40,203.0.113.25,203.0.113.40,test-rule,testuser,server-user,web-browsing,vsys1,,,,,,,,,45678,443,,,,tcp,drop,example.test/download.exe,Synthetic CVE-2025-12345(30001),any,high,server-to-client,,,,,,,,aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa,public-cloud,,,,,,,,,,,,,,,synthetic-fw,,,,,,,,,,malware,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,", + "expected": { + "origin.ip": "192.0.2.25", + "target.ip": "198.51.100.40", + "log.paDirection": "server-to-client", + "actionResult": "denied" + }, + "matches": [ + "ioc_threat_intel_match_server_to_client" + ], + "absent": [ + "connectionStatus" + ], + "alertSides": { + "ioc_threat_intel_match_server_to_client": [ + "198.51.100.40", + "192.0.2.25" + ] + } + }, + { + "name": "positive-wildfire_malware_detection_server_to_client", + "dataSource": "synthetic-collector", + "raw": "<14>Sep 17 12:00:00 synthetic-fw 1,2026/09/17 12:00:00,SYNTH-FW,THREAT,wildfire,2817,2026/09/17 12:00:00,192.0.2.25,198.51.100.40,203.0.113.25,203.0.113.40,test-rule,testuser,server-user,web-browsing,vsys1,,,,,,,,,45678,443,,,,tcp,alert,example.test/download.exe,Synthetic CVE-2025-12345(30001),malware,high,server-to-client,,,,,,,,aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa,public-cloud,,,,,,,,,,,,,,,synthetic-fw,,,,,,,,,,code-execution,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,", + "expected": { + "origin.ip": "192.0.2.25", + "target.ip": "198.51.100.40", + "log.paDirection": "server-to-client" + }, + "matches": [ + "wildfire_malware_detection_server_to_client" + ], + "absent": [ + "connectionStatus" + ], + "alertSides": { + "wildfire_malware_detection_server_to_client": [ + "198.51.100.40", + "192.0.2.25" + ] + } + }, + { + "name": "positive-panos_dns_security_alerts", + "dataSource": "synthetic-collector", + "raw": "<14>Sep 17 12:00:00 synthetic-fw 1,2026/09/17 12:00:00,SYNTH-FW,THREAT,spyware,2817,2026/09/17 12:00:00,192.0.2.25,198.51.100.40,203.0.113.25,203.0.113.40,test-rule,testuser,server-user,web-browsing,vsys1,,,,,,,,,45678,443,,,,tcp,sinkhole,example.test/download.exe,DNS signature,any,medium,client-to-server,,,,,,,,aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa,public-cloud,,,,,,,,,,,,,,,synthetic-fw,,,,,,,,,,dns-c2,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,", + "expected": { + "actionResult": "denied" + }, + "matches": [ + "panos_dns_security_alerts" + ], + "absent": [], + "alertSides": { + "panos_dns_security_alerts": [ + "192.0.2.25", + "198.51.100.40" + ] + } + }, + { + "name": "dns-legacy-subtype", + "dataSource": "synthetic-collector", + "raw": "<14>Sep 17 12:00:00 synthetic-fw 1,2026/09/17 12:00:00,SYNTH-FW,THREAT,dns,2817,2026/09/17 12:00:00,192.0.2.25,198.51.100.40,203.0.113.25,203.0.113.40,test-rule,testuser,server-user,web-browsing,vsys1,,,,,,,,,45678,443,,,,tcp,alert,example.test/download.exe,DNS signature,any,medium,client-to-server,,,,,,,,aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa,public-cloud,,,,,,,,,,,,,,,synthetic-fw,,,,,,,,,,code-execution,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,", + "expected": { + "log.pa_subtype": "dns" + }, + "matches": [ + "panos_dns_security_alerts" + ], + "absent": [ + "actionResult" + ], + "alertSides": { + "panos_dns_security_alerts": [ + "192.0.2.25", + "198.51.100.40" + ] + } + }, + { + "name": "positive-panos_url_filtering_blocks", + "dataSource": "synthetic-collector", + "raw": "<14>Sep 17 12:00:00 synthetic-fw 1,2026/09/17 12:00:00,SYNTH-FW,THREAT,url,2817,2026/09/17 12:00:00,192.0.2.25,198.51.100.40,203.0.113.25,203.0.113.40,test-rule,testuser,server-user,web-browsing,vsys1,,,,,,,,,45678,443,,,,tcp,block-url,example.test/download.exe,URL Filtering(9999),phishing,medium,client-to-server,,,,,,,,aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa,public-cloud,,,,,,,,,,,,,,,synthetic-fw,,,,,,,,,,code-execution,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,", + "expected": { + "actionResult": "denied", + "log.misc": "example.test/download.exe" + }, + "matches": [ + "panos_url_filtering_blocks" + ], + "absent": [ + "target.url" + ], + "alertSides": { + "panos_url_filtering_blocks": [ + "198.51.100.40", + "192.0.2.25" + ] + } + }, + { + "name": "risky-url-alert", + "dataSource": "synthetic-collector", + "raw": "<14>Sep 17 12:00:00 synthetic-fw 1,2026/09/17 12:00:00,SYNTH-FW,THREAT,url,2817,2026/09/17 12:00:00,192.0.2.25,198.51.100.40,203.0.113.25,203.0.113.40,test-rule,testuser,server-user,web-browsing,vsys1,,,,,,,,,45678,443,,,,tcp,alert,example.test/download.exe,URL Filtering(9999),grayware,medium,client-to-server,,,,,,,,aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa,public-cloud,,,,,,,,,,,,,,,synthetic-fw,,,,,,,,,,code-execution,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,", + "expected": {}, + "matches": [ + "panos_url_filtering_blocks" + ], + "absent": [ + "actionResult" + ], + "alertSides": { + "panos_url_filtering_blocks": [ + "198.51.100.40", + "192.0.2.25" + ] + } + }, + { + "name": "risky-url-block-continue", + "dataSource": "synthetic-collector", + "raw": "<14>Sep 17 12:00:00 synthetic-fw 1,2026/09/17 12:00:00,SYNTH-FW,THREAT,url,2817,2026/09/17 12:00:00,192.0.2.25,198.51.100.40,203.0.113.25,203.0.113.40,test-rule,testuser,server-user,web-browsing,vsys1,,,,,,,,,45678,443,,,,tcp,block-continue,example.test/download.exe,URL Filtering(9999),grayware,medium,client-to-server,,,,,,,,aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa,public-cloud,,,,,,,,,,,,,,,synthetic-fw,,,,,,,,,,code-execution,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,", + "expected": {}, + "matches": [ + "panos_url_filtering_blocks" + ], + "absent": [], + "alertSides": { + "panos_url_filtering_blocks": [ + "198.51.100.40", + "192.0.2.25" + ] + } + }, + { + "name": "risky-url-block-override", + "dataSource": "synthetic-collector", + "raw": "<14>Sep 17 12:00:00 synthetic-fw 1,2026/09/17 12:00:00,SYNTH-FW,THREAT,url,2817,2026/09/17 12:00:00,192.0.2.25,198.51.100.40,203.0.113.25,203.0.113.40,test-rule,testuser,server-user,web-browsing,vsys1,,,,,,,,,45678,443,,,,tcp,block-override,example.test/download.exe,URL Filtering(9999),grayware,medium,client-to-server,,,,,,,,aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa,public-cloud,,,,,,,,,,,,,,,synthetic-fw,,,,,,,,,,code-execution,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,", + "expected": {}, + "matches": [ + "panos_url_filtering_blocks" + ], + "absent": [], + "alertSides": { + "panos_url_filtering_blocks": [ + "198.51.100.40", + "192.0.2.25" + ] + } + }, + { + "name": "risky-url-block-page", + "dataSource": "synthetic-collector", + "raw": "<14>Sep 17 12:00:00 synthetic-fw 1,2026/09/17 12:00:00,SYNTH-FW,THREAT,url,2817,2026/09/17 12:00:00,192.0.2.25,198.51.100.40,203.0.113.25,203.0.113.40,test-rule,testuser,server-user,web-browsing,vsys1,,,,,,,,,45678,443,,,,tcp,block-page,example.test/download.exe,URL Filtering(9999),grayware,medium,client-to-server,,,,,,,,aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa,public-cloud,,,,,,,,,,,,,,,synthetic-fw,,,,,,,,,,code-execution,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,", + "expected": {}, + "matches": [ + "panos_url_filtering_blocks" + ], + "absent": [ + "actionResult" + ], + "alertSides": { + "panos_url_filtering_blocks": [ + "198.51.100.40", + "192.0.2.25" + ] + } + }, + { + "name": "benign-url-block-not-history-candidate", + "dataSource": "synthetic-collector", + "raw": "<14>Sep 17 12:00:00 synthetic-fw 1,2026/09/17 12:00:00,SYNTH-FW,THREAT,url,2817,2026/09/17 12:00:00,192.0.2.25,198.51.100.40,203.0.113.25,203.0.113.40,test-rule,testuser,server-user,web-browsing,vsys1,,,,,,,,,45678,443,,,,tcp,block-url,example.test/download.exe,Synthetic CVE-2025-12345(30001),business-and-economy,high,client-to-server,,,,,,,,aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa,public-cloud,,,,,,,,,,,,,,,synthetic-fw,,,,,,,,,,code-execution,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,", + "expected": {}, + "matches": [], + "absent": [ + "log.correlationCandidate.paloalto.url" + ], + "alertSides": {} + }, + { + "name": "ordinary-system-not-auth-history-candidate", + "dataSource": "synthetic-collector", + "raw": "<14>Sep 17 12:00:00 synthetic-fw 1,2026/09/17 12:00:00,SYNTH-FW,SYSTEM,auth,2817,2026/09/17 12:00:00,vsys1,general,,,,general,informational,Routine configuration notification,1001,,,,,,,synthetic-fw,,,2026-09-17T12:00:00.000-04:00", + "expected": {}, + "matches": [], + "absent": [ + "log.correlationCandidate.paloalto.authFailure" + ], + "alertSides": {} + }, + { + "name": "ordinary-spyware-not-dns-history-candidate", + "dataSource": "synthetic-collector", + "raw": "<14>Sep 17 12:00:00 synthetic-fw 1,2026/09/17 12:00:00,SYNTH-FW,THREAT,spyware,2817,2026/09/17 12:00:00,192.0.2.25,198.51.100.40,203.0.113.25,203.0.113.40,test-rule,testuser,server-user,web-browsing,vsys1,,,,,,,,,45678,443,,,,tcp,alert,example.test/download.exe,ordinary spyware,any,low,client-to-server,,,,,,,,aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa,public-cloud,,,,,,,,,,,,,,,synthetic-fw,,,,,,,,,,spyware,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,", + "expected": {}, + "matches": [], + "absent": [ + "log.correlationCandidate.paloalto.dns" + ], + "alertSides": {} + }, + { + "name": "low-vulnerability-not-history-candidate", + "dataSource": "synthetic-collector", + "raw": "<14>Sep 17 12:00:00 synthetic-fw 1,2026/09/17 12:00:00,SYNTH-FW,THREAT,vulnerability,2817,2026/09/17 12:00:00,192.0.2.25,198.51.100.40,203.0.113.25,203.0.113.40,test-rule,testuser,server-user,web-browsing,vsys1,,,,,,,,,45678,443,,,,tcp,alert,example.test/download.exe,Synthetic CVE-2025-12345(30001),any,low,client-to-server,,,,,,,,aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa,public-cloud,,,,,,,,,,,,,,,synthetic-fw,,,,,,,,,,code-execution,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,", + "expected": {}, + "matches": [], + "absent": [ + "log.correlationCandidate.paloalto.vulnerability" + ], + "alertSides": {} + }, + { + "name": "wildfire-benign-not-malware", + "dataSource": "synthetic-collector", + "raw": "<14>Sep 17 12:00:00 synthetic-fw 1,2026/09/17 12:00:00,SYNTH-FW,THREAT,wildfire,2817,2026/09/17 12:00:00,192.0.2.25,198.51.100.40,203.0.113.25,203.0.113.40,test-rule,testuser,server-user,web-browsing,vsys1,,,,,,,,,45678,443,,,,tcp,alert,example.test/download.exe,Synthetic CVE-2025-12345(30001),benign,high,client-to-server,,,,,,,,aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa,public-cloud,,,,,,,,,,,,,,,synthetic-fw,,,,,,,,,,code-execution,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,", + "expected": {}, + "matches": [], + "absent": [], + "alertSides": {} + }, + { + "name": "wildfire-grayware-not-malware", + "dataSource": "synthetic-collector", + "raw": "<14>Sep 17 12:00:00 synthetic-fw 1,2026/09/17 12:00:00,SYNTH-FW,THREAT,wildfire,2817,2026/09/17 12:00:00,192.0.2.25,198.51.100.40,203.0.113.25,203.0.113.40,test-rule,testuser,server-user,web-browsing,vsys1,,,,,,,,,45678,443,,,,tcp,alert,example.test/download.exe,Synthetic CVE-2025-12345(30001),grayware,high,client-to-server,,,,,,,,aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa,public-cloud,,,,,,,,,,,,,,,synthetic-fw,,,,,,,,,,code-execution,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,", + "expected": {}, + "matches": [], + "absent": [], + "alertSides": {} + }, + { + "name": "wildfire-phishing-not-malware", + "dataSource": "synthetic-collector", + "raw": "<14>Sep 17 12:00:00 synthetic-fw 1,2026/09/17 12:00:00,SYNTH-FW,THREAT,wildfire,2817,2026/09/17 12:00:00,192.0.2.25,198.51.100.40,203.0.113.25,203.0.113.40,test-rule,testuser,server-user,web-browsing,vsys1,,,,,,,,,45678,443,,,,tcp,alert,example.test/download.exe,Synthetic CVE-2025-12345(30001),phishing,high,client-to-server,,,,,,,,aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa,public-cloud,,,,,,,,,,,,,,,synthetic-fw,,,,,,,,,,code-execution,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,", + "expected": {}, + "matches": [], + "absent": [], + "alertSides": {} + }, + { + "name": "wildfire-any-not-malware", + "dataSource": "synthetic-collector", + "raw": "<14>Sep 17 12:00:00 synthetic-fw 1,2026/09/17 12:00:00,SYNTH-FW,THREAT,wildfire,2817,2026/09/17 12:00:00,192.0.2.25,198.51.100.40,203.0.113.25,203.0.113.40,test-rule,testuser,server-user,web-browsing,vsys1,,,,,,,,,45678,443,,,,tcp,alert,example.test/download.exe,Synthetic CVE-2025-12345(30001),any,high,client-to-server,,,,,,,,aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa,public-cloud,,,,,,,,,,,,,,,synthetic-fw,,,,,,,,,,code-execution,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,", + "expected": {}, + "matches": [], + "absent": [], + "alertSides": {} + }, + { + "name": "threat-allow-does-not-prove-success", + "dataSource": "synthetic-collector", + "raw": "<14>Sep 17 12:00:00 synthetic-fw 1,2026/09/17 12:00:00,SYNTH-FW,THREAT,flood,2817,2026/09/17 12:00:00,192.0.2.25,198.51.100.40,203.0.113.25,203.0.113.40,test-rule,testuser,server-user,web-browsing,vsys1,,,,,,,,,45678,443,,,,tcp,allow,example.test/download.exe,flood,any,high,client-to-server,,,,,,,,aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa,public-cloud,,,,,,,,,,,,,,,synthetic-fw,,,,,,,,,,code-execution,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,", + "expected": {}, + "matches": [], + "absent": [ + "actionResult", + "connectionStatus" + ], + "alertSides": {} + }, + { + "name": "threat-alert-does-not-prove-success", + "dataSource": "synthetic-collector", + "raw": "<14>Sep 17 12:00:00 synthetic-fw 1,2026/09/17 12:00:00,SYNTH-FW,THREAT,flood,2817,2026/09/17 12:00:00,192.0.2.25,198.51.100.40,203.0.113.25,203.0.113.40,test-rule,testuser,server-user,web-browsing,vsys1,,,,,,,,,45678,443,,,,tcp,alert,example.test/download.exe,flood,any,high,client-to-server,,,,,,,,aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa,public-cloud,,,,,,,,,,,,,,,synthetic-fw,,,,,,,,,,code-execution,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,", + "expected": {}, + "matches": [], + "absent": [ + "actionResult", + "connectionStatus" + ], + "alertSides": {} + }, + { + "name": "threat-syncookie-sent-does-not-prove-success", + "dataSource": "synthetic-collector", + "raw": "<14>Sep 17 12:00:00 synthetic-fw 1,2026/09/17 12:00:00,SYNTH-FW,THREAT,flood,2817,2026/09/17 12:00:00,192.0.2.25,198.51.100.40,203.0.113.25,203.0.113.40,test-rule,testuser,server-user,web-browsing,vsys1,,,,,,,,,45678,443,,,,tcp,syncookie-sent,example.test/download.exe,flood,any,high,client-to-server,,,,,,,,aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa,public-cloud,,,,,,,,,,,,,,,synthetic-fw,,,,,,,,,,code-execution,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,", + "expected": {}, + "matches": [], + "absent": [ + "actionResult", + "connectionStatus" + ], + "alertSides": {} + }, + { + "name": "wildfire-block", + "dataSource": "synthetic-collector", + "raw": "<14>Sep 17 12:00:00 synthetic-fw 1,2026/09/17 12:00:00,SYNTH-FW,THREAT,wildfire,2817,2026/09/17 12:00:00,192.0.2.25,198.51.100.40,203.0.113.25,203.0.113.40,test-rule,testuser,server-user,web-browsing,vsys1,,,,,,,,,45678,443,,,,tcp,block,example.test/download.exe,Synthetic CVE-2025-12345(30001),malware,high,client-to-server,,,,,,,,aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa,public-cloud,,,,,,,,,,,,,,,synthetic-fw,,,,,,,,,,code-execution,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,", + "expected": { + "actionResult": "denied" + }, + "matches": [ + "wildfire_malware_detection" + ], + "absent": [], + "alertSides": { + "wildfire_malware_detection": [ + "192.0.2.25", + "198.51.100.40" + ] + } + }, + { + "name": "wildfire-deny", + "dataSource": "synthetic-collector", + "raw": "<14>Sep 17 12:00:00 synthetic-fw 1,2026/09/17 12:00:00,SYNTH-FW,THREAT,wildfire,2817,2026/09/17 12:00:00,192.0.2.25,198.51.100.40,203.0.113.25,203.0.113.40,test-rule,testuser,server-user,web-browsing,vsys1,,,,,,,,,45678,443,,,,tcp,deny,example.test/download.exe,Synthetic CVE-2025-12345(30001),malware,high,client-to-server,,,,,,,,aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa,public-cloud,,,,,,,,,,,,,,,synthetic-fw,,,,,,,,,,code-execution,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,", + "expected": { + "actionResult": "denied" + }, + "matches": [ + "wildfire_malware_detection" + ], + "absent": [], + "alertSides": { + "wildfire_malware_detection": [ + "192.0.2.25", + "198.51.100.40" + ] + } + }, + { + "name": "threat-unknown-direction-missing", + "dataSource": "synthetic-collector", + "raw": "<14>Sep 17 12:00:00 synthetic-fw 1,2026/09/17 12:00:00,SYNTH-FW,THREAT,vulnerability,2817,2026/09/17 12:00:00,192.0.2.25,198.51.100.40,203.0.113.25,203.0.113.40,test-rule,testuser,server-user,web-browsing,vsys1,,,,,,,,,45678,443,,,,tcp,alert,example.test/download.exe,Synthetic CVE-2025-12345(30001),any,high,,,,,,,,,aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa,public-cloud,,,,,,,,,,,,,,,synthetic-fw,,,,,,,,,,code-execution,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,", + "expected": {}, + "matches": [], + "absent": [ + "log.paDirection", + "log.correlationCandidate.paloalto.vulnerability" + ], + "alertSides": {} + }, + { + "name": "threat-unknown-direction-unknown", + "dataSource": "synthetic-collector", + "raw": "<14>Sep 17 12:00:00 synthetic-fw 1,2026/09/17 12:00:00,SYNTH-FW,THREAT,vulnerability,2817,2026/09/17 12:00:00,192.0.2.25,198.51.100.40,203.0.113.25,203.0.113.40,test-rule,testuser,server-user,web-browsing,vsys1,,,,,,,,,45678,443,,,,tcp,alert,example.test/download.exe,Synthetic CVE-2025-12345(30001),any,high,unknown,,,,,,,,aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa,public-cloud,,,,,,,,,,,,,,,synthetic-fw,,,,,,,,,,code-execution,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,", + "expected": {}, + "matches": [], + "absent": [ + "log.paDirection", + "log.correlationCandidate.paloalto.vulnerability" + ], + "alertSides": {} + }, + { + "name": "invalid-source-not-an-ip", + "dataSource": "synthetic-collector", + "raw": "<14>Sep 17 12:00:00 synthetic-fw 1,2026/09/17 12:00:00,SYNTH-FW,TRAFFIC,end,2817,2026/09/17 12:00:00,not-an-ip,198.51.100.40,203.0.113.25,203.0.113.40,test-rule,testuser,server-user,ssl,vsys1,,,,,,,,,45678,443,,,,tcp,allow,300,200,100,12,,,,,,,,,,8,4,tcp-fin,11,22,33,44,virtual-system-name,synthetic-fw,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,client.example,00:11:22:33:44:55,,,,,,,server.example,aa:bb:cc:dd:ee:ff,,,,,,,,,,,2026-09-17T12:00:00.000-04:00", + "expected": { + "log.src": "not-an-ip" + }, + "matches": [], + "absent": [ + "origin.ip" + ], + "alertSides": {} + }, + { + "name": "invalid-source-0.0.0.0", + "dataSource": "synthetic-collector", + "raw": "<14>Sep 17 12:00:00 synthetic-fw 1,2026/09/17 12:00:00,SYNTH-FW,TRAFFIC,end,2817,2026/09/17 12:00:00,0.0.0.0,198.51.100.40,203.0.113.25,203.0.113.40,test-rule,testuser,server-user,ssl,vsys1,,,,,,,,,45678,443,,,,tcp,allow,300,200,100,12,,,,,,,,,,8,4,tcp-fin,11,22,33,44,virtual-system-name,synthetic-fw,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,client.example,00:11:22:33:44:55,,,,,,,server.example,aa:bb:cc:dd:ee:ff,,,,,,,,,,,2026-09-17T12:00:00.000-04:00", + "expected": { + "log.src": "0.0.0.0" + }, + "matches": [], + "absent": [ + "origin.ip" + ], + "alertSides": {} + }, + { + "name": "invalid-source-::", + "dataSource": "synthetic-collector", + "raw": "<14>Sep 17 12:00:00 synthetic-fw 1,2026/09/17 12:00:00,SYNTH-FW,TRAFFIC,end,2817,2026/09/17 12:00:00,::,198.51.100.40,203.0.113.25,203.0.113.40,test-rule,testuser,server-user,ssl,vsys1,,,,,,,,,45678,443,,,,tcp,allow,300,200,100,12,,,,,,,,,,8,4,tcp-fin,11,22,33,44,virtual-system-name,synthetic-fw,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,client.example,00:11:22:33:44:55,,,,,,,server.example,aa:bb:cc:dd:ee:ff,,,,,,,,,,,2026-09-17T12:00:00.000-04:00", + "expected": { + "log.src": "::" + }, + "matches": [], + "absent": [ + "origin.ip" + ], + "alertSides": {} + }, + { + "name": "invalid-source-0:0:0:0:0:0:0:0", + "dataSource": "synthetic-collector", + "raw": "<14>Sep 17 12:00:00 synthetic-fw 1,2026/09/17 12:00:00,SYNTH-FW,TRAFFIC,end,2817,2026/09/17 12:00:00,0:0:0:0:0:0:0:0,198.51.100.40,203.0.113.25,203.0.113.40,test-rule,testuser,server-user,ssl,vsys1,,,,,,,,,45678,443,,,,tcp,allow,300,200,100,12,,,,,,,,,,8,4,tcp-fin,11,22,33,44,virtual-system-name,synthetic-fw,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,client.example,00:11:22:33:44:55,,,,,,,server.example,aa:bb:cc:dd:ee:ff,,,,,,,,,,,2026-09-17T12:00:00.000-04:00", + "expected": { + "log.src": "0:0:0:0:0:0:0:0" + }, + "matches": [], + "absent": [ + "origin.ip" + ], + "alertSides": {} + }, + { + "name": "invalid-source-::ffff:0.0.0.0", + "dataSource": "synthetic-collector", + "raw": "<14>Sep 17 12:00:00 synthetic-fw 1,2026/09/17 12:00:00,SYNTH-FW,TRAFFIC,end,2817,2026/09/17 12:00:00,::ffff:0.0.0.0,198.51.100.40,203.0.113.25,203.0.113.40,test-rule,testuser,server-user,ssl,vsys1,,,,,,,,,45678,443,,,,tcp,allow,300,200,100,12,,,,,,,,,,8,4,tcp-fin,11,22,33,44,virtual-system-name,synthetic-fw,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,client.example,00:11:22:33:44:55,,,,,,,server.example,aa:bb:cc:dd:ee:ff,,,,,,,,,,,2026-09-17T12:00:00.000-04:00", + "expected": { + "log.src": "::ffff:0.0.0.0" + }, + "matches": [], + "absent": [ + "origin.ip" + ], + "alertSides": {} + }, + { + "name": "invalid-source-999.1.1.1", + "dataSource": "synthetic-collector", + "raw": "<14>Sep 17 12:00:00 synthetic-fw 1,2026/09/17 12:00:00,SYNTH-FW,TRAFFIC,end,2817,2026/09/17 12:00:00,999.1.1.1,198.51.100.40,203.0.113.25,203.0.113.40,test-rule,testuser,server-user,ssl,vsys1,,,,,,,,,45678,443,,,,tcp,allow,300,200,100,12,,,,,,,,,,8,4,tcp-fin,11,22,33,44,virtual-system-name,synthetic-fw,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,client.example,00:11:22:33:44:55,,,,,,,server.example,aa:bb:cc:dd:ee:ff,,,,,,,,,,,2026-09-17T12:00:00.000-04:00", + "expected": { + "log.src": "999.1.1.1" + }, + "matches": [], + "absent": [ + "origin.ip" + ], + "alertSides": {} + }, + { + "name": "invalid-port--1", + "dataSource": "synthetic-collector", + "raw": "<14>Sep 17 12:00:00 synthetic-fw 1,2026/09/17 12:00:00,SYNTH-FW,TRAFFIC,end,2817,2026/09/17 12:00:00,192.0.2.25,198.51.100.40,203.0.113.25,203.0.113.40,test-rule,testuser,server-user,ssl,vsys1,,,,,,,,,45678,-1,,,,tcp,allow,300,200,100,12,,,,,,,,,,8,4,tcp-fin,11,22,33,44,virtual-system-name,synthetic-fw,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,client.example,00:11:22:33:44:55,,,,,,,server.example,aa:bb:cc:dd:ee:ff,,,,,,,,,,,2026-09-17T12:00:00.000-04:00", + "expected": { + "log.dpt": "-1" + }, + "matches": [], + "absent": [ + "target.port" + ], + "alertSides": {} + }, + { + "name": "invalid-port-65536", + "dataSource": "synthetic-collector", + "raw": "<14>Sep 17 12:00:00 synthetic-fw 1,2026/09/17 12:00:00,SYNTH-FW,TRAFFIC,end,2817,2026/09/17 12:00:00,192.0.2.25,198.51.100.40,203.0.113.25,203.0.113.40,test-rule,testuser,server-user,ssl,vsys1,,,,,,,,,45678,65536,,,,tcp,allow,300,200,100,12,,,,,,,,,,8,4,tcp-fin,11,22,33,44,virtual-system-name,synthetic-fw,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,client.example,00:11:22:33:44:55,,,,,,,server.example,aa:bb:cc:dd:ee:ff,,,,,,,,,,,2026-09-17T12:00:00.000-04:00", + "expected": { + "log.dpt": "65536" + }, + "matches": [], + "absent": [ + "target.port" + ], + "alertSides": {} + }, + { + "name": "invalid-port-abc", + "dataSource": "synthetic-collector", + "raw": "<14>Sep 17 12:00:00 synthetic-fw 1,2026/09/17 12:00:00,SYNTH-FW,TRAFFIC,end,2817,2026/09/17 12:00:00,192.0.2.25,198.51.100.40,203.0.113.25,203.0.113.40,test-rule,testuser,server-user,ssl,vsys1,,,,,,,,,45678,abc,,,,tcp,allow,300,200,100,12,,,,,,,,,,8,4,tcp-fin,11,22,33,44,virtual-system-name,synthetic-fw,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,client.example,00:11:22:33:44:55,,,,,,,server.example,aa:bb:cc:dd:ee:ff,,,,,,,,,,,2026-09-17T12:00:00.000-04:00", + "expected": { + "log.dpt": "abc" + }, + "matches": [], + "absent": [ + "target.port" + ], + "alertSides": {} + }, + { + "name": "invalid-port-1.2", + "dataSource": "synthetic-collector", + "raw": "<14>Sep 17 12:00:00 synthetic-fw 1,2026/09/17 12:00:00,SYNTH-FW,TRAFFIC,end,2817,2026/09/17 12:00:00,192.0.2.25,198.51.100.40,203.0.113.25,203.0.113.40,test-rule,testuser,server-user,ssl,vsys1,,,,,,,,,45678,1.2,,,,tcp,allow,300,200,100,12,,,,,,,,,,8,4,tcp-fin,11,22,33,44,virtual-system-name,synthetic-fw,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,client.example,00:11:22:33:44:55,,,,,,,server.example,aa:bb:cc:dd:ee:ff,,,,,,,,,,,2026-09-17T12:00:00.000-04:00", + "expected": { + "log.dpt": "1.2" + }, + "matches": [], + "absent": [ + "target.port" + ], + "alertSides": {} + }, + { + "name": "invalid-port-4294967296", + "dataSource": "synthetic-collector", + "raw": "<14>Sep 17 12:00:00 synthetic-fw 1,2026/09/17 12:00:00,SYNTH-FW,TRAFFIC,end,2817,2026/09/17 12:00:00,192.0.2.25,198.51.100.40,203.0.113.25,203.0.113.40,test-rule,testuser,server-user,ssl,vsys1,,,,,,,,,45678,4294967296,,,,tcp,allow,300,200,100,12,,,,,,,,,,8,4,tcp-fin,11,22,33,44,virtual-system-name,synthetic-fw,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,client.example,00:11:22:33:44:55,,,,,,,server.example,aa:bb:cc:dd:ee:ff,,,,,,,,,,,2026-09-17T12:00:00.000-04:00", + "expected": { + "log.dpt": "4294967296" + }, + "matches": [], + "absent": [ + "target.port" + ], + "alertSides": {} + }, + { + "name": "invalid-packets--1", + "dataSource": "synthetic-collector", + "raw": "<14>Sep 17 12:00:00 synthetic-fw 1,2026/09/17 12:00:00,SYNTH-FW,TRAFFIC,end,2817,2026/09/17 12:00:00,192.0.2.25,198.51.100.40,203.0.113.25,203.0.113.40,test-rule,testuser,server-user,ssl,vsys1,,,,,,,,,45678,443,,,,tcp,allow,300,200,100,12,,,,,,,,,,-1,4,tcp-fin,11,22,33,44,virtual-system-name,synthetic-fw,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,client.example,00:11:22:33:44:55,,,,,,,server.example,aa:bb:cc:dd:ee:ff,,,,,,,,,,,2026-09-17T12:00:00.000-04:00", + "expected": { + "log.pkts_sent": "-1" + }, + "matches": [], + "absent": [ + "origin.packagesSent" + ], + "alertSides": {} + }, + { + "name": "invalid-packets-1.5", + "dataSource": "synthetic-collector", + "raw": "<14>Sep 17 12:00:00 synthetic-fw 1,2026/09/17 12:00:00,SYNTH-FW,TRAFFIC,end,2817,2026/09/17 12:00:00,192.0.2.25,198.51.100.40,203.0.113.25,203.0.113.40,test-rule,testuser,server-user,ssl,vsys1,,,,,,,,,45678,443,,,,tcp,allow,300,200,100,12,,,,,,,,,,1.5,4,tcp-fin,11,22,33,44,virtual-system-name,synthetic-fw,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,client.example,00:11:22:33:44:55,,,,,,,server.example,aa:bb:cc:dd:ee:ff,,,,,,,,,,,2026-09-17T12:00:00.000-04:00", + "expected": { + "log.pkts_sent": "1.5" + }, + "matches": [], + "absent": [ + "origin.packagesSent" + ], + "alertSides": {} + }, + { + "name": "invalid-packets-NaN", + "dataSource": "synthetic-collector", + "raw": "<14>Sep 17 12:00:00 synthetic-fw 1,2026/09/17 12:00:00,SYNTH-FW,TRAFFIC,end,2817,2026/09/17 12:00:00,192.0.2.25,198.51.100.40,203.0.113.25,203.0.113.40,test-rule,testuser,server-user,ssl,vsys1,,,,,,,,,45678,443,,,,tcp,allow,300,200,100,12,,,,,,,,,,NaN,4,tcp-fin,11,22,33,44,virtual-system-name,synthetic-fw,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,client.example,00:11:22:33:44:55,,,,,,,server.example,aa:bb:cc:dd:ee:ff,,,,,,,,,,,2026-09-17T12:00:00.000-04:00", + "expected": { + "log.pkts_sent": "NaN" + }, + "matches": [], + "absent": [ + "origin.packagesSent" + ], + "alertSides": {} + }, + { + "name": "invalid-packets-18446744073709551616", + "dataSource": "synthetic-collector", + "raw": "<14>Sep 17 12:00:00 synthetic-fw 1,2026/09/17 12:00:00,SYNTH-FW,TRAFFIC,end,2817,2026/09/17 12:00:00,192.0.2.25,198.51.100.40,203.0.113.25,203.0.113.40,test-rule,testuser,server-user,ssl,vsys1,,,,,,,,,45678,443,,,,tcp,allow,300,200,100,12,,,,,,,,,,18446744073709551616,4,tcp-fin,11,22,33,44,virtual-system-name,synthetic-fw,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,client.example,00:11:22:33:44:55,,,,,,,server.example,aa:bb:cc:dd:ee:ff,,,,,,,,,,,2026-09-17T12:00:00.000-04:00", + "expected": { + "log.pkts_sent": "18446744073709551616" + }, + "matches": [], + "absent": [ + "origin.packagesSent" + ], + "alertSides": {} + }, + { + "name": "documented-HIP-MATCH-layout", + "dataSource": "synthetic-collector", + "raw": "<14>Sep 17 12:00:00 synthetic-fw 1,2026/09/17 12:00:00,SYNTH-FW,HIP-MATCH,,2817,2026/09/17 12:00:00,testuser,vsys1,workstation.example,Windows,192.0.2.25,,,,,,,,,,,,,,,,,,00:11:22:33:44:55", + "expected": { + "origin.ip": "192.0.2.25", + "origin.host": "workstation.example", + "origin.user": "testuser", + "origin.operatingSystem": "Windows", + "origin.mac": "00:11:22:33:44:55" + }, + "matches": [], + "absent": [ + "actionResult" + ], + "alertSides": {} + }, + { + "name": "documented-GLOBALPROTECT-layout", + "dataSource": "synthetic-collector", + "raw": "<14>Sep 17 12:00:00 synthetic-fw 1,2026/09/17 12:00:00,SYNTH-FW,GLOBALPROTECT,,2817,2026/09/17 12:00:00,vsys1,gateway-auth,,,,testuser,,vpn-client,192.0.2.25,,10.0.0.25,,,,,Windows,,,,,,failure", + "expected": { + "origin.ip": "192.0.2.25", + "origin.host": "vpn-client", + "origin.user": "testuser", + "action": "gateway-auth", + "actionResult": "failure" + }, + "matches": [], + "absent": [], + "alertSides": {} + }, + { + "name": "documented-IPTAG-layout", + "dataSource": "synthetic-collector", + "raw": "<14>Sep 17 12:00:00 synthetic-fw 1,2026/09/17 12:00:00,SYNTH-FW,IPTAG,,2817,2026/09/17 12:00:00,vsys1,192.0.2.25,test-tag,register-tag", + "expected": { + "origin.ip": "192.0.2.25", + "action": "register-tag", + "log.tag_name": "test-tag" + }, + "matches": [], + "absent": [ + "actionResult" + ], + "alertSides": {} + }, + { + "name": "documented-USERID-layout", + "dataSource": "synthetic-collector", + "raw": "<14>Sep 17 12:00:00 synthetic-fw 1,2026/09/17 12:00:00,SYNTH-FW,USERID,,2817,2026/09/17 12:00:00,vsys1,192.0.2.25,testuser,,login,,,,,,,,,,,,,,,,,,,groupflags,directory,test-tag,2026-09-17T12:00:00Z", + "expected": { + "origin.ip": "192.0.2.25", + "origin.user": "testuser", + "action": "login", + "log.tag_name": "test-tag", + "deviceTime": "2026-09-17T12:00:00Z" + }, + "matches": [], + "absent": [ + "actionResult" + ], + "alertSides": {} + }, + { + "name": "documented-DECRYPTION-layout", + "dataSource": "synthetic-collector", + "raw": "<14>Sep 17 12:00:00 synthetic-fw 1,2026/09/17 12:00:00,SYNTH-FW,DECRYPTION,,2817,2026/09/17 12:00:00,192.0.2.25,198.51.100.40,,,,,,,vsys1,,,,,,,,,45678,443,,,,tcp,drop", + "expected": { + "origin.ip": "192.0.2.25", + "target.ip": "198.51.100.40", + "actionResult": "denied" + }, + "matches": [], + "absent": [], + "alertSides": {} + }, + { + "name": "documented-START-layout", + "dataSource": "synthetic-collector", + "raw": "<14>Sep 17 12:00:00 synthetic-fw 1,2026/09/17 12:00:00,SYNTH-FW,START,,2817,2026/09/17 12:00:00,192.0.2.25,198.51.100.40,,,,,,,vsys1,,,,,,,,,45678,443,,,,tcp,deny,,,,,,,,,,,,,,,,,,200,100", + "expected": { + "origin.ip": "192.0.2.25", + "target.ip": "198.51.100.40", + "actionResult": "denied", + "origin.bytesSent": 200, + "origin.bytesReceived": 100 + }, + "matches": [], + "absent": [], + "alertSides": {} + }, + { + "name": "documented-SCTP-layout", + "dataSource": "synthetic-collector", + "raw": "<14>Sep 17 12:00:00 synthetic-fw 1,2026/09/17 12:00:00,SYNTH-FW,SCTP,,2817,2026/09/17 12:00:00,192.0.2.25,198.51.100.40,,,,,,,vsys1,,,,,,,,,45678,443,,,,,sctp,deny", + "expected": { + "origin.ip": "192.0.2.25", + "target.ip": "198.51.100.40", + "protocol": "sctp", + "actionResult": "denied" + }, + "matches": [], + "absent": [], + "alertSides": {} + }, + { + "name": "documented-CONFIG-layout", + "dataSource": "synthetic-collector", + "raw": "<14>Sep 17 12:00:00 synthetic-fw 1,2026/09/17 12:00:00,SYNTH-FW,CONFIG,,2817,2026/09/17 12:00:00,192.0.2.25,vsys1,commit,admin-test,Web,Submitted,,,,,,,,,,,synthetic-fw,,,,2026-09-17T12:00:00Z", + "expected": { + "origin.ip": "192.0.2.25", + "origin.user": "admin-test", + "target.host": "synthetic-fw", + "action": "commit", + "deviceTime": "2026-09-17T12:00:00Z" + }, + "matches": [], + "absent": [ + "actionResult" + ], + "alertSides": {} + }, + { + "name": "documented-AUTHENTICATION-layout", + "dataSource": "synthetic-collector", + "raw": "<14>Sep 17 12:00:00 synthetic-fw 1,2026/09/17 12:00:00,SYNTH-FW,AUTHENTICATION,,2817,2026/09/17 12:00:00,vsys1,192.0.2.25,testuser,,,,,,,,,,,test-result,,,,,,,,,,,,,,,,,,,,,,,reserved,synthetic-user-agent,5678", + "expected": { + "origin.ip": "192.0.2.25", + "origin.user": "testuser", + "action": "test-result", + "log.user_agent": "synthetic-user-agent", + "log.sessionid": "5678" + }, + "matches": [], + "absent": [ + "actionResult" + ], + "alertSides": {} + }, + { + "name": "documented-CORRELATION-layout", + "dataSource": "synthetic-collector", + "raw": "<14>Sep 17 12:00:00 synthetic-fw 1,2026/09/17 12:00:00,SYNTH-FW,CORRELATION,,2817,2026/09/17 12:00:00,192.0.2.25,testuser,vsys1,suspicious,high", + "expected": { + "origin.ip": "192.0.2.25", + "origin.user": "testuser", + "severity": "error" + }, + "matches": [], + "absent": [ + "actionResult" + ], + "alertSides": {} + }, + { + "name": "documented-GTP-layout", + "dataSource": "synthetic-collector", + "raw": "<14>Sep 17 12:00:00 synthetic-fw 1,2026/09/17 12:00:00,SYNTH-FW,GTP,,2817,2026/09/17 12:00:00,192.0.2.25,198.51.100.40,,,,,,,vsys1,,,,,,,,,45678,2123,,,reserved-flags,udp,deny,gtp-event", + "expected": { + "origin.ip": "192.0.2.25", + "target.ip": "198.51.100.40", + "protocol": "udp", + "action": "deny", + "actionResult": "denied", + "log.event_type": "gtp-event" + }, + "matches": [], + "absent": [], + "alertSides": {} + }, + { + "name": "cef-traffic-last-field", + "dataSource": "synthetic-collector", + "raw": "CEF:0|Palo Alto Networks|PAN-OS|10.0|end|TRAFFIC|1|deviceExternalId=SYNTH-FW cs3Label=Virtual System cs3=vsys1 src=192.0.2.25 dst=198.51.100.40 act=deny PanOSPacketsSent=12 PanOSPacketsReceived=4", + "expected": { + "origin.ip": "192.0.2.25", + "target.ip": "198.51.100.40", + "actionResult": "denied", + "origin.packagesSent": "12", + "origin.packagesReceived": "4", + "log.paType": "TRAFFIC", + "log.paSubtype": "end", + "log.embDeviceVendor": "Palo Alto Networks", + "log.embDeviceProduct": "PAN-OS", + "log.formatType": "CEF", + "log.formatVersion": "0" + }, + "matches": [], + "absent": [], + "alertSides": {} + }, + { + "name": "cef-escaped-equals-cannot-forge-field", + "dataSource": "synthetic-collector", + "raw": "CEF:0|Palo Alto Networks|PAN-OS|10.0|end|TRAFFIC|1|deviceExternalId=SYNTH-FW cs3Label=Virtual System cs3=vsys1 msg=untrusted src\\=203.0.113.66 src=192.0.2.25 dst=198.51.100.40 act=deny", + "expected": { + "origin.ip": "192.0.2.25", + "log.msg": "untrusted src\\=203.0.113.66", + "actionResult": "denied" + }, + "matches": [], + "absent": [], + "alertSides": {} + }, + { + "name": "cef-multiword-values-and-final-action", + "dataSource": "synthetic-collector", + "raw": "CEF:0|Palo Alto Networks|PAN-OS|10.0|end|TRAFFIC|1|deviceExternalId=SYNTH-FW cs3Label=Virtual System cs3=vsys1 src=192.0.2.25 dst=198.51.100.40 cs1Label=Rule cs1=Allow Test Rule act=drop", + "expected": { + "log.cs1": "Allow Test Rule", + "action": "drop", + "actionResult": "denied" + }, + "matches": [], + "absent": [], + "alertSides": {} + }, + { + "name": "cef-source-must-not-match-natsrc", + "dataSource": "synthetic-collector", + "raw": "CEF:0|Palo Alto Networks|PAN-OS|10.0|end|TRAFFIC|1|deviceExternalId=SYNTH-FW cs3Label=Virtual System cs3=vsys1 sourceTranslatedAddress=203.0.113.66 dst=198.51.100.40 act=deny", + "expected": { + "log.natsrc": "203.0.113.66", + "target.ip": "198.51.100.40" + }, + "matches": [], + "absent": [ + "origin.ip" + ], + "alertSides": {} + }, + { + "name": "cef-category-PanOSThreatCategory", + "dataSource": "synthetic-collector", + "raw": "CEF:0|Palo Alto Networks|PAN-OS|10.0|Synthetic malware(12345)|THREAT|8|deviceExternalId=SYNTH-FW cs3Label=Virtual System cs3=vsys1 src=192.0.2.25 dst=198.51.100.40 cat=virus act=drop flexString2Label=Direction flexString2=server-to-client PanOSThreatCategory=malware", + "expected": { + "log.pa_subtype": "virus", + "log.pa_threatid": "Synthetic malware(12345)", + "log.thr_category": "malware", + "actionResult": "denied" + }, + "matches": [ + "ioc_threat_intel_match_server_to_client" + ], + "absent": [ + "severity" + ], + "alertSides": { + "ioc_threat_intel_match_server_to_client": [ + "198.51.100.40", + "192.0.2.25" + ] + } + }, + { + "name": "cef-category-panOSThreatCategory", + "dataSource": "synthetic-collector", + "raw": "CEF:0|Palo Alto Networks|PAN-OS|10.0|Synthetic malware(12345)|THREAT|8|deviceExternalId=SYNTH-FW cs3Label=Virtual System cs3=vsys1 src=192.0.2.25 dst=198.51.100.40 cat=virus act=drop flexString2Label=Direction flexString2=server-to-client panOSThreatCategory=malware", + "expected": { + "log.pa_subtype": "virus", + "log.pa_threatid": "Synthetic malware(12345)", + "log.thr_category": "malware", + "actionResult": "denied" + }, + "matches": [ + "ioc_threat_intel_match_server_to_client" + ], + "absent": [ + "severity" + ], + "alertSides": { + "ioc_threat_intel_match_server_to_client": [ + "198.51.100.40", + "192.0.2.25" + ] + } + }, + { + "name": "cef-system-auth", + "dataSource": "synthetic-collector", + "raw": "<14>Sep 17 12:00:00 synthetic-fw CEF:0|Palo Alto Networks|PAN-OS|10.0|auth|SYSTEM|3|deviceExternalId=SYNTH-FW cs3Label=Virtual System cs3=vsys1 cat=auth-fail msg=failed authentication for user 'testuser'. Reason: invalid. From: 192.0.2.25. dvchost=synthetic-fw", + "expected": { + "origin.ip": "192.0.2.25", + "origin.user": "testuser", + "target.host": "synthetic-fw", + "actionResult": "failure" + }, + "matches": [ + "panos_admin_brute_force" + ], + "absent": [], + "alertSides": { + "panos_admin_brute_force": [ + "192.0.2.25", + "" + ] + } + }, + { + "name": "cef-config-admin-is-origin", + "dataSource": "synthetic-collector", + "raw": "CEF:0|Palo Alto Networks|PAN-OS|10.0|Succeeded|CONFIG|1|deviceExternalId=SYNTH-FW cs3Label=Virtual System cs3=vsys1 shost=192.0.2.25 act=commit duser=testadmin dvchost=synthetic-fw msg=/config/devices/entry", + "expected": { + "origin.ip": "192.0.2.25", + "origin.user": "testadmin", + "target.host": "synthetic-fw", + "action": "commit", + "actionResult": "success" + }, + "matches": [], + "absent": [ + "target.user", + "target.path", + "origin.path" + ], + "alertSides": {} + }, + { + "name": "cef-auth-user-is-origin", + "dataSource": "synthetic-collector", + "raw": "CEF:0|Palo Alto Networks|PAN-OS|10.0|general|AUTHENTICATION|1|deviceExternalId=SYNTH-FW cs3Label=Virtual System cs3=vsys1 src=192.0.2.25 duser=testuser msg=custom-result", + "expected": { + "origin.ip": "192.0.2.25", + "origin.user": "testuser", + "action": "custom-result" + }, + "matches": [], + "absent": [ + "target.user", + "actionResult" + ], + "alertSides": {} + }, + { + "name": "cef-hip-ipv6", + "dataSource": "synthetic-collector", + "raw": "CEF:0|Palo Alto Networks|PAN-OS|10.0|object|HIP-MATCH|1|deviceExternalId=SYNTH-FW cs3Label=Virtual System cs3=vsys1 src=0.0.0.0 c6a2Label=IPv6 Source Address c6a2=2001:db8::25 shost=workstation.example cs2Label=Operating System cs2=Windows PanOSEndpointMac=00:11:22:33:44:55", + "expected": { + "origin.ip": "2001:db8::25", + "origin.host": "workstation.example", + "origin.operatingSystem": "Windows", + "origin.mac": "00:11:22:33:44:55" + }, + "matches": [], + "absent": [], + "alertSides": {} + }, + { + "name": "cef-url-subtype-in-signature", + "dataSource": "synthetic-collector", + "raw": "CEF:0|Palo Alto Networks|PAN-OS|10.0|url|THREAT|5|deviceExternalId=SYNTH-FW cs3Label=Virtual System cs3=vsys1 src=192.0.2.25 dst=198.51.100.40 cat=URL Filtering(9999) cs2Label=URL Category cs2=phishing act=block-url request=phishing.example/login", + "expected": { + "log.pa_subtype": "url", + "log.pa_threatid": "URL Filtering(9999)", + "log.misc": "phishing.example/login" + }, + "matches": [ + "panos_url_filtering_blocks" + ], + "absent": [ + "target.url" + ], + "alertSides": { + "panos_url_filtering_blocks": [ + "198.51.100.40", + "192.0.2.25" + ] + } + }, + { + "name": "cef-wildfire-cloud-is-not-path", + "dataSource": "synthetic-collector", + "raw": "CEF:0|Palo Alto Networks|PAN-OS|10.0|wildfire|THREAT|8|deviceExternalId=SYNTH-FW cs3Label=Virtual System cs3=vsys1 src=192.0.2.25 dst=198.51.100.40 cat=WildFire signature cs2Label=URL Category cs2=malware act=block filePath=public-cloud fileHash=aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa flexString2Label=Direction flexString2=server-to-client", + "expected": { + "origin.sha256": "aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa", + "log.filePath": "public-cloud", + "actionResult": "denied", + "log.category": "malware" + }, + "matches": [], + "absent": [ + "origin.path", + "target.path", + "severity" + ], + "alertSides": {} + }, + { + "name": "cef-threat-allow-is-not-success", + "dataSource": "synthetic-collector", + "raw": "CEF:0|Palo Alto Networks|PAN-OS|10.0|Flood(8501)|THREAT|5|deviceExternalId=SYNTH-FW cs3Label=Virtual System cs3=vsys1 src=192.0.2.25 cat=flood act=allow", + "expected": { + "log.pa_subtype": "flood" + }, + "matches": [], + "absent": [ + "actionResult", + "connectionStatus" + ], + "alertSides": {} + }, + { + "name": "cef-traffic-blocked-end-reason", + "dataSource": "synthetic-collector", + "raw": "CEF:0|Palo Alto Networks|PAN-OS|10.0|end|TRAFFIC|1|deviceExternalId=SYNTH-FW cs3Label=Virtual System cs3=vsys1 src=192.0.2.25 act=allow reason=threat", + "expected": { + "actionResult": "denied" + }, + "matches": [], + "absent": [], + "alertSides": {} + }, + { + "name": "cef-unknown-byte-orientation-retained", + "dataSource": "synthetic-collector", + "raw": "CEF:0|Palo Alto Networks|PAN-OS|10.0|end|TRAFFIC|1|deviceExternalId=SYNTH-FW cs3Label=Virtual System cs3=vsys1 src=192.0.2.25 in=123 out=456 act=allow", + "expected": { + "log.in": "123", + "log.out": "456" + }, + "matches": [], + "absent": [ + "origin.bytesSent", + "origin.bytesReceived", + "target.bytesSent", + "target.bytesReceived" + ], + "alertSides": {} + }, + { + "name": "cortex-feed-not-pan-os", + "dataSource": "synthetic-collector", + "raw": "<41>1 2026-09-17T12:00:00Z cortexxdr - - - - threat,None,None,None,blocked,192.0.2.25", + "expected": {}, + "matches": [], + "absent": [ + "log.pa_type", + "origin.ip", + "target.ip", + "actionResult", + "severity" + ], + "alertSides": {} + }, + { + "name": "cef-inside-unrelated-message-is-not-header", + "dataSource": "synthetic-collector", + "raw": "<14>Sep 17 12:00:00 random-host User wrote CEF:0|Palo Alto Networks|PAN-OS|10.0|end|TRAFFIC|1|src=192.0.2.25 act=allow", + "expected": {}, + "matches": [], + "absent": [ + "log.pa_type", + "origin.ip", + "actionResult" + ], + "alertSides": {} + }, + { + "name": "leef-unverified-retains-raw", + "dataSource": "synthetic-collector", + "raw": "LEEF:1.0|Palo Alto Networks|PAN-OS|10.0|THREAT|src=192.0.2.25\tdst=198.51.100.40", + "expected": {}, + "matches": [], + "absent": [ + "log.pa_type", + "origin.ip", + "actionResult" + ], + "alertSides": {} + }, + { + "name": "url-legacy-tail-layout", + "dataSource": "synthetic-collector", + "raw": "<14>Sep 17 12:00:00 synthetic-fw 1,2026/09/17 12:00:00,SYNTH-FW,THREAT,url,2817,2026/09/17 12:00:00,192.0.2.25,198.51.100.40,,,,,,,vsys1,,,,,,,,,45678,443,,,,tcp,block-url,phishing.example/path,URL Filtering(9999),phishing,medium,client-to-server,,,,,,,,,,,,,,,,,,,,,,,,synthetic-fw,,,,,,,,,,phishing,,,,,\"request,header=\"\"test\"\"\",phishing,11111111-2222-3333-4444-555555555555,,,,,,,,,,client.example,00:11:22:33:44:55,,,,,,,server.example,aa:bb:cc:dd:ee:ff,,,,,,,,,,,,2026-09-17T12:00:00.000-04:00,,,,,,,,,,,,,,synthetic-unknown-tail-a,synthetic-unknown-tail-b", + "expected": { + "origin.host": "client.example", + "target.host": "server.example", + "deviceTime": "2026-09-17T12:00:00.000-04:00", + "log.http_headers": "request,header=\"test\"", + "origin.mac": "00:11:22:33:44:55", + "target.mac": "aa:bb:cc:dd:ee:ff", + "log.paURLLegacyTail1": "synthetic-unknown-tail-a", + "log.paURLLegacyTail2": "synthetic-unknown-tail-b" + }, + "matches": [ + "panos_url_filtering_blocks", + "ioc_threat_intel_match_server_to_client" + ], + "alertSides": { + "panos_url_filtering_blocks": [ + "198.51.100.40", + "192.0.2.25" + ], + "ioc_threat_intel_match_server_to_client": [ + "198.51.100.40", + "192.0.2.25" + ] + }, + "absent": [ + "statusCode", + "log.flow_type", + "log.cluster_name" + ] + }, + { + "name": "url-current-tail-layout", + "dataSource": "synthetic-collector", + "raw": "<14>Sep 17 12:00:00 synthetic-fw 1,2026/09/17 12:00:00,SYNTH-FW,THREAT,url,2817,2026/09/17 12:00:00,192.0.2.25,198.51.100.40,,,,,,,vsys1,,,,,,,,,45678,443,,,,tcp,block-url,phishing.example/path,URL Filtering(9999),phishing,medium,client-to-server,,,,,,,,,,,,,,,,,,,,,,,,synthetic-fw,,,,,,,,,,phishing,,,,,\"request,header=\"\"test\"\"\",HTTP/1.1 403 Forbidden,403,phishing,11111111-2222-3333-4444-555555555555,,,,,,,,,,client.example,00:11:22:33:44:55,,,,,,,server.example,aa:bb:cc:dd:ee:ff,,,,,,,,,,,,2026-09-17T12:00:00.000-04:00,,,,,,,,,,,,,synthetic-cloud-report,synthetic-cluster,synthetic-flow", + "expected": { + "origin.host": "client.example", + "target.host": "server.example", + "deviceTime": "2026-09-17T12:00:00.000-04:00", + "log.http_headers": "request,header=\"test\"", + "origin.mac": "00:11:22:33:44:55", + "target.mac": "aa:bb:cc:dd:ee:ff", + "statusCode": 403, + "log.response_headers": "HTTP/1.1 403 Forbidden", + "log.cloud_reportid": "synthetic-cloud-report", + "log.cluster_name": "synthetic-cluster", + "log.flow_type": "synthetic-flow" + }, + "matches": [ + "panos_url_filtering_blocks", + "ioc_threat_intel_match_server_to_client" + ], + "alertSides": { + "panos_url_filtering_blocks": [ + "198.51.100.40", + "192.0.2.25" + ], + "ioc_threat_intel_match_server_to_client": [ + "198.51.100.40", + "192.0.2.25" + ] + }, + "absent": [] + }, + { + "name": "missing-history-serial", + "dataSource": "synthetic-collector", + "raw": "<14>Sep 17 12:00:00 synthetic-fw 1,2026/09/17 12:00:00,,SYSTEM,auth,2817,2026/09/17 12:00:00,vsys1,auth-fail,,,,general,informational,\"failed authentication for user 'testuser'. Reason: User is not in allowlist. auth profile 'Local', vsys 'vsys1', From: 192.0.2.25.\",1001,,,,,,,synthetic-fw,,,2026-09-17T12:00:00.000-04:00", + "expected": { + "origin.ip": "192.0.2.25", + "origin.user": "testuser", + "target.host": "synthetic-fw", + "action": "auth-fail", + "actionResult": "failure", + "severity": "info", + "deviceTime": "2026-09-17T12:00:00.000-04:00" + }, + "matches": [], + "absent": [ + "log.correlationCandidate.paloalto.authFailure" + ], + "alertSides": {} + }, + { + "name": "missing-history-collector", + "dataSource": "", + "raw": "<14>Sep 17 12:00:00 synthetic-fw 1,2026/09/17 12:00:00,SYNTH-FW,SYSTEM,auth,2817,2026/09/17 12:00:00,vsys1,auth-fail,,,,general,informational,\"failed authentication for user 'testuser'. Reason: User is not in allowlist. auth profile 'Local', vsys 'vsys1', From: 192.0.2.25.\",1001,,,,,,,synthetic-fw,,,2026-09-17T12:00:00.000-04:00", + "expected": { + "origin.ip": "192.0.2.25", + "origin.user": "testuser", + "target.host": "synthetic-fw", + "action": "auth-fail", + "actionResult": "failure", + "severity": "info", + "deviceTime": "2026-09-17T12:00:00.000-04:00" + }, + "matches": [], + "absent": [ + "log.correlationCandidate.paloalto.authFailure" + ], + "alertSides": {} + }, + { + "name": "dns-risk-category-not-c2-dns-ddns", + "dataSource": "synthetic-collector", + "raw": "<14>Sep 17 12:00:00 synthetic-fw 1,2026/09/17 12:00:00,SYNTH-FW,THREAT,spyware,2817,2026/09/17 12:00:00,192.0.2.25,198.51.100.40,203.0.113.25,203.0.113.40,test-rule,testuser,server-user,web-browsing,vsys1,,,,,,,,,45678,443,,,,tcp,alert,example.test/download.exe,DNS signature,any,medium,client-to-server,,,,,,,,aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa,public-cloud,,,,,,,,,,,,,,,synthetic-fw,,,,,,,,,,dns-ddns,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,", + "expected": { + "log.thr_category": "dns-ddns" + }, + "matches": [], + "absent": [ + "log.correlationCandidate.paloalto.dns", + "actionResult" + ], + "alertSides": {} + }, + { + "name": "dns-risk-category-not-c2-dns-parked", + "dataSource": "synthetic-collector", + "raw": "<14>Sep 17 12:00:00 synthetic-fw 1,2026/09/17 12:00:00,SYNTH-FW,THREAT,spyware,2817,2026/09/17 12:00:00,192.0.2.25,198.51.100.40,203.0.113.25,203.0.113.40,test-rule,testuser,server-user,web-browsing,vsys1,,,,,,,,,45678,443,,,,tcp,alert,example.test/download.exe,DNS signature,any,medium,client-to-server,,,,,,,,aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa,public-cloud,,,,,,,,,,,,,,,synthetic-fw,,,,,,,,,,dns-parked,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,", + "expected": { + "log.thr_category": "dns-parked" + }, + "matches": [], + "absent": [ + "log.correlationCandidate.paloalto.dns", + "actionResult" + ], + "alertSides": {} + }, + { + "name": "dns-risk-category-not-c2-dns-grayware", + "dataSource": "synthetic-collector", + "raw": "<14>Sep 17 12:00:00 synthetic-fw 1,2026/09/17 12:00:00,SYNTH-FW,THREAT,spyware,2817,2026/09/17 12:00:00,192.0.2.25,198.51.100.40,203.0.113.25,203.0.113.40,test-rule,testuser,server-user,web-browsing,vsys1,,,,,,,,,45678,443,,,,tcp,alert,example.test/download.exe,DNS signature,any,medium,client-to-server,,,,,,,,aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa,public-cloud,,,,,,,,,,,,,,,synthetic-fw,,,,,,,,,,dns-grayware,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,", + "expected": { + "log.thr_category": "dns-grayware" + }, + "matches": [], + "absent": [ + "log.correlationCandidate.paloalto.dns", + "actionResult" + ], + "alertSides": {} + }, + { + "name": "invalid-mac-remains-vendor", + "dataSource": "synthetic-collector", + "raw": "<14>Sep 17 12:00:00 synthetic-fw 1,2026/09/17 12:00:00,SYNTH-FW,TRAFFIC,end,2817,2026/09/17 12:00:00,192.0.2.25,198.51.100.40,203.0.113.25,203.0.113.40,test-rule,testuser,server-user,ssl,vsys1,,,,,,,,,45678,443,,,,tcp,allow,300,200,100,12,,,,,,,,,,8,4,tcp-fin,11,22,33,44,virtual-system-name,synthetic-fw,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,client.example,not-a-mac,,,,,,,server.example,00:00:00:00:00:zz,,,,,,,,,,,2026-09-17T12:00:00.000-04:00", + "expected": { + "origin.ip": "192.0.2.25", + "target.ip": "198.51.100.40", + "origin.user": "testuser", + "target.user": "server-user", + "origin.port": 45678, + "target.port": 443, + "origin.bytesSent": 200, + "origin.bytesReceived": 100, + "origin.packagesSent": "8", + "origin.packagesReceived": "4", + "log.vsys_name": "virtual-system-name", + "log.device_name": "synthetic-fw", + "origin.host": "client.example", + "target.host": "server.example", + "actionResult": "success", + "log.natsrc": "203.0.113.25" + }, + "matches": [], + "absent": [ + "connectionStatus", + "target.bytesSent", + "origin.mac", + "target.mac" + ], + "alertSides": {} + }, + { + "name": "legacy-seven-field-leef-labelled-compatibility", + "dataSource": "synthetic-collector", + "raw": "LEEF:1|Palo Alto Networks|PAN-OS|10.0|end|TRAFFIC|1|deviceExternalId=SYNTH-FW cs3Label=Virtual System cs3=vsys1 src=192.0.2.25 dst=198.51.100.40 act=deny PanOSPacketsSent=12 PanOSPacketsReceived=4", + "expected": { + "origin.ip": "192.0.2.25", + "target.ip": "198.51.100.40", + "actionResult": "denied", + "origin.packagesSent": "12", + "origin.packagesReceived": "4", + "log.paFormat": "LEEF-legacy" + }, + "matches": [], + "absent": [], + "alertSides": {} + }, + { + "name": "config-custom-layout", + "dataSource": "synthetic-collector", + "raw": "<14>Sep 17 12:00:00 synthetic-fw 1,2026/09/17 12:00:00,SYNTH-FW,CONFIG,,2817,2026/09/17 12:00:00,192.0.2.25,vsys1,commit,admin-test,Web,Submitted,,,,,,,,,,,synthetic-fw,,,,2026-09-17T12:00:00Z", + "expected": { + "origin.ip": "192.0.2.25", + "origin.user": "admin-test", + "target.host": "synthetic-fw", + "action": "commit", + "deviceTime": "2026-09-17T12:00:00Z", + "log.paConfigLayout": "custom" + }, + "matches": [], + "absent": [ + "actionResult" + ], + "alertSides": {} + }, + { + "name": "config-default-layout", + "dataSource": "synthetic-collector", + "raw": "<14>Sep 17 12:00:00 synthetic-fw 1,2026/09/17 12:00:00,SYNTH-FW,CONFIG,,2817,2026/09/17 12:00:00,192.0.2.25,vsys1,commit,admin-test,Web,Submitted,,,,,,,,,synthetic-fw,,,,2026-09-17T12:00:00Z", + "expected": { + "origin.ip": "192.0.2.25", + "origin.user": "admin-test", + "target.host": "synthetic-fw", + "action": "commit", + "deviceTime": "2026-09-17T12:00:00Z", + "log.paConfigLayout": "default" + }, + "matches": [], + "absent": [ + "actionResult" + ], + "alertSides": {} + }, + { + "name": "config-unknown-tail-not-firewall-host", + "dataSource": "synthetic-collector", + "raw": "<14>Sep 17 12:00:00 synthetic-fw 1,2026/09/17 12:00:00,SYNTH-FW,CONFIG,,2817,2026/09/17 12:00:00,192.0.2.25,vsys1,commit,admin-test,Web,Submitted,,,,,,,,,,,audit-comment-not-host,,,,", + "expected": { + "origin.ip": "192.0.2.25", + "origin.user": "admin-test", + "action": "commit", + "log.paConfigTail9": "audit-comment-not-host" + }, + "matches": [], + "absent": [ + "actionResult", + "target.host", + "deviceTime", + "log.device_name", + "log.paConfigLayout" + ], + "alertSides": {} + }, + { + "name": "url-unknown-tail-keeps-unclassified-fields", + "dataSource": "synthetic-collector", + "raw": "<14>Sep 17 12:00:00 synthetic-fw 1,2026/09/17 12:00:00,SYNTH-FW,THREAT,url,2817,2026/09/17 12:00:00,192.0.2.25,198.51.100.40,,,,,,,vsys1,,,,,,,,,45678,443,,,,tcp,block-url,phishing.example/path,URL Filtering(9999),phishing,medium,client-to-server,,,,,,,,,,,,,,,,,,,,,,,,synthetic-fw,,,,,,,,,,phishing,,,,,\"request,header=\"\"test\"\"\",HTTP/1.1 403 Forbidden,403,phishing,11111111-2222-3333-4444-555555555555,,,,,,,,,,client.example,00:11:22:33:44:55,,,,,,,server.example,aa:bb:cc:dd:ee:ff,,,,,,,,,,,,,,,,,,,,,,,,,", + "expected": { + "log.paURLTail1": "403", + "log.misc": "phishing.example/path" + }, + "matches": [ + "panos_url_filtering_blocks", + "ioc_threat_intel_match_server_to_client" + ], + "alertSides": { + "panos_url_filtering_blocks": [ + "198.51.100.40", + "192.0.2.25" + ], + "ioc_threat_intel_match_server_to_client": [ + "198.51.100.40", + "192.0.2.25" + ] + }, + "absent": [ + "origin.host", + "target.host", + "origin.mac", + "target.mac", + "deviceTime", + "statusCode", + "log.paURLLayout", + "target.url" + ] + }, + { + "name": "traffic-new-optional-tail", + "dataSource": "synthetic-collector", + "raw": "<14>Sep 17 12:00:00 synthetic-fw 1,2026/09/17 12:00:00,SYNTH-FW,TRAFFIC,end,2817,2026/09/17 12:00:00,192.0.2.25,198.51.100.40,203.0.113.25,203.0.113.40,test-rule,testuser,server-user,ssl,vsys1,,,,,,,,,45678,443,,,,tcp,allow,300,200,100,12,,,,,,,,,,8,4,tcp-fin,11,22,33,44,virtual-system-name,synthetic-fw,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,client.example,00:11:22:33:44:55,,,,,,,server.example,aa:bb:cc:dd:ee:ff,,,,,,,,,,,2026-09-17T12:00:00.000-04:00,,,,,,,,,,,,,NonProxy,synthetic-cluster,,,,,,,,,,,,synthetic-src-device,synthetic-dst-device", + "expected": { + "origin.ip": "192.0.2.25", + "target.ip": "198.51.100.40", + "origin.user": "testuser", + "target.user": "server-user", + "origin.port": 45678, + "target.port": 443, + "origin.bytesSent": 200, + "origin.bytesReceived": 100, + "origin.packagesSent": "8", + "origin.packagesReceived": "4", + "log.vsys_name": "virtual-system-name", + "log.device_name": "synthetic-fw", + "origin.host": "client.example", + "target.host": "server.example", + "origin.mac": "00:11:22:33:44:55", + "target.mac": "aa:bb:cc:dd:ee:ff", + "actionResult": "success", + "log.natsrc": "203.0.113.25", + "log.flow_type": "NonProxy", + "log.cluster_name": "synthetic-cluster", + "log.src_adv_devid": "synthetic-src-device", + "log.dst_adv_devid": "synthetic-dst-device" + }, + "matches": [], + "absent": [ + "connectionStatus", + "target.bytesSent" + ], + "alertSides": {} + }, + { + "name": "positive-panos_url_filtering_blocks-absolute-url", + "dataSource": "synthetic-collector", + "raw": "<14>Sep 17 12:00:00 synthetic-fw 1,2026/09/17 12:00:00,SYNTH-FW,THREAT,url,2817,2026/09/17 12:00:00,192.0.2.25,198.51.100.40,203.0.113.25,203.0.113.40,test-rule,testuser,server-user,web-browsing,vsys1,,,,,,,,,45678,443,,,,tcp,block-url,https://example.test/download.exe,URL Filtering(9999),phishing,medium,client-to-server,,,,,,,,aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa,public-cloud,,,,,,,,,,,,,,,synthetic-fw,,,,,,,,,,code-execution,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,", + "expected": { + "actionResult": "denied", + "log.misc": "https://example.test/download.exe", + "target.url": "https://example.test/download.exe" + }, + "matches": [ + "panos_url_filtering_blocks" + ], + "absent": [], + "alertSides": { + "panos_url_filtering_blocks": [ + "198.51.100.40", + "192.0.2.25" + ] + } + }, + { + "name": "cef-url-subtype-in-signature-absolute-url", + "dataSource": "synthetic-collector", + "raw": "CEF:0|Palo Alto Networks|PAN-OS|10.0|url|THREAT|5|deviceExternalId=SYNTH-FW cs3Label=Virtual System cs3=vsys1 src=192.0.2.25 dst=198.51.100.40 cat=URL Filtering(9999) cs2Label=URL Category cs2=phishing act=block-url request=https://phishing.example/login", + "expected": { + "log.pa_subtype": "url", + "log.pa_threatid": "URL Filtering(9999)", + "log.misc": "https://phishing.example/login", + "target.url": "https://phishing.example/login" + }, + "matches": [ + "panos_url_filtering_blocks" + ], + "absent": [], + "alertSides": { + "panos_url_filtering_blocks": [ + "198.51.100.40", + "192.0.2.25" + ] + } + }, + { + "name": "url-unknown-tail-keeps-unclassified-fields-absolute-url", + "dataSource": "synthetic-collector", + "raw": "<14>Sep 17 12:00:00 synthetic-fw 1,2026/09/17 12:00:00,SYNTH-FW,THREAT,url,2817,2026/09/17 12:00:00,192.0.2.25,198.51.100.40,,,,,,,vsys1,,,,,,,,,45678,443,,,,tcp,block-url,https://phishing.example/path,URL Filtering(9999),phishing,medium,client-to-server,,,,,,,,,,,,,,,,,,,,,,,,synthetic-fw,,,,,,,,,,phishing,,,,,\"request,header=\"\"test\"\"\",HTTP/1.1 403 Forbidden,403,phishing,11111111-2222-3333-4444-555555555555,,,,,,,,,,client.example,00:11:22:33:44:55,,,,,,,server.example,aa:bb:cc:dd:ee:ff,,,,,,,,,,,,,,,,,,,,,,,,,", + "expected": { + "log.paURLTail1": "403", + "log.misc": "https://phishing.example/path", + "target.url": "https://phishing.example/path" + }, + "matches": [ + "panos_url_filtering_blocks", + "ioc_threat_intel_match_server_to_client" + ], + "alertSides": { + "panos_url_filtering_blocks": [ + "198.51.100.40", + "192.0.2.25" + ], + "ioc_threat_intel_match_server_to_client": [ + "198.51.100.40", + "192.0.2.25" + ] + }, + "absent": [ + "origin.host", + "target.host", + "origin.mac", + "target.mac", + "deviceTime", + "statusCode", + "log.paURLLayout" + ] + }, + { + "name": "cef-config-device-placeholder-dash", + "dataSource": "synthetic-collector", + "raw": "CEF:0|Palo Alto Networks|PAN-OS|10.0|Succeeded|CONFIG|1|deviceExternalId=SYNTH-FW cs3Label=Virtual System cs3=vsys1 shost=192.0.2.25 act=commit duser=testadmin dvchost=- msg=/config/devices/entry", + "expected": { + "origin.ip": "192.0.2.25", + "origin.user": "testadmin", + "action": "commit", + "actionResult": "success" + }, + "matches": [], + "absent": [ + "target.user", + "target.path", + "origin.path", + "target.host" + ], + "alertSides": {} + }, + { + "name": "cef-config-device-placeholder-na", + "dataSource": "synthetic-collector", + "raw": "CEF:0|Palo Alto Networks|PAN-OS|10.0|Succeeded|CONFIG|1|deviceExternalId=SYNTH-FW cs3Label=Virtual System cs3=vsys1 shost=192.0.2.25 act=commit duser=testadmin dvchost=N/A msg=/config/devices/entry", + "expected": { + "origin.ip": "192.0.2.25", + "origin.user": "testadmin", + "action": "commit", + "actionResult": "success" + }, + "matches": [], + "absent": [ + "target.user", + "target.path", + "origin.path", + "target.host" + ], + "alertSides": {} + }, + { + "name": "cef-config-device-placeholder-empty", + "dataSource": "synthetic-collector", + "raw": "CEF:0|Palo Alto Networks|PAN-OS|10.0|Succeeded|CONFIG|1|deviceExternalId=SYNTH-FW cs3Label=Virtual System cs3=vsys1 shost=192.0.2.25 act=commit duser=testadmin dvchost= msg=/config/devices/entry", + "expected": { + "origin.ip": "192.0.2.25", + "origin.user": "testadmin", + "action": "commit", + "actionResult": "success" + }, + "matches": [], + "absent": [ + "target.user", + "target.path", + "origin.path", + "target.host" + ], + "alertSides": {} + }, + { + "name": "cef-config-device-absent", + "dataSource": "synthetic-collector", + "raw": "CEF:0|Palo Alto Networks|PAN-OS|10.0|Succeeded|CONFIG|1|deviceExternalId=SYNTH-FW cs3Label=Virtual System cs3=vsys1 shost=192.0.2.25 act=commit duser=testadmin msg=/config/devices/entry", + "expected": { + "origin.ip": "192.0.2.25", + "origin.user": "testadmin", + "action": "commit", + "actionResult": "success" + }, + "matches": [], + "absent": [ + "target.user", + "target.path", + "origin.path", + "target.host" + ], + "alertSides": {} + }, + { + "name": "documented-data-tail-order", + "dataSource": "synthetic-collector", + "raw": "<14>Sep 17 12:00:00 synthetic-fw 1,2026/09/17 12:00:00,SYNTH-FW,THREAT,data,2817,2026/09/17 12:00:00,192.0.2.25,198.51.100.40,,,,,,,vsys1,,,,,,,,,45678,443,,,,tcp,alert,synthetic-file.bin,Synthetic content(12345),benign,low,client-to-server,,,,,,,,,,,,,,,,,,,,,,,,synthetic-fw,,,,,,,,,,benign,,,,,\"request,header=\"\"test\"\"\",phishing,11111111-2222-3333-4444-555555555555,,,,,,,,,,client.example,00:11:22:33:44:55,,,,,,,server.example,aa:bb:cc:dd:ee:ff,,,,,,,,,,,,2026-09-17T12:00:00.000-04:00,,,,,,,,,,,,,synthetic-cloud-report,synthetic-cluster,synthetic-flow", + "expected": { + "origin.host": "client.example", + "target.host": "server.example", + "deviceTime": "2026-09-17T12:00:00.000-04:00", + "log.http_headers": "request,header=\"test\"", + "origin.mac": "00:11:22:33:44:55", + "target.mac": "aa:bb:cc:dd:ee:ff", + "log.cloud_reportid": "synthetic-cloud-report", + "log.cluster_name": "synthetic-cluster", + "log.flow_type": "synthetic-flow", + "log.pa_subtype": "data", + "severity": "info" + }, + "matches": [], + "alertSides": {}, + "absent": [ + "statusCode", + "actionResult", + "target.url" + ] + }, + { + "name": "documented-dlp-tail-order", + "dataSource": "synthetic-collector", + "raw": "<14>Sep 17 12:00:00 synthetic-fw 1,2026/09/17 12:00:00,SYNTH-FW,THREAT,dlp,2817,2026/09/17 12:00:00,192.0.2.25,198.51.100.40,,,,,,,vsys1,,,,,,,,,45678,443,,,,tcp,alert,synthetic-file.bin,Synthetic content(12345),benign,low,client-to-server,,,,,,,,,,,,,,,,,,,,,,,,synthetic-fw,,,,,,,,,,benign,,,,,\"request,header=\"\"test\"\"\",phishing,11111111-2222-3333-4444-555555555555,,,,,,,,,,client.example,00:11:22:33:44:55,,,,,,,server.example,aa:bb:cc:dd:ee:ff,,,,,,,,,,,,2026-09-17T12:00:00.000-04:00,,,,,,,,,,,,,synthetic-cloud-report,synthetic-cluster,synthetic-flow", + "expected": { + "origin.host": "client.example", + "target.host": "server.example", + "deviceTime": "2026-09-17T12:00:00.000-04:00", + "log.http_headers": "request,header=\"test\"", + "origin.mac": "00:11:22:33:44:55", + "target.mac": "aa:bb:cc:dd:ee:ff", + "log.cloud_reportid": "synthetic-cloud-report", + "log.cluster_name": "synthetic-cluster", + "log.flow_type": "synthetic-flow", + "log.pa_subtype": "dlp", + "severity": "info" + }, + "matches": [], + "alertSides": {}, + "absent": [ + "statusCode", + "actionResult", + "target.url" + ] + }, + { + "name": "documented-dlp-non-file-tail-order", + "dataSource": "synthetic-collector", + "raw": "<14>Sep 17 12:00:00 synthetic-fw 1,2026/09/17 12:00:00,SYNTH-FW,THREAT,dlp-non-file,2817,2026/09/17 12:00:00,192.0.2.25,198.51.100.40,,,,,,,vsys1,,,,,,,,,45678,443,,,,tcp,alert,synthetic-file.bin,Synthetic content(12345),benign,low,client-to-server,,,,,,,,,,,,,,,,,,,,,,,,synthetic-fw,,,,,,,,,,benign,,,,,\"request,header=\"\"test\"\"\",phishing,11111111-2222-3333-4444-555555555555,,,,,,,,,,client.example,00:11:22:33:44:55,,,,,,,server.example,aa:bb:cc:dd:ee:ff,,,,,,,,,,,,2026-09-17T12:00:00.000-04:00,,,,,,,,,,,,,synthetic-cloud-report,synthetic-cluster,synthetic-flow", + "expected": { + "origin.host": "client.example", + "target.host": "server.example", + "deviceTime": "2026-09-17T12:00:00.000-04:00", + "log.http_headers": "request,header=\"test\"", + "origin.mac": "00:11:22:33:44:55", + "target.mac": "aa:bb:cc:dd:ee:ff", + "log.cloud_reportid": "synthetic-cloud-report", + "log.cluster_name": "synthetic-cluster", + "log.flow_type": "synthetic-flow", + "log.pa_subtype": "dlp-non-file", + "severity": "info" + }, + "matches": [], + "alertSides": {}, + "absent": [ + "statusCode", + "actionResult", + "target.url" + ] + }, + { + "name": "documented-file-tail-order", + "dataSource": "synthetic-collector", + "raw": "<14>Sep 17 12:00:00 synthetic-fw 1,2026/09/17 12:00:00,SYNTH-FW,THREAT,file,2817,2026/09/17 12:00:00,192.0.2.25,198.51.100.40,,,,,,,vsys1,,,,,,,,,45678,443,,,,tcp,alert,synthetic-file.bin,Synthetic content(12345),benign,low,client-to-server,,,,,,,,,,,,,,,,,,,,,,,,synthetic-fw,,,,,,,,,,benign,,,,,\"request,header=\"\"test\"\"\",phishing,11111111-2222-3333-4444-555555555555,,,,,,,,,,client.example,00:11:22:33:44:55,,,,,,,server.example,aa:bb:cc:dd:ee:ff,,,,,,,,,,,,2026-09-17T12:00:00.000-04:00,,,,,,,,,,,,,synthetic-cloud-report,synthetic-cluster,synthetic-flow", + "expected": { + "origin.host": "client.example", + "target.host": "server.example", + "deviceTime": "2026-09-17T12:00:00.000-04:00", + "log.http_headers": "request,header=\"test\"", + "origin.mac": "00:11:22:33:44:55", + "target.mac": "aa:bb:cc:dd:ee:ff", + "log.cloud_reportid": "synthetic-cloud-report", + "log.cluster_name": "synthetic-cluster", + "log.flow_type": "synthetic-flow", + "log.pa_subtype": "file", + "severity": "info" + }, + "matches": [], + "alertSides": {}, + "absent": [ + "statusCode", + "actionResult", + "target.url" + ] + }, + { + "name": "documented-spyware-tail-order", + "dataSource": "synthetic-collector", + "raw": "<14>Sep 17 12:00:00 synthetic-fw 1,2026/09/17 12:00:00,SYNTH-FW,THREAT,spyware,2817,2026/09/17 12:00:00,192.0.2.25,198.51.100.40,,,,,,,vsys1,,,,,,,,,45678,443,,,,tcp,alert,synthetic-file.bin,Synthetic content(12345),benign,low,client-to-server,,,,,,,,,,,,,,,,,,,,,,,,synthetic-fw,,,,,,,,,,benign,,,,,\"request,header=\"\"test\"\"\",phishing,11111111-2222-3333-4444-555555555555,,,,,,,,,,client.example,00:11:22:33:44:55,,,,,,,server.example,aa:bb:cc:dd:ee:ff,,,,,,,,,,,,2026-09-17T12:00:00.000-04:00,,,,,,,,,,,,,synthetic-cloud-report,synthetic-flow,synthetic-cluster", + "expected": { + "origin.host": "client.example", + "target.host": "server.example", + "deviceTime": "2026-09-17T12:00:00.000-04:00", + "log.http_headers": "request,header=\"test\"", + "origin.mac": "00:11:22:33:44:55", + "target.mac": "aa:bb:cc:dd:ee:ff", + "log.cloud_reportid": "synthetic-cloud-report", + "log.cluster_name": "synthetic-cluster", + "log.flow_type": "synthetic-flow", + "log.pa_subtype": "spyware", + "severity": "info" + }, + "matches": [], + "alertSides": {}, + "absent": [ + "statusCode", + "actionResult", + "target.url" + ] + } +] diff --git a/rules/paloalto/pa_firewall/ioc_threat_intel_match.yml b/rules/paloalto/pa_firewall/ioc_threat_intel_match.yml index b4d468b28..9fbbe93cb 100644 --- a/rules/paloalto/pa_firewall/ioc_threat_intel_match.yml +++ b/rules/paloalto/pa_firewall/ioc_threat_intel_match.yml @@ -1,38 +1,29 @@ -# Rule version v1.0.0 +# Rule version v2.0.0 dataTypes: - - firewall-paloalto -name: IOC Match from Threat Intelligence Feed +- firewall-paloalto +name: PAN-OS Blocked Threat Category Detection (session source) impact: confidentiality: 3 integrity: 3 availability: 2 -category: Defense Evasion -technique: "T1027 - Obfuscated Files or Information" +category: Intrusion Detection +technique: '' adversary: origin references: - - https://docs.paloaltonetworks.com/cortex/cortex-xsoar/threat-intelligence-management - - https://attack.mitre.org/techniques/T1027/ -description: | - Detects when network traffic matches known Indicators of Compromise (IOCs) from threat intelligence feeds. This includes malicious IPs, domains, URLs, or file hashes associated with known threat actors or campaigns. The Palo Alto firewall has identified and blocked traffic based on threat intelligence data. - - Next Steps: - 1. Review the specific IOC that triggered the alert and verify its legitimacy - 2. Investigate the source IP address for additional suspicious activities - 3. Check if the same IOC has been observed from other internal hosts - 4. Examine the target destination for potential compromise indicators - 5. Update threat intelligence feeds and firewall rules as necessary - 6. Consider isolating affected hosts if compromise is confirmed - 7. Document the incident and IOC details for threat hunting activities -where: | - (contains("log.panOSThreatCategory", "malware") || - contains("log.panOSThreatCategory", "command-and-control") || - contains("log.panOSThreatCategory", "phishing") || - contains("log.panOSThreatCategory", "botnet") || - contains("log.msg", "threat-intel") || - contains("log.msg", "ioc-match")) && - oneOf("log.panOSAction", ["block", "deny", "drop", "reset-both", "reset-client", "reset-server"]) +- https://docs.paloaltonetworks.com/ngfw/administration/monitoring/use-syslog-for-monitoring/syslog-field-descriptions/threat-log-fields +description: Detects a blocked PAN-OS threat categorized as malware, command-and-control, phishing or botnet. The + category alone does not establish membership in an external intelligence feed. Review the signature, vendor action, + session endpoints and attack direction; a blocked event does not establish compromise. For URL-category events, + the requested remote resource is the adversary; the request direction does not make the requesting client the + malicious resource. +where: equals("log.pa_type", "THREAT") && oneOf("log.thr_category", ["malware", "command-and-control", "phishing", + "botnet"]) && equals("actionResult", "denied") && exists("origin.ip") && exists("target.ip") && !equals("log.pa_subtype", + "url") && equals("log.paDirection", "client-to-server") groupBy: - - lastEvent.log.panOSThreatID - - adversary.ip - - target.ip +- lastEvent.dataSource +- lastEvent.log.paScope +- lastEvent.log.paVsys +- adversary.ip +- target.ip +- lastEvent.log.pa_threatid diff --git a/rules/paloalto/pa_firewall/ioc_threat_intel_match_server_to_client.yml b/rules/paloalto/pa_firewall/ioc_threat_intel_match_server_to_client.yml new file mode 100644 index 000000000..9c38c0527 --- /dev/null +++ b/rules/paloalto/pa_firewall/ioc_threat_intel_match_server_to_client.yml @@ -0,0 +1,29 @@ +# Rule version v2.0.0 + +dataTypes: +- firewall-paloalto +name: PAN-OS Blocked Threat Category Detection (session destination) +impact: + confidentiality: 3 + integrity: 3 + availability: 2 +category: Intrusion Detection +technique: '' +adversary: target +references: +- https://docs.paloaltonetworks.com/ngfw/administration/monitoring/use-syslog-for-monitoring/syslog-field-descriptions/threat-log-fields +description: Detects a blocked PAN-OS threat categorized as malware, command-and-control, phishing or botnet. The + category alone does not establish membership in an external intelligence feed. Review the signature, vendor action, + session endpoints and attack direction; a blocked event does not establish compromise. For URL-category events, + the requested remote resource is the adversary; the request direction does not make the requesting client the + malicious resource. +where: equals("log.pa_type", "THREAT") && oneOf("log.thr_category", ["malware", "command-and-control", "phishing", + "botnet"]) && equals("actionResult", "denied") && exists("origin.ip") && exists("target.ip") && (equals("log.pa_subtype", + "url") || equals("log.paDirection", "server-to-client")) +groupBy: +- lastEvent.dataSource +- lastEvent.log.paScope +- lastEvent.log.paVsys +- adversary.ip +- target.ip +- lastEvent.log.pa_threatid diff --git a/rules/paloalto/pa_firewall/panos_admin_brute_force.yml b/rules/paloalto/pa_firewall/panos_admin_brute_force.yml index e395bc50e..8d84c72fe 100644 --- a/rules/paloalto/pa_firewall/panos_admin_brute_force.yml +++ b/rules/paloalto/pa_firewall/panos_admin_brute_force.yml @@ -1,43 +1,48 @@ -# Rule version v1.0.0 +# Rule version v2.0.0 dataTypes: - - firewall-paloalto -name: PAN-OS Management Plane Login Brute Force +- firewall-paloalto +name: PAN-OS Repeated Authentication Failures impact: confidentiality: 3 integrity: 3 availability: 1 category: Credential Access -technique: "T1110 - Brute Force" +technique: T1110 - Brute Force adversary: origin references: - - https://docs.paloaltonetworks.com/pan-os/10-2/pan-os-admin/monitoring/use-syslog-for-monitoring/syslog-field-descriptions/system-log-fields - - https://attack.mitre.org/techniques/T1110/ -description: | - Detects multiple failed login attempts to the PAN-OS management plane (web UI, SSH, or API), indicating potential brute force attacks against firewall administrative credentials. - - Next Steps: - 1. Investigate the source IP attempting management authentication - 2. Verify if the targeted admin account exists and is active - 3. Check for any successful logins from the same source after failures - 4. Consider restricting management access by IP address - 5. Enable account lockout policies if not already configured - 6. Review management interface exposure and restrict to trusted networks -where: | - equals("log.pa_type", "SYSTEM") && - (contains("log.message", ["auth", "login"]) && contains("log.message", ["fail", "invalid", "denied"])) && - exists("origin.ip") -afterEvents: - - indexPattern: v11-log-firewall-paloalto-* - with: - - field: origin.ip - operator: filter_term - value: '{{.origin.ip}}' - - field: log.pa_type - operator: filter_term - value: 'SYSTEM' - within: 15m - count: 10 +- https://docs.paloaltonetworks.com/ngfw/administration/monitoring/use-syslog-for-monitoring/syslog-field-descriptions/system-log-fields +- https://attack.mitre.org/techniques/T1110/ +description: Detects ten SYSTEM auth-fail events from the same observed source, collector, firewall and virtual + system within fifteen minutes. The event can come from different authentication services; it does not by itself + prove a management-plane login. Check the authentication profile, requested user and any subsequent successes + before treating the sequence as an attack. +where: equals("log.pa_type", "SYSTEM") && equals("log.eventid", "auth-fail") && equals("actionResult", "failure") + && exists("origin.ip") && exists("dataSource") && !equals("dataSource", "") && exists("log.paScope") && exists("log.paVsys") groupBy: - - adversary.ip - - adversary.user +- lastEvent.dataSource +- lastEvent.log.paScope +- lastEvent.log.paVsys +- adversary.ip +- target.ip +- adversary.user +afterEvents: +- indexPattern: v11-log-firewall-paloalto-* + with: + - field: dataSource + operator: filter_term + value: '{{.dataSource}}' + - field: log.paScope + operator: filter_term + value: '{{.log.paScope}}' + - field: log.paVsys + operator: filter_term + value: '{{.log.paVsys}}' + - field: origin.ip + operator: filter_term + value: '{{.origin.ip}}' + - field: log.correlationCandidate.paloalto.authFailure + operator: filter_term + value: match + within: 15m + count: 10 diff --git a/rules/paloalto/pa_firewall/panos_dns_security_alerts.yml b/rules/paloalto/pa_firewall/panos_dns_security_alerts.yml index f48a242aa..4bbf7e5a6 100644 --- a/rules/paloalto/pa_firewall/panos_dns_security_alerts.yml +++ b/rules/paloalto/pa_firewall/panos_dns_security_alerts.yml @@ -1,46 +1,49 @@ -# Rule version v1.0.0 +# Rule version v2.0.0 dataTypes: - - firewall-paloalto -name: PAN-OS DNS Security Alert Detection +- firewall-paloalto +name: PAN-OS Repeated DNS Security Detections impact: confidentiality: 3 integrity: 2 availability: 1 -category: Command and Control -technique: "T1071.004 - Application Layer Protocol: DNS" +category: Intrusion Detection +technique: '' adversary: origin references: - - https://docs.paloaltonetworks.com/pan-os/10-2/pan-os-admin/threat-prevention/dns-security - - https://attack.mitre.org/techniques/T1071/004/ -description: | - Detects PAN-OS DNS Security alerts including DNS sinkholing, domain generation algorithm (DGA) detection, DNS tunneling, and queries to known malicious domains. These alerts indicate potential C2 communication or data exfiltration via DNS. - - Next Steps: - 1. Identify the internal host generating suspicious DNS queries - 2. Review the queried domains for DGA patterns or known malicious indicators - 3. Check if DNS tunneling tools are installed on the source system - 4. Review the DNS query frequency and payload sizes for anomalies - 5. Investigate the source host for malware infection - 6. Block the malicious domains and scan the affected host -where: | - equals("log.pa_type", "THREAT") && - (equals("log.pa_subtype", "dns") || - (contains("log.message", "DNS") && contains("log.message", ["sinkhole", "DGA", "tunnel", "malicious"]))) && - (oneOf("log.act", ["sinkhole", "block-url", "alert", "drop"]) || - exists("log.DNSSICategory")) && - exists("origin.ip") -afterEvents: - - indexPattern: v11-log-firewall-paloalto-* - with: - - field: origin.ip - operator: filter_term - value: '{{.origin.ip}}' - - field: log.pa_subtype - operator: filter_term - value: 'dns' - within: 30m - count: 3 +- https://docs.paloaltonetworks.com/ngfw/administration/monitoring/use-syslog-for-monitoring/syslog-field-descriptions/threat-log-fields +- https://docs.paloaltonetworks.com/dns-security/administration/monitor-dns-security/view-dns-security-logs +description: Detects three relevant DNS security events from the same observed source, collector, firewall and virtual + system within thirty minutes. Supports the legacy dns subtype and spyware sinkhole or dns-c2/dns-malware category + events. A source can be a forwarding resolver rather than the original endpoint. Trace the DNS request and vendor + action before attributing compromise; an alert action does not prove a successful connection. +where: equals("log.pa_type", "THREAT") && (equals("log.pa_subtype", "dns") || (equals("log.pa_subtype", "spyware") + && (equals("action", "sinkhole") || oneOf("log.thr_category", ["dns-c2", "dns-malware"])))) && oneOf("action", + ["sinkhole", "block-url", "alert", "drop", "reset-both", "reset-client", "reset-server", "block-ip"]) && exists("origin.ip") + && exists("dataSource") && !equals("dataSource", "") && exists("log.paScope") && exists("log.paVsys") groupBy: - - adversary.ip - - target.host +- lastEvent.dataSource +- lastEvent.log.paScope +- lastEvent.log.paVsys +- adversary.ip +- target.ip +afterEvents: +- indexPattern: v11-log-firewall-paloalto-* + with: + - field: dataSource + operator: filter_term + value: '{{.dataSource}}' + - field: log.paScope + operator: filter_term + value: '{{.log.paScope}}' + - field: log.paVsys + operator: filter_term + value: '{{.log.paVsys}}' + - field: origin.ip + operator: filter_term + value: '{{.origin.ip}}' + - field: log.correlationCandidate.paloalto.dns + operator: filter_term + value: match + within: 30m + count: 3 diff --git a/rules/paloalto/pa_firewall/panos_spyware_vulnerability.yml b/rules/paloalto/pa_firewall/panos_spyware_vulnerability.yml index e3e6ec993..13a567330 100644 --- a/rules/paloalto/pa_firewall/panos_spyware_vulnerability.yml +++ b/rules/paloalto/pa_firewall/panos_spyware_vulnerability.yml @@ -1,35 +1,27 @@ -# Rule version v1.0.0 +# Rule version v2.0.0 dataTypes: - - firewall-paloalto -name: PAN-OS Spyware and Vulnerability Threat Detection +- firewall-paloalto +name: PAN-OS High-Severity Spyware or Vulnerability Detection (client-to-server) impact: confidentiality: 3 integrity: 3 availability: 2 category: Intrusion Detection -technique: "T1190 - Exploit Public-Facing Application" +technique: '' adversary: origin references: - - https://docs.paloaltonetworks.com/pan-os/10-2/pan-os-admin/threat-prevention - - https://attack.mitre.org/techniques/T1190/ -description: | - Detects spyware and vulnerability threat detections from PAN-OS threat prevention engine. These alerts indicate active exploitation attempts, spyware callbacks, or known vulnerability exploitation against protected hosts. - - Next Steps: - 1. Investigate the source and target of the detected threat - 2. Review the specific threat ID and signature for vulnerability details - 3. Check if the attack was blocked or only alerted - 4. Verify the target system is patched against the exploited vulnerability - 5. Scan the target system for signs of compromise if the threat was not blocked - 6. Update threat prevention signatures and review security profiles -where: | - equals("log.pa_type", "THREAT") && - oneOf("log.pa_subtype", ["spyware", "vulnerability"]) && - oneOf("log.severityLabel", ["critical", "high"]) && - exists("origin.ip") && - exists("target.ip") +- https://docs.paloaltonetworks.com/ngfw/administration/monitoring/use-syslog-for-monitoring/syslog-field-descriptions/threat-log-fields +description: Detects a high or critical PAN-OS spyware or vulnerability signature. The signature does not prove + successful exploitation, a public-facing target, or a particular technique. Review the threat ID, action and attack + direction. Session source and destination retain their physical roles; the rule uses the documented attack direction + to select the alert adversary. +where: equals("log.pa_type", "THREAT") && oneOf("log.pa_subtype", ["spyware", "vulnerability"]) && oneOf("log.severityLabel", + ["high", "critical"]) && exists("origin.ip") && exists("target.ip") && equals("log.paDirection", "client-to-server") groupBy: - - lastEvent.log.pa_threatid - - adversary.ip - - target.ip +- lastEvent.dataSource +- lastEvent.log.paScope +- lastEvent.log.paVsys +- adversary.ip +- target.ip +- lastEvent.log.pa_threatid diff --git a/rules/paloalto/pa_firewall/panos_spyware_vulnerability_server_to_client.yml b/rules/paloalto/pa_firewall/panos_spyware_vulnerability_server_to_client.yml new file mode 100644 index 000000000..7e8e93565 --- /dev/null +++ b/rules/paloalto/pa_firewall/panos_spyware_vulnerability_server_to_client.yml @@ -0,0 +1,27 @@ +# Rule version v2.0.0 + +dataTypes: +- firewall-paloalto +name: PAN-OS High-Severity Spyware or Vulnerability Detection (server-to-client) +impact: + confidentiality: 3 + integrity: 3 + availability: 2 +category: Intrusion Detection +technique: '' +adversary: target +references: +- https://docs.paloaltonetworks.com/ngfw/administration/monitoring/use-syslog-for-monitoring/syslog-field-descriptions/threat-log-fields +description: Detects a high or critical PAN-OS spyware or vulnerability signature. The signature does not prove + successful exploitation, a public-facing target, or a particular technique. Review the threat ID, action and attack + direction. Session source and destination retain their physical roles; the rule uses the documented attack direction + to select the alert adversary. +where: equals("log.pa_type", "THREAT") && oneOf("log.pa_subtype", ["spyware", "vulnerability"]) && oneOf("log.severityLabel", + ["high", "critical"]) && exists("origin.ip") && exists("target.ip") && equals("log.paDirection", "server-to-client") +groupBy: +- lastEvent.dataSource +- lastEvent.log.paScope +- lastEvent.log.paVsys +- adversary.ip +- target.ip +- lastEvent.log.pa_threatid diff --git a/rules/paloalto/pa_firewall/panos_url_filtering_blocks.yml b/rules/paloalto/pa_firewall/panos_url_filtering_blocks.yml index ec9b867ff..0b9cc7adb 100644 --- a/rules/paloalto/pa_firewall/panos_url_filtering_blocks.yml +++ b/rules/paloalto/pa_firewall/panos_url_filtering_blocks.yml @@ -1,45 +1,51 @@ -# Rule version v1.0.0 +# Rule version v2.0.0 dataTypes: - - firewall-paloalto -name: PAN-OS Malicious URL Category Block +- firewall-paloalto +name: PAN-OS Repeated Risky URL Category Detections impact: confidentiality: 3 integrity: 2 availability: 1 -category: Command and Control -technique: "T1071.001 - Application Layer Protocol: Web Protocols" -adversary: origin +category: Intrusion Detection +technique: '' +adversary: target references: - - https://docs.paloaltonetworks.com/pan-os/10-2/pan-os-admin/url-filtering - - https://attack.mitre.org/techniques/T1071/001/ -description: | - Detects URL filtering blocks for malicious, phishing, or command-and-control URL categories on Palo Alto firewalls. Repeated blocks from the same host may indicate malware infection or compromised credentials. - - Next Steps: - 1. Investigate the internal host that attempted to access the malicious URL - 2. Review the URL category and specific blocked domain for threat context - 3. Check if the user clicked a phishing link in email - 4. Scan the host for malware if the URL was a C2 callback - 5. Review other connections from the same host for additional IOCs - 6. Block the destination domain at DNS level for defense in depth -where: | - equals("log.pa_type", "THREAT") && - equals("log.pa_subtype", "url") && - oneOf("log.act", ["block-url", "block-page", "block-override", "alert"]) && - (oneOf("log.urlCategory", ["malware", "phishing", "command-and-control", "grayware", "hacking"]) || - contains("log.category", ["malware", "phishing", "command-and-control", "grayware", "hacking"])) -afterEvents: - - indexPattern: v11-log-firewall-paloalto-* - with: - - field: origin.ip - operator: filter_term - value: '{{.origin.ip}}' - - field: log.pa_subtype - operator: filter_term - value: 'url' - within: 30m - count: 5 +- https://docs.paloaltonetworks.com/ngfw/administration/monitoring/use-syslog-for-monitoring/syslog-field-descriptions/url-filtering-log-fields +description: Detects five URL events in the configured malware, phishing, command-and-control, grayware or hacking + categories from the same observed source, collector, firewall and virtual system within thirty minutes. Includes + alert-only detections and blocked/confirmation-page requests. Grayware or hacking categorization does not prove + malware, and requesting a URL does not prove execution or compromise. The requested remote resource is the alert + adversary; the requesting client is its target. Inspect the URL and action; a later continue/override is a separate + event. +where: equals("log.pa_type", "THREAT") && equals("log.pa_subtype", "url") && oneOf("action", ["block-url", "block-page", + "block-continue", "block-override", "alert"]) && oneOf("log.category", ["malware", "phishing", "command-and-control", + "grayware", "hacking"]) && exists("origin.ip") && exists("dataSource") && !equals("dataSource", "") && exists("log.paScope") + && exists("log.paVsys") groupBy: - - adversary.ip - - target.host +- lastEvent.dataSource +- lastEvent.log.paScope +- lastEvent.log.paVsys +- adversary.ip +- target.ip +- lastEvent.log.category +afterEvents: +- indexPattern: v11-log-firewall-paloalto-* + with: + - field: dataSource + operator: filter_term + value: '{{.dataSource}}' + - field: log.paScope + operator: filter_term + value: '{{.log.paScope}}' + - field: log.paVsys + operator: filter_term + value: '{{.log.paVsys}}' + - field: origin.ip + operator: filter_term + value: '{{.origin.ip}}' + - field: log.correlationCandidate.paloalto.url + operator: filter_term + value: match + within: 30m + count: 5 diff --git a/rules/paloalto/pa_firewall/wildfire_malware_detection.yml b/rules/paloalto/pa_firewall/wildfire_malware_detection.yml index d74791573..2986556a7 100644 --- a/rules/paloalto/pa_firewall/wildfire_malware_detection.yml +++ b/rules/paloalto/pa_firewall/wildfire_malware_detection.yml @@ -1,32 +1,28 @@ -# Rule version v1.0.0 +# Rule version v2.0.0 dataTypes: - - firewall-paloalto -name: WildFire Malware Detection +- firewall-paloalto +name: PAN-OS WildFire Malware Verdict (client-to-server) impact: confidentiality: 3 integrity: 3 availability: 2 -category: Execution -technique: "T1204.002 - User Execution: Malicious File" +category: Malware Detection +technique: '' adversary: origin references: - - https://docs.paloaltonetworks.com/advanced-wildfire/administration/advanced-wildfire-overview - - https://attack.mitre.org/techniques/T1204/002/ -description: | - Detects when WildFire identifies malicious files or malware based on threat analysis. This rule triggers on files with malicious verdicts from WildFire's advanced analysis engine, indicating potential malware execution or file-based threats. - - Next Steps: - 1. Immediately isolate the affected host to prevent lateral movement - 2. Review the file hash and name from the WildFire report - 3. Check if the file was executed or just downloaded - 4. Investigate user activity around the time of detection - 5. Scan other systems for the same file hash - 6. Review email logs if the file came via email attachment - 7. Update security policies to prevent similar threats - 8. Consider forensic analysis of the affected system -where: equals("log.pa_type", "THREAT") && equals("log.pa_subtype", "wildfire") && oneOf("log.severityLabel", ["high", "critical"]) && oneOf("log.act", ["alert", "block", "deny"]) +- https://docs.paloaltonetworks.com/ngfw/administration/monitoring/use-syslog-for-monitoring/syslog-field-descriptions/threat-log-fields +description: Detects a high or critical WildFire submission with the explicit malware verdict. A WildFire verdict + is analysis of a submitted file; it does not prove file execution. Inspect the hash, action and endpoint evidence. + The block action indicates a blocked file; alert alone does not establish prevention. Benign, grayware and phishing + verdicts are not mislabeled as malware by this rule. +where: equals("log.pa_type", "THREAT") && equals("log.pa_subtype", "wildfire") && equals("log.category", "malware") + && oneOf("log.severityLabel", ["high", "critical"]) && oneOf("action", ["alert", "block", "deny"]) && exists("origin.ip") + && exists("target.ip") && equals("log.paDirection", "client-to-server") groupBy: - - lastEvent.log.pa_threatid - - target.host - - target.ip +- lastEvent.dataSource +- lastEvent.log.paScope +- lastEvent.log.paVsys +- adversary.ip +- target.ip +- lastEvent.log.pa_threatid diff --git a/rules/paloalto/pa_firewall/wildfire_malware_detection_server_to_client.yml b/rules/paloalto/pa_firewall/wildfire_malware_detection_server_to_client.yml new file mode 100644 index 000000000..5cc32dab7 --- /dev/null +++ b/rules/paloalto/pa_firewall/wildfire_malware_detection_server_to_client.yml @@ -0,0 +1,28 @@ +# Rule version v2.0.0 + +dataTypes: +- firewall-paloalto +name: PAN-OS WildFire Malware Verdict (server-to-client) +impact: + confidentiality: 3 + integrity: 3 + availability: 2 +category: Malware Detection +technique: '' +adversary: target +references: +- https://docs.paloaltonetworks.com/ngfw/administration/monitoring/use-syslog-for-monitoring/syslog-field-descriptions/threat-log-fields +description: Detects a high or critical WildFire submission with the explicit malware verdict. A WildFire verdict + is analysis of a submitted file; it does not prove file execution. Inspect the hash, action and endpoint evidence. + The block action indicates a blocked file; alert alone does not establish prevention. Benign, grayware and phishing + verdicts are not mislabeled as malware by this rule. +where: equals("log.pa_type", "THREAT") && equals("log.pa_subtype", "wildfire") && equals("log.category", "malware") + && oneOf("log.severityLabel", ["high", "critical"]) && oneOf("action", ["alert", "block", "deny"]) && exists("origin.ip") + && exists("target.ip") && equals("log.paDirection", "server-to-client") +groupBy: +- lastEvent.dataSource +- lastEvent.log.paScope +- lastEvent.log.paVsys +- adversary.ip +- target.ip +- lastEvent.log.pa_threatid diff --git a/rules/paloalto/pa_firewall/zero_day_exploit_prevention.yml b/rules/paloalto/pa_firewall/zero_day_exploit_prevention.yml index 0339ae464..f91185bef 100644 --- a/rules/paloalto/pa_firewall/zero_day_exploit_prevention.yml +++ b/rules/paloalto/pa_firewall/zero_day_exploit_prevention.yml @@ -1,41 +1,56 @@ -# Rule version v1.0.0 +# Rule version v2.0.0 dataTypes: - - firewall-paloalto -name: Zero-Day Exploit Prevention +- firewall-paloalto +name: PAN-OS Repeated High-Severity Vulnerability Signatures (client-to-server) impact: confidentiality: 3 integrity: 3 availability: 3 -category: Execution -technique: "T1203 - Exploitation for Client Execution" +category: Intrusion Detection +technique: '' adversary: origin references: - - https://docs.paloaltonetworks.com/threat-prevention/administration/best-practices/best-practices-for-securing-your-network-from-layer-4-and-layer-7-evasions/evasion-signatures - - https://attack.mitre.org/techniques/T1203/ -description: | - Detects potential zero-day exploits blocked by Palo Alto's threat prevention engine. This rule triggers on high-severity vulnerability attempts and unknown threat patterns that may indicate zero-day exploit attempts. The rule looks for THREAT type events with vulnerability or exploit subtypes that have high or critical severity, and either contain CVE references or are categorized as unknown threats. - - Next Steps: - 1. Investigate the source IP address and determine if it's internal or external - 2. Review the specific threat ID and vulnerability details in Palo Alto logs - 3. Check if the exploit attempt was successful or blocked - 4. Analyze network traffic patterns from the source IP for additional malicious activity - 5. Update threat prevention signatures if a new zero-day is confirmed - 6. Consider blocking the source IP if it shows persistent malicious behavior - 7. Review and strengthen endpoint security on potentially targeted systems -where: equals("log.pa_type", "THREAT") && oneOf("log.pa_subtype", ["vulnerability", "exploit"]) && oneOf("log.severityLabel", ["high", "critical"]) && (contains("log.pa_threatid", "CVE") || equals("log.category", "unknown")) -afterEvents: - - indexPattern: v11-log-firewall-paloalto-* - with: - - field: origin.ip - operator: filter_term - value: '{{.origin.ip}}' - - field: log.pa_type - operator: filter_term - value: 'THREAT' - within: 30m - count: 2 +- https://docs.paloaltonetworks.com/ngfw/administration/monitoring/use-syslog-for-monitoring/syslog-field-descriptions/threat-log-fields +description: Detects two high or critical vulnerability/exploit detections carrying a CVE label or the legacy unknown + category within thirty minutes, for the same collector, firewall, virtual system, endpoints and attack direction. + Neither a known CVE nor an unknown category establishes a zero-day. The vendor action determines whether traffic + was blocked; this sequence does not prove successful exploitation. Inspect the signature and target exposure. + The single-event spyware/vulnerability rule can also match these events. +where: equals("log.pa_type", "THREAT") && oneOf("log.pa_subtype", ["vulnerability", "exploit"]) && oneOf("log.severityLabel", + ["high", "critical"]) && (contains("log.pa_threatid", "CVE") || equals("log.category", "unknown")) && exists("target.ip") + && exists("origin.ip") && exists("dataSource") && !equals("dataSource", "") && exists("log.paScope") && exists("log.paVsys") + && equals("log.paDirection", "client-to-server") groupBy: - - adversary.ip - - target.ip +- lastEvent.dataSource +- lastEvent.log.paScope +- lastEvent.log.paVsys +- adversary.ip +- target.ip +- lastEvent.log.pa_threatid +afterEvents: +- indexPattern: v11-log-firewall-paloalto-* + with: + - field: dataSource + operator: filter_term + value: '{{.dataSource}}' + - field: log.paScope + operator: filter_term + value: '{{.log.paScope}}' + - field: log.paVsys + operator: filter_term + value: '{{.log.paVsys}}' + - field: origin.ip + operator: filter_term + value: '{{.origin.ip}}' + - field: log.correlationCandidate.paloalto.vulnerability + operator: filter_term + value: match + - field: target.ip + operator: filter_term + value: '{{.target.ip}}' + - field: log.paDirection + operator: filter_term + value: '{{.log.paDirection}}' + within: 30m + count: 2 diff --git a/rules/paloalto/pa_firewall/zero_day_exploit_prevention_server_to_client.yml b/rules/paloalto/pa_firewall/zero_day_exploit_prevention_server_to_client.yml new file mode 100644 index 000000000..0ce523b05 --- /dev/null +++ b/rules/paloalto/pa_firewall/zero_day_exploit_prevention_server_to_client.yml @@ -0,0 +1,56 @@ +# Rule version v2.0.0 + +dataTypes: +- firewall-paloalto +name: PAN-OS Repeated High-Severity Vulnerability Signatures (server-to-client) +impact: + confidentiality: 3 + integrity: 3 + availability: 3 +category: Intrusion Detection +technique: '' +adversary: target +references: +- https://docs.paloaltonetworks.com/ngfw/administration/monitoring/use-syslog-for-monitoring/syslog-field-descriptions/threat-log-fields +description: Detects two high or critical vulnerability/exploit detections carrying a CVE label or the legacy unknown + category within thirty minutes, for the same collector, firewall, virtual system, endpoints and attack direction. + Neither a known CVE nor an unknown category establishes a zero-day. The vendor action determines whether traffic + was blocked; this sequence does not prove successful exploitation. Inspect the signature and target exposure. + The single-event spyware/vulnerability rule can also match these events. +where: equals("log.pa_type", "THREAT") && oneOf("log.pa_subtype", ["vulnerability", "exploit"]) && oneOf("log.severityLabel", + ["high", "critical"]) && (contains("log.pa_threatid", "CVE") || equals("log.category", "unknown")) && exists("target.ip") + && exists("origin.ip") && exists("dataSource") && !equals("dataSource", "") && exists("log.paScope") && exists("log.paVsys") + && equals("log.paDirection", "server-to-client") +groupBy: +- lastEvent.dataSource +- lastEvent.log.paScope +- lastEvent.log.paVsys +- adversary.ip +- target.ip +- lastEvent.log.pa_threatid +afterEvents: +- indexPattern: v11-log-firewall-paloalto-* + with: + - field: dataSource + operator: filter_term + value: '{{.dataSource}}' + - field: log.paScope + operator: filter_term + value: '{{.log.paScope}}' + - field: log.paVsys + operator: filter_term + value: '{{.log.paVsys}}' + - field: origin.ip + operator: filter_term + value: '{{.origin.ip}}' + - field: log.correlationCandidate.paloalto.vulnerability + operator: filter_term + value: match + - field: target.ip + operator: filter_term + value: '{{.target.ip}}' + - field: log.paDirection + operator: filter_term + value: '{{.log.paDirection}}' + within: 30m + count: 2 From dd27214aa3bc64c901f18ea3ea70943162775e3a Mon Sep 17 00:00:00 2001 From: Ricardo Valdes Date: Thu, 24 Sep 2026 10:02:48 -0400 Subject: [PATCH 3/9] fix(paloalto): use field names the parser keeps The EventProcessor parser plugins remove every character other than letters, digits and dots from the field names they write: grok, add, rename, csv, kv and top-level json keys all pass the name through go-sdk utils.SanitizeField. Conditions, rules, placeholders, groupBy and the later filter steps look a name up exactly as written. So the filter stored log.pa_type as log.patype, and every condition or rule that tested log.pa_type, log.pa_subtype, log.pa_threatid, log.thr_category or another underscored name never matched. The type-specific outcome, address, URL and configuration handling and the brute-force marker never ran, and none of the eleven rules could fire. Rename every field name that contains an underscore to camelCase, for example log.pa_type to log.paType, log.thr_category to log.thrCategory and log.receive_time to log.receiveTime. That covers 239 names in the filter (grok, csv, add, cast, delete and condition positions), the four names the rules use in conditions and groupBy, and the same names in the test expectations. Regular expressions, values, raw samples and the CSV column order are unchanged. log.paType and log.paSubtype are the names v11 already used; the two CEF-only steps that copied the underscored type fields into them would now copy a field onto itself, so they are removed. The Palo Alto test model now cleans every written name (grok, add, rename, csv, and top-level json keys only) the way the real plugins do, so a filter that writes one name and reads another fails the tests instead of passing. Run against the previous files, 92 fixture cases now fail, as the real parser would have. Co-Authored-By: Claude Opus 5.5 --- filters/paloalto/pa_firewall.yml | 2203 ++++++++--------- plugins/alerts/paloalto_contract_test.go | 46 +- .../testdata/filter-contracts/paloalto.json | 6 +- plugins/alerts/testdata/paloalto_raw.json | 142 +- .../pa_firewall/ioc_threat_intel_match.yml | 6 +- ...oc_threat_intel_match_server_to_client.yml | 6 +- .../pa_firewall/panos_admin_brute_force.yml | 2 +- .../pa_firewall/panos_dns_security_alerts.yml | 4 +- .../panos_spyware_vulnerability.yml | 4 +- ...spyware_vulnerability_server_to_client.yml | 4 +- .../panos_url_filtering_blocks.yml | 2 +- .../wildfire_malware_detection.yml | 4 +- ...ire_malware_detection_server_to_client.yml | 4 +- .../zero_day_exploit_prevention.yml | 6 +- ...ay_exploit_prevention_server_to_client.yml | 6 +- 15 files changed, 1228 insertions(+), 1217 deletions(-) diff --git a/filters/paloalto/pa_firewall.yml b/filters/paloalto/pa_firewall.yml index 95bf7355c..22f3ff0c6 100644 --- a/filters/paloalto/pa_firewall.yml +++ b/filters/paloalto/pa_firewall.yml @@ -22,8 +22,8 @@ pipeline: - log.paPayload - log.paCefExtensions - log.paCefSignature - - log.pa_type - - log.pa_subtype + - log.paType + - log.paSubtype - grok: source: raw patterns: @@ -82,7 +82,7 @@ pipeline: pattern: (?:\\.|[^|\\])* - fieldName: log.paSep2 pattern: \| - - fieldName: log.pa_type + - fieldName: log.paType pattern: '[A-Z][A-Z0-9-]*' - fieldName: log.paSep3 pattern: \| @@ -2428,7 +2428,7 @@ pipeline: patterns: - fieldName: log.paIgnored pattern: ^(?:[A-Za-z][A-Za-z0-9_]*=(?:\\.|[^=\\])*?[ \t]+)*?cert_sizePanOSCommonNameLength= - - fieldName: log.cert_sizePanOSCommonNameLength + - fieldName: log.certSizePanOSCommonNameLength pattern: (?:\\.|[^=\\])*? - fieldName: log.paSuffix pattern: (?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) @@ -2518,7 +2518,7 @@ pipeline: patterns: - fieldName: log.paIgnored pattern: ^(?:[A-Za-z][A-Za-z0-9_]*=(?:\\.|[^=\\])*?[ \t]+)*?client_osPanOSEndpointOSVersion= - - fieldName: log.client_osPanOSEndpointOSVersion + - fieldName: log.clientOsPanOSEndpointOSVersion pattern: (?:\\.|[^=\\])*? - fieldName: log.paSuffix pattern: (?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) @@ -2668,7 +2668,7 @@ pipeline: patterns: - fieldName: log.paIgnored pattern: ^(?:[A-Za-z][A-Za-z0-9_]*=(?:\\.|[^=\\])*?[ \t]+)*?connect_methodPanOSConnectionErrorID= - - fieldName: log.connect_methodPanOSConnectionErrorID + - fieldName: log.connectMethodPanOSConnectionErrorID pattern: (?:\\.|[^=\\])*? - fieldName: log.paSuffix pattern: (?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) @@ -2878,7 +2878,7 @@ pipeline: patterns: - fieldName: log.paIgnored pattern: ^(?:[A-Za-z][A-Za-z0-9_]*=(?:\\.|[^=\\])*?[ \t]+)*?device_namePanOSActionFlags= - - fieldName: log.device_namePanOSActionFlags + - fieldName: log.deviceNamePanOSActionFlags pattern: (?:\\.|[^=\\])*? - fieldName: log.paSuffix pattern: (?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) @@ -2888,7 +2888,7 @@ pipeline: patterns: - fieldName: log.paIgnored pattern: ^(?:[A-Za-z][A-Za-z0-9_]*=(?:\\.|[^=\\])*?[ \t]+)*?dg_hier_level_1PanOSDGl2= - - fieldName: log.dg_hier_level_1PanOSDGl2 + - fieldName: log.dgHierLevel1PanOSDGl2 pattern: (?:\\.|[^=\\])*? - fieldName: log.paSuffix pattern: (?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) @@ -2898,7 +2898,7 @@ pipeline: patterns: - fieldName: log.paIgnored pattern: ^(?:[A-Za-z][A-Za-z0-9_]*=(?:\\.|[^=\\])*?[ \t]+)*?dg_hier_level_2PanOSDGl3= - - fieldName: log.dg_hier_level_2PanOSDGl3 + - fieldName: log.dgHierLevel2PanOSDGl3 pattern: (?:\\.|[^=\\])*? - fieldName: log.paSuffix pattern: (?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) @@ -2908,7 +2908,7 @@ pipeline: patterns: - fieldName: log.paIgnored pattern: ^(?:[A-Za-z][A-Za-z0-9_]*=(?:\\.|[^=\\])*?[ \t]+)*?dg_hier_level_3PanOSDGl4= - - fieldName: log.dg_hier_level_3PanOSDGl4 + - fieldName: log.dgHierLevel3PanOSDGl4 pattern: (?:\\.|[^=\\])*? - fieldName: log.paSuffix pattern: (?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) @@ -2918,7 +2918,7 @@ pipeline: patterns: - fieldName: log.paIgnored pattern: ^(?:[A-Za-z][A-Za-z0-9_]*=(?:\\.|[^=\\])*?[ \t]+)*?dg_hier_level_4PanOSVsysName= - - fieldName: log.dg_hier_level_4PanOSVsysName + - fieldName: log.dgHierLevel4PanOSVsysName pattern: (?:\\.|[^=\\])*? - fieldName: log.paSuffix pattern: (?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) @@ -2958,7 +2958,7 @@ pipeline: patterns: - fieldName: log.paIgnored pattern: ^(?:[A-Za-z][A-Za-z0-9_]*=(?:\\.|[^=\\])*?[ \t]+)*?dst_categoryPanOSDestinationDeviceProfile= - - fieldName: log.dst_categoryPanOSDestinationDeviceProfile + - fieldName: log.dstCategoryPanOSDestinationDeviceProfile pattern: (?:\\.|[^=\\])*? - fieldName: log.paSuffix pattern: (?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) @@ -2968,7 +2968,7 @@ pipeline: patterns: - fieldName: log.paIgnored pattern: ^(?:[A-Za-z][A-Za-z0-9_]*=(?:\\.|[^=\\])*?[ \t]+)*?dst_dagPanOSTimeGeneratedHighResolution= - - fieldName: log.dst_dagPanOSTimeGeneratedHighResolution + - fieldName: log.dstDagPanOSTimeGeneratedHighResolution pattern: (?:\\.|[^=\\])*? - fieldName: log.paSuffix pattern: (?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) @@ -2978,7 +2978,7 @@ pipeline: patterns: - fieldName: log.paIgnored pattern: ^(?:[A-Za-z][A-Za-z0-9_]*=(?:\\.|[^=\\])*?[ \t]+)*?dst_edlPanOSSourceDynamicAddressGroup= - - fieldName: log.dst_edlPanOSSourceDynamicAddressGroup + - fieldName: log.dstEdlPanOSSourceDynamicAddressGroup pattern: (?:\\.|[^=\\])*? - fieldName: log.paSuffix pattern: (?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) @@ -2988,7 +2988,7 @@ pipeline: patterns: - fieldName: log.paIgnored pattern: ^(?:[A-Za-z][A-Za-z0-9_]*=(?:\\.|[^=\\])*?[ \t]+)*?dst_hostPanOSDestinationDeviceMac= - - fieldName: log.dst_hostPanOSDestinationDeviceMac + - fieldName: log.dstHostPanOSDestinationDeviceMac pattern: (?:\\.|[^=\\])*? - fieldName: log.paSuffix pattern: (?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) @@ -2998,7 +2998,7 @@ pipeline: patterns: - fieldName: log.paIgnored pattern: ^(?:[A-Za-z][A-Za-z0-9_]*=(?:\\.|[^=\\])*?[ \t]+)*?dst_macPanContainerName= - - fieldName: log.dst_macPanContainerName + - fieldName: log.dstMacPanContainerName pattern: (?:\\.|[^=\\])*? - fieldName: log.paSuffix pattern: (?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) @@ -3008,7 +3008,7 @@ pipeline: patterns: - fieldName: log.paIgnored pattern: ^(?:[A-Za-z][A-Za-z0-9_]*=(?:\\.|[^=\\])*?[ \t]+)*?dst_modelPanOSDestinationDeviceVendor= - - fieldName: log.dst_modelPanOSDestinationDeviceVendor + - fieldName: log.dstModelPanOSDestinationDeviceVendor pattern: (?:\\.|[^=\\])*? - fieldName: log.paSuffix pattern: (?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) @@ -3018,7 +3018,7 @@ pipeline: patterns: - fieldName: log.paIgnored pattern: ^(?:[A-Za-z][A-Za-z0-9_]*=(?:\\.|[^=\\])*?[ \t]+)*?dst_osfamilyPanDstDeviceOSv= - - fieldName: log.dst_osfamilyPanDstDeviceOSv + - fieldName: log.dstOsfamilyPanDstDeviceOSv pattern: (?:\\.|[^=\\])*? - fieldName: log.paSuffix pattern: (?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) @@ -3028,7 +3028,7 @@ pipeline: patterns: - fieldName: log.paIgnored pattern: ^(?:[A-Za-z][A-Za-z0-9_]*=(?:\\.|[^=\\])*?[ \t]+)*?dst_osfamilyPanOSDestinationDeviceOSVersion= - - fieldName: log.dst_osfamilyPanOSDestinationDeviceOSVersion + - fieldName: log.dstOsfamilyPanOSDestinationDeviceOSVersion pattern: (?:\\.|[^=\\])*? - fieldName: log.paSuffix pattern: (?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) @@ -3038,7 +3038,7 @@ pipeline: patterns: - fieldName: log.paIgnored pattern: ^(?:[A-Za-z][A-Za-z0-9_]*=(?:\\.|[^=\\])*?[ \t]+)*?dst_profilePanDstDeviceModel= - - fieldName: log.dst_profilePanDstDeviceModel + - fieldName: log.dstProfilePanDstDeviceModel pattern: (?:\\.|[^=\\])*? - fieldName: log.paSuffix pattern: (?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) @@ -3048,7 +3048,7 @@ pipeline: patterns: - fieldName: log.paIgnored pattern: ^(?:[A-Za-z][A-Za-z0-9_]*=(?:\\.|[^=\\])*?[ \t]+)*?dst_uuidPanOSTunnelID= - - fieldName: log.dst_uuidPanOSTunnelID + - fieldName: log.dstUuidPanOSTunnelID pattern: (?:\\.|[^=\\])*? - fieldName: log.paSuffix pattern: (?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) @@ -3098,7 +3098,7 @@ pipeline: patterns: - fieldName: log.paIgnored pattern: ^(?:[A-Za-z][A-Za-z0-9_]*=(?:\\.|[^=\\])*?[ \t]+)*?err_indexPanOSRootStatus= - - fieldName: log.err_indexPanOSRootStatus + - fieldName: log.errIndexPanOSRootStatus pattern: (?:\\.|[^=\\])*? - fieldName: log.paSuffix pattern: (?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) @@ -3278,7 +3278,7 @@ pipeline: patterns: - fieldName: log.paIgnored pattern: ^(?:[A-Za-z][A-Za-z0-9_]*=(?:\\.|[^=\\])*?[ \t]+)*?http2_connectionPanDynamicUsrgrp= - - fieldName: log.http2_connectionPanDynamicUsrgrp + - fieldName: log.http2ConnectionPanDynamicUsrgrp pattern: (?:\\.|[^=\\])*? - fieldName: log.paSuffix pattern: (?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) @@ -3288,7 +3288,7 @@ pipeline: patterns: - fieldName: log.paIgnored pattern: ^(?:[A-Za-z][A-Za-z0-9_]*=(?:\\.|[^=\\])*?[ \t]+)*?http_headersPanOSRuleUUID= - - fieldName: log.http_headersPanOSRuleUUID + - fieldName: log.httpHeadersPanOSRuleUUID pattern: (?:\\.|[^=\\])*? - fieldName: log.paSuffix pattern: (?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) @@ -3298,7 +3298,7 @@ pipeline: patterns: - fieldName: log.paIgnored pattern: ^(?:[A-Za-z][A-Za-z0-9_]*=(?:\\.|[^=\\])*?[ \t]+)*?http_headersPanOSURLCatList= - - fieldName: log.http_headersPanOSURLCatList + - fieldName: log.httpHeadersPanOSURLCatList pattern: (?:\\.|[^=\\])*? - fieldName: log.paSuffix pattern: (?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) @@ -5568,7 +5568,7 @@ pipeline: patterns: - fieldName: log.paIgnored pattern: ^(?:[A-Za-z][A-Za-z0-9_]*=(?:\\.|[^=\\])*?[ \t]+)*?parent_session_idPanOSParentStartTime= - - fieldName: log.parent_session_idPanOSParentStartTime + - fieldName: log.parentSessionIdPanOSParentStartTime pattern: (?:\\.|[^=\\])*? - fieldName: log.paSuffix pattern: (?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) @@ -5578,7 +5578,7 @@ pipeline: patterns: - fieldName: log.paIgnored pattern: ^(?:[A-Za-z][A-Za-z0-9_]*=(?:\\.|[^=\\])*?[ \t]+)*?partial_hashPanTimeHighRes= - - fieldName: log.partial_hashPanTimeHighRes + - fieldName: log.partialHashPanTimeHighRes pattern: (?:\\.|[^=\\])*? - fieldName: log.paSuffix pattern: (?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) @@ -5588,7 +5588,7 @@ pipeline: patterns: - fieldName: log.paIgnored pattern: ^(?:[A-Za-z][A-Za-z0-9_]*=(?:\\.|[^=\\])*?[ \t]+)*?pcap_idfileHash= - - fieldName: log.pcap_idfileHash + - fieldName: log.pcapIdfileHash pattern: (?:\\.|[^=\\])*? - fieldName: log.paSuffix pattern: (?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) @@ -5598,7 +5598,7 @@ pipeline: patterns: - fieldName: log.paIgnored pattern: ^(?:[A-Za-z][A-Za-z0-9_]*=(?:\\.|[^=\\])*?[ \t]+)*?pcap_idrequestMethod= - - fieldName: log.pcap_idrequestMethod + - fieldName: log.pcapIdrequestMethod pattern: (?:\\.|[^=\\])*? - fieldName: log.paSuffix pattern: (?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) @@ -5608,7 +5608,7 @@ pipeline: patterns: - fieldName: log.paIgnored pattern: ^(?:[A-Za-z][A-Za-z0-9_]*=(?:\\.|[^=\\])*?[ \t]+)*?pod_namePanSrcEDL= - - fieldName: log.pod_namePanSrcEDL + - fieldName: log.podNamePanSrcEDL pattern: (?:\\.|[^=\\])*? - fieldName: log.paSuffix pattern: (?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) @@ -5618,7 +5618,7 @@ pipeline: patterns: - fieldName: log.paIgnored pattern: ^(?:[A-Za-z][A-Za-z0-9_]*=(?:\\.|[^=\\])*?[ \t]+)*?pod_namespacePanOSContainerName= - - fieldName: log.pod_namespacePanOSContainerName + - fieldName: log.podNamespacePanOSContainerName pattern: (?:\\.|[^=\\])*? - fieldName: log.paSuffix pattern: (?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) @@ -5658,7 +5658,7 @@ pipeline: patterns: - fieldName: log.paIgnored pattern: ^(?:[A-Za-z][A-Za-z0-9_]*=(?:\\.|[^=\\])*?[ \t]+)*?proxy_typePanOSCertificateSerial= - - fieldName: log.proxy_typePanOSCertificateSerial + - fieldName: log.proxyTypePanOSCertificateSerial pattern: (?:\\.|[^=\\])*? - fieldName: log.paSuffix pattern: (?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) @@ -5668,7 +5668,7 @@ pipeline: patterns: - fieldName: log.paIgnored pattern: ^(?:[A-Za-z][A-Za-z0-9_]*=(?:\\.|[^=\\])*?[ \t]+)*?public_ipPanOSPublicIPv6= - - fieldName: log.public_ipPanOSPublicIPv6 + - fieldName: log.publicIpPanOSPublicIPv6 pattern: (?:\\.|[^=\\])*? - fieldName: log.paSuffix pattern: (?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) @@ -5698,7 +5698,7 @@ pipeline: patterns: - fieldName: log.paIgnored pattern: ^(?:[A-Za-z][A-Za-z0-9_]*=(?:\\.|[^=\\])*?[ \t]+)*?receive_timePanOSDeviceSN= - - fieldName: log.receive_timePanOSDeviceSN + - fieldName: log.receiveTimePanOSDeviceSN pattern: (?:\\.|[^=\\])*? - fieldName: log.paSuffix pattern: (?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) @@ -5708,7 +5708,7 @@ pipeline: patterns: - fieldName: log.paIgnored pattern: ^(?:[A-Za-z][A-Za-z0-9_]*=(?:\\.|[^=\\])*?[ \t]+)*?receive_timedeviceExternalId= - - fieldName: log.receive_timedeviceExternalId + - fieldName: log.receiveTimedeviceExternalId pattern: (?:\\.|[^=\\])*? - fieldName: log.paSuffix pattern: (?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) @@ -5768,7 +5768,7 @@ pipeline: patterns: - fieldName: log.paIgnored pattern: ^(?:[A-Za-z][A-Za-z0-9_]*=(?:\\.|[^=\\])*?[ \t]+)*?rootcn_lenPanOSSNILength= - - fieldName: log.rootcn_lenPanOSSNILength + - fieldName: log.rootcnLenPanOSSNILength pattern: (?:\\.|[^=\\])*? - fieldName: log.paSuffix pattern: (?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) @@ -5788,7 +5788,7 @@ pipeline: patterns: - fieldName: log.paIgnored pattern: ^(?:[A-Za-z][A-Za-z0-9_]*=(?:\\.|[^=\\])*?[ \t]+)*?rule_uuidPanOSClientToFirewall= - - fieldName: log.rule_uuidPanOSClientToFirewall + - fieldName: log.ruleUuidPanOSClientToFirewall pattern: (?:\\.|[^=\\])*? - fieldName: log.paSuffix pattern: (?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) @@ -5798,7 +5798,7 @@ pipeline: patterns: - fieldName: log.paIgnored pattern: ^(?:[A-Za-z][A-Za-z0-9_]*=(?:\\.|[^=\\])*?[ \t]+)*?rule_uuidPanOSTimeGeneratedHighResolution= - - fieldName: log.rule_uuidPanOSTimeGeneratedHighResolution + - fieldName: log.ruleUuidPanOSTimeGeneratedHighResolution pattern: (?:\\.|[^=\\])*? - fieldName: log.paSuffix pattern: (?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) @@ -5818,7 +5818,7 @@ pipeline: patterns: - fieldName: log.paIgnored pattern: ^(?:[A-Za-z][A-Za-z0-9_]*=(?:\\.|[^=\\])*?[ \t]+)*?selection_typePanOSSSLResponseTime= - - fieldName: log.selection_typePanOSSSLResponseTime + - fieldName: log.selectionTypePanOSSSLResponseTime pattern: (?:\\.|[^=\\])*? - fieldName: log.paSuffix pattern: (?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) @@ -5878,7 +5878,7 @@ pipeline: patterns: - fieldName: log.paIgnored pattern: ^(?:[A-Za-z][A-Za-z0-9_]*=(?:\\.|[^=\\])*?[ \t]+)*?sni_lenPanOSErrorMessage= - - fieldName: log.sni_lenPanOSErrorMessage + - fieldName: log.sniLenPanOSErrorMessage pattern: (?:\\.|[^=\\])*? - fieldName: log.paSuffix pattern: (?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) @@ -5928,7 +5928,7 @@ pipeline: patterns: - fieldName: log.paIgnored pattern: ^(?:[A-Za-z][A-Za-z0-9_]*=(?:\\.|[^=\\])*?[ \t]+)*?src_categoryPanOSSourceDeviceProfile= - - fieldName: log.src_categoryPanOSSourceDeviceProfile + - fieldName: log.srcCategoryPanOSSourceDeviceProfile pattern: (?:\\.|[^=\\])*? - fieldName: log.paSuffix pattern: (?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) @@ -5938,7 +5938,7 @@ pipeline: patterns: - fieldName: log.paIgnored pattern: ^(?:[A-Za-z][A-Za-z0-9_]*=(?:\\.|[^=\\])*?[ \t]+)*?src_categoryPanSrcDeviceProf= - - fieldName: log.src_categoryPanSrcDeviceProf + - fieldName: log.srcCategoryPanSrcDeviceProf pattern: (?:\\.|[^=\\])*? - fieldName: log.paSuffix pattern: (?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) @@ -5948,7 +5948,7 @@ pipeline: patterns: - fieldName: log.paIgnored pattern: ^(?:[A-Za-z][A-Za-z0-9_]*=(?:\\.|[^=\\])*?[ \t]+)*?src_hostPanOSSourceDeviceMac= - - fieldName: log.src_hostPanOSSourceDeviceMac + - fieldName: log.srcHostPanOSSourceDeviceMac pattern: (?:\\.|[^=\\])*? - fieldName: log.paSuffix pattern: (?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) @@ -5958,7 +5958,7 @@ pipeline: patterns: - fieldName: log.paIgnored pattern: ^(?:[A-Za-z][A-Za-z0-9_]*=(?:\\.|[^=\\])*?[ \t]+)*?src_hostPanSrcMac= - - fieldName: log.src_hostPanSrcMac + - fieldName: log.srcHostPanSrcMac pattern: (?:\\.|[^=\\])*? - fieldName: log.paSuffix pattern: (?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) @@ -5968,7 +5968,7 @@ pipeline: patterns: - fieldName: log.paIgnored pattern: ^(?:[A-Za-z][A-Za-z0-9_]*=(?:\\.|[^=\\])*?[ \t]+)*?src_macPanOSTrafficOriginRegion= - - fieldName: log.src_macPanOSTrafficOriginRegion + - fieldName: log.srcMacPanOSTrafficOriginRegion pattern: (?:\\.|[^=\\])*? - fieldName: log.paSuffix pattern: (?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) @@ -5978,7 +5978,7 @@ pipeline: patterns: - fieldName: log.paIgnored pattern: ^(?:[A-Za-z][A-Za-z0-9_]*=(?:\\.|[^=\\])*?[ \t]+)*?src_modelPanOSSourceDeviceVendor= - - fieldName: log.src_modelPanOSSourceDeviceVendor + - fieldName: log.srcModelPanOSSourceDeviceVendor pattern: (?:\\.|[^=\\])*? - fieldName: log.paSuffix pattern: (?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) @@ -5988,7 +5988,7 @@ pipeline: patterns: - fieldName: log.paIgnored pattern: ^(?:[A-Za-z][A-Za-z0-9_]*=(?:\\.|[^=\\])*?[ \t]+)*?src_modelPanSrcDeviceVendor= - - fieldName: log.src_modelPanSrcDeviceVendor + - fieldName: log.srcModelPanSrcDeviceVendor pattern: (?:\\.|[^=\\])*? - fieldName: log.paSuffix pattern: (?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) @@ -5998,7 +5998,7 @@ pipeline: patterns: - fieldName: log.paIgnored pattern: ^(?:[A-Za-z][A-Za-z0-9_]*=(?:\\.|[^=\\])*?[ \t]+)*?src_osfamilyPanOSSourceDeviceOSVersion= - - fieldName: log.src_osfamilyPanOSSourceDeviceOSVersion + - fieldName: log.srcOsfamilyPanOSSourceDeviceOSVersion pattern: (?:\\.|[^=\\])*? - fieldName: log.paSuffix pattern: (?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) @@ -6008,7 +6008,7 @@ pipeline: patterns: - fieldName: log.paIgnored pattern: ^(?:[A-Za-z][A-Za-z0-9_]*=(?:\\.|[^=\\])*?[ \t]+)*?src_osversionPanSrcHostname= - - fieldName: log.src_osversionPanSrcHostname + - fieldName: log.srcOsversionPanSrcHostname pattern: (?:\\.|[^=\\])*? - fieldName: log.paSuffix pattern: (?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) @@ -6018,7 +6018,7 @@ pipeline: patterns: - fieldName: log.paIgnored pattern: ^(?:[A-Za-z][A-Za-z0-9_]*=(?:\\.|[^=\\])*?[ \t]+)*?src_uuidPanOSDstUUID= - - fieldName: log.src_uuidPanOSDstUUID + - fieldName: log.srcUuidPanOSDstUUID pattern: (?:\\.|[^=\\])*? - fieldName: log.paSuffix pattern: (?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) @@ -6028,7 +6028,7 @@ pipeline: patterns: - fieldName: log.paIgnored pattern: ^(?:[A-Za-z][A-Za-z0-9_]*=(?:\\.|[^=\\])*?[ \t]+)*?src_vendorPanSrcDeviceOS= - - fieldName: log.src_vendorPanSrcDeviceOS + - fieldName: log.srcVendorPanSrcDeviceOS pattern: (?:\\.|[^=\\])*? - fieldName: log.paSuffix pattern: (?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) @@ -6118,7 +6118,7 @@ pipeline: patterns: - fieldName: log.paIgnored pattern: ^(?:[A-Za-z][A-Za-z0-9_]*=(?:\\.|[^=\\])*?[ \t]+)*?tag_namePanOSEventID= - - fieldName: log.tag_namePanOSEventID + - fieldName: log.tagNamePanOSEventID pattern: (?:\\.|[^=\\])*? - fieldName: log.paSuffix pattern: (?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) @@ -6128,7 +6128,7 @@ pipeline: patterns: - fieldName: log.paIgnored pattern: ^(?:[A-Za-z][A-Za-z0-9_]*=(?:\\.|[^=\\])*?[ \t]+)*?thr_categoryPanOSContentVer= - - fieldName: log.thr_categoryPanOSContentVer + - fieldName: log.thrCategoryPanOSContentVer pattern: (?:\\.|[^=\\])*? - fieldName: log.paSuffix pattern: (?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) @@ -6138,7 +6138,7 @@ pipeline: patterns: - fieldName: log.paIgnored pattern: ^(?:[A-Za-z][A-Za-z0-9_]*=(?:\\.|[^=\\])*?[ \t]+)*?tls_authPanOSPolicyName= - - fieldName: log.tls_authPanOSPolicyName + - fieldName: log.tlsAuthPanOSPolicyName pattern: (?:\\.|[^=\\])*? - fieldName: log.paSuffix pattern: (?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) @@ -6148,7 +6148,7 @@ pipeline: patterns: - fieldName: log.paIgnored pattern: ^(?:[A-Za-z][A-Za-z0-9_]*=(?:\\.|[^=\\])*?[ \t]+)*?tls_versionPanOSTLSKeyExchange= - - fieldName: log.tls_versionPanOSTLSKeyExchange + - fieldName: log.tlsVersionPanOSTLSKeyExchange pattern: (?:\\.|[^=\\])*? - fieldName: log.paSuffix pattern: (?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) @@ -6188,7 +6188,7 @@ pipeline: patterns: - fieldName: log.paIgnored pattern: ^(?:[A-Za-z][A-Za-z0-9_]*=(?:\\.|[^=\\])*?[ \t]+)*?url_category_listPanOSHTTP2Con= - - fieldName: log.url_category_listPanOSHTTP2Con + - fieldName: log.urlCategoryListPanOSHTTP2Con pattern: (?:\\.|[^=\\])*? - fieldName: log.paSuffix pattern: (?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) @@ -6218,7 +6218,7 @@ pipeline: patterns: - fieldName: log.paIgnored pattern: ^(?:[A-Za-z][A-Za-z0-9_]*=(?:\\.|[^=\\])*?[ \t]+)*?xff_ipPanSrcDeviceCat= - - fieldName: log.xff_ipPanSrcDeviceCat + - fieldName: log.xffIpPanSrcDeviceCat pattern: (?:\\.|[^=\\])*? - fieldName: log.paSuffix pattern: (?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) @@ -6227,13 +6227,13 @@ pipeline: source: log.paPayload separator: ',' headers: - - log.future_use - - log.receive_time + - log.futureUse + - log.receiveTime - log.serial - - log.pa_type - - log.pa_subtype - - log.future_use - - log.time_generated + - log.paType + - log.paSubtype + - log.futureUse + - log.timeGenerated - log.src - log.dst - log.natsrc @@ -6245,10 +6245,10 @@ pipeline: - log.vsys - log.from - log.to - - log.inbound_if - - log.outbound_if + - log.inboundIf + - log.outboundIf - log.logset - - log.future_use + - log.futureUse - log.sessionid - log.repeatcnt - log.spt @@ -6259,116 +6259,116 @@ pipeline: - log.proto - log.act - log.bytes - - log.bytes_sent - - log.bytes_received + - log.bytesSent + - log.bytesReceived - log.packets - log.start - log.elapsed - log.category - - log.future_use + - log.futureUse - log.seqno - log.actionflags - log.srcloc - log.dstloc - - log.future_use - - log.pkts_sent - - log.pkts_received - - log.session_end_reason - - log.dg_hier_level_1 - - log.dg_hier_level_2 - - log.dg_hier_level_3 - - log.dg_hier_level_4 - - log.vsys_name - - log.device_name - - log.action_source - - log.src_uuid - - log.dst_uuid - - log.tunnelid_imsi - - log.monitortag_imei - - log.parent_session_id - - log.parent_start_time + - log.futureUse + - log.pktsSent + - log.pktsReceived + - log.sessionEndReason + - log.dgHierLevel1 + - log.dgHierLevel2 + - log.dgHierLevel3 + - log.dgHierLevel4 + - log.vsysName + - log.deviceName + - log.actionSource + - log.srcUuid + - log.dstUuid + - log.tunnelidImsi + - log.monitortagImei + - log.parentSessionId + - log.parentStartTime - log.tunnel - - log.assoc_id + - log.assocId - log.chunks - - log.chunks_sent - - log.chunks_received - - log.rule_uuid - - log.http2_connection - - log.link_change_count - - log.policy_id - - log.link_switches - - log.sdwan_cluster - - log.sdwan_device_type - - log.sdwan_cluster_type - - log.sdwan_site - - log.dynusergroup_name - - log.xff_ip - - log.src_category - - log.src_profile - - log.src_model - - log.src_vendor - - log.src_osfamily - - log.src_osversion - - log.src_host - - log.src_mac - - log.dst_category - - log.dst_profile - - log.dst_model - - log.dst_vendor - - log.dst_osfamily - - log.dst_osversion - - log.dst_host - - log.dst_mac - - log.container_id - - log.pod_namespace - - log.pod_name - - log.src_edl - - log.dst_edl + - log.chunksSent + - log.chunksReceived + - log.ruleUuid + - log.http2Connection + - log.linkChangeCount + - log.policyId + - log.linkSwitches + - log.sdwanCluster + - log.sdwanDeviceType + - log.sdwanClusterType + - log.sdwanSite + - log.dynusergroupName + - log.xffIp + - log.srcCategory + - log.srcProfile + - log.srcModel + - log.srcVendor + - log.srcOsfamily + - log.srcOsversion + - log.srcHost + - log.srcMac + - log.dstCategory + - log.dstProfile + - log.dstModel + - log.dstVendor + - log.dstOsfamily + - log.dstOsversion + - log.dstHost + - log.dstMac + - log.containerId + - log.podNamespace + - log.podName + - log.srcEdl + - log.dstEdl - log.hostid - log.serialnumber - - log.src_dag - - log.dst_dag - - log.session_owner - - log.high_res_timestamp - - log.nsdsai_sst - - log.nsdsai_sd - - log.subcategory_of_app - - log.category_of_app - - log.technology_of_app - - log.risk_of_app - - log.characteristic_of_app - - log.container_of_app - - log.tunneled_app - - log.is_saas_of_app - - log.sanctioned_state_of_app + - log.srcDag + - log.dstDag + - log.sessionOwner + - log.highResTimestamp + - log.nsdsaiSst + - log.nsdsaiSd + - log.subcategoryOfApp + - log.categoryOfApp + - log.technologyOfApp + - log.riskOfApp + - log.characteristicOfApp + - log.containerOfApp + - log.tunneledApp + - log.isSaasOfApp + - log.sanctionedStateOfApp - log.offloaded - - log.flow_type - - log.cluster_name - - log.ai_traffic - - log.ai_forward_error - - log.k8s_cluster_id - - log.tcp_rtt_c2s - - log.tcp_rtt_s2c - - log.total_n_ooseq_c2s - - log.total_n_ooseq_s2c - - log.tcp_retransit_cnt_c2s - - log.tcp_retransit_cnt_s2c - - log.tcp_zero_window_cnt_c2s - - log.tcp_zero_window_cnt_s2c - - log.src_adv_devid - - log.dst_adv_devid + - log.flowType + - log.clusterName + - log.aiTraffic + - log.aiForwardError + - log.k8sClusterId + - log.tcpRttC2s + - log.tcpRttS2c + - log.totalNOoseqC2s + - log.totalNOoseqS2c + - log.tcpRetransitCntC2s + - log.tcpRetransitCntS2c + - log.tcpZeroWindowCntC2s + - log.tcpZeroWindowCntS2c + - log.srcAdvDevid + - log.dstAdvDevid where: equals("log.paFormat", "CSV") && regexMatch("log.paPayload", "^[^,]*,[^,]*,[^,]*,TRAFFIC,") - csv: source: log.paPayload separator: ',' headers: - - log.future_use - - log.receive_time + - log.futureUse + - log.receiveTime - log.serial - - log.pa_type - - log.pa_subtype - - log.future_use - - log.time_generated + - log.paType + - log.paSubtype + - log.futureUse + - log.timeGenerated - log.src - log.dst - log.natsrc @@ -6380,10 +6380,10 @@ pipeline: - log.vsys - log.from - log.to - - log.inbound_if - - log.outbound_if + - log.inboundIf + - log.outboundIf - log.logset - - log.future_use + - log.futureUse - log.sessionid - log.repeatcnt - log.spt @@ -6394,7 +6394,7 @@ pipeline: - log.proto - log.act - log.misc - - log.pa_threatid + - log.paThreatid - log.category - log.severityLabel - log.direction @@ -6402,13 +6402,13 @@ pipeline: - log.actionflags - log.srcloc - log.dstloc - - log.future_use + - log.futureUse - log.contenttype - - log.pcap_id + - log.pcapId - log.filedigest - log.cloud - - log.url_idx - - log.user_agent + - log.urlIdx + - log.userAgent - log.filetype - log.xff - log.referer @@ -6416,88 +6416,88 @@ pipeline: - log.subject - log.recipient - log.reportid - - log.dg_hier_level_1 - - log.dg_hier_level_2 - - log.dg_hier_level_3 - - log.dg_hier_level_4 - - log.vsys_name - - log.device_name - - log.future_use - - log.src_uuid - - log.dst_uuid - - log.http_method - - log.tunnelid_imsi - - log.monitortag_imei - - log.parent_session_id - - log.parent_start_time + - log.dgHierLevel1 + - log.dgHierLevel2 + - log.dgHierLevel3 + - log.dgHierLevel4 + - log.vsysName + - log.deviceName + - log.futureUse + - log.srcUuid + - log.dstUuid + - log.httpMethod + - log.tunnelidImsi + - log.monitortagImei + - log.parentSessionId + - log.parentStartTime - log.tunnel - - log.thr_category + - log.thrCategory - log.contentver - - log.future_use - - log.assoc_id + - log.futureUse + - log.assocId - log.ppid - - log.http_headers - - log.url_category_list - - log.rule_uuid - - log.http2_connection - - log.dynusergroup_name - - log.xff_ip - - log.src_category - - log.src_profile - - log.src_model - - log.src_vendor - - log.src_osfamily - - log.src_osversion - - log.src_host - - log.src_mac - - log.dst_category - - log.dst_profile - - log.dst_model - - log.dst_vendor - - log.dst_osfamily - - log.dst_osversion - - log.dst_host - - log.dst_mac - - log.container_id - - log.pod_namespace - - log.pod_name - - log.src_edl - - log.dst_edl + - log.httpHeaders + - log.urlCategoryList + - log.ruleUuid + - log.http2Connection + - log.dynusergroupName + - log.xffIp + - log.srcCategory + - log.srcProfile + - log.srcModel + - log.srcVendor + - log.srcOsfamily + - log.srcOsversion + - log.srcHost + - log.srcMac + - log.dstCategory + - log.dstProfile + - log.dstModel + - log.dstVendor + - log.dstOsfamily + - log.dstOsversion + - log.dstHost + - log.dstMac + - log.containerId + - log.podNamespace + - log.podName + - log.srcEdl + - log.dstEdl - log.hostid - log.serialnumber - - log.domain_edl - - log.src_dag - - log.dst_dag - - log.partial_hash - - log.high_res_timestamp + - log.domainEdl + - log.srcDag + - log.dstDag + - log.partialHash + - log.highResTimestamp - log.reason - log.justification - - log.nssai_sst - - log.subcategory_of_app - - log.category_of_app - - log.technology_of_app - - log.risk_of_app - - log.characteristic_of_app - - log.container_of_app - - log.tunneled_app - - log.is_saas_of_app - - log.sanctioned_state_of_app - - log.cloud_reportid - - log.flow_type - - log.cluster_name + - log.nssaiSst + - log.subcategoryOfApp + - log.categoryOfApp + - log.technologyOfApp + - log.riskOfApp + - log.characteristicOfApp + - log.containerOfApp + - log.tunneledApp + - log.isSaasOfApp + - log.sanctionedStateOfApp + - log.cloudReportid + - log.flowType + - log.clusterName where: equals("log.paFormat", "CSV") && regexMatch("log.paPayload", "^[^,]*,[^,]*,[^,]*,THREAT,") && !regexMatch("log.paPayload", "^[^,]*,[^,]*,[^,]*,THREAT,(?:url|data|dlp|dlp-non-file|file),") - csv: source: log.paPayload separator: ',' headers: - - log.future_use - - log.receive_time + - log.futureUse + - log.receiveTime - log.serial - - log.pa_type - - log.pa_subtype - - log.future_use - - log.time_generated + - log.paType + - log.paSubtype + - log.futureUse + - log.timeGenerated - log.src - log.dst - log.natsrc @@ -6509,10 +6509,10 @@ pipeline: - log.vsys - log.from - log.to - - log.inbound_if - - log.outbound_if + - log.inboundIf + - log.outboundIf - log.logset - - log.future_use + - log.futureUse - log.sessionid - log.repeatcnt - log.spt @@ -6523,7 +6523,7 @@ pipeline: - log.proto - log.act - log.misc - - log.pa_threatid + - log.paThreatid - log.category - log.severityLabel - log.direction @@ -6531,13 +6531,13 @@ pipeline: - log.actionflags - log.srcloc - log.dstloc - - log.future_use + - log.futureUse - log.contenttype - - log.pcap_id + - log.pcapId - log.filedigest - log.cloud - - log.url_idx - - log.user_agent + - log.urlIdx + - log.userAgent - log.filetype - log.xff - log.referer @@ -6545,87 +6545,87 @@ pipeline: - log.subject - log.recipient - log.reportid - - log.dg_hier_level_1 - - log.dg_hier_level_2 - - log.dg_hier_level_3 - - log.dg_hier_level_4 - - log.vsys_name - - log.device_name - - log.future_use - - log.src_uuid - - log.dst_uuid - - log.http_method - - log.tunnelid_imsi - - log.monitortag_imei - - log.parent_session_id - - log.parent_start_time + - log.dgHierLevel1 + - log.dgHierLevel2 + - log.dgHierLevel3 + - log.dgHierLevel4 + - log.vsysName + - log.deviceName + - log.futureUse + - log.srcUuid + - log.dstUuid + - log.httpMethod + - log.tunnelidImsi + - log.monitortagImei + - log.parentSessionId + - log.parentStartTime - log.tunnel - - log.thr_category + - log.thrCategory - log.contentver - - log.future_use - - log.assoc_id + - log.futureUse + - log.assocId - log.ppid - - log.http_headers - - log.url_category_list - - log.rule_uuid - - log.http2_connection - - log.dynusergroup_name - - log.xff_ip - - log.src_category - - log.src_profile - - log.src_model - - log.src_vendor - - log.src_osfamily - - log.src_osversion - - log.src_host - - log.src_mac - - log.dst_category - - log.dst_profile - - log.dst_model - - log.dst_vendor - - log.dst_osfamily - - log.dst_osversion - - log.dst_host - - log.dst_mac - - log.container_id - - log.pod_namespace - - log.pod_name - - log.src_edl - - log.dst_edl + - log.httpHeaders + - log.urlCategoryList + - log.ruleUuid + - log.http2Connection + - log.dynusergroupName + - log.xffIp + - log.srcCategory + - log.srcProfile + - log.srcModel + - log.srcVendor + - log.srcOsfamily + - log.srcOsversion + - log.srcHost + - log.srcMac + - log.dstCategory + - log.dstProfile + - log.dstModel + - log.dstVendor + - log.dstOsfamily + - log.dstOsversion + - log.dstHost + - log.dstMac + - log.containerId + - log.podNamespace + - log.podName + - log.srcEdl + - log.dstEdl - log.hostid - log.serialnumber - - log.domain_edl - - log.src_dag - - log.dst_dag - - log.partial_hash - - log.high_res_timestamp + - log.domainEdl + - log.srcDag + - log.dstDag + - log.partialHash + - log.highResTimestamp - log.reason - log.justification - - log.nssai_sst - - log.subcategory_of_app - - log.category_of_app - - log.technology_of_app - - log.risk_of_app - - log.characteristic_of_app - - log.container_of_app - - log.tunneled_app - - log.is_saas_of_app - - log.sanctioned_state_of_app - - log.cloud_reportid - - log.cluster_name - - log.flow_type + - log.nssaiSst + - log.subcategoryOfApp + - log.categoryOfApp + - log.technologyOfApp + - log.riskOfApp + - log.characteristicOfApp + - log.containerOfApp + - log.tunneledApp + - log.isSaasOfApp + - log.sanctionedStateOfApp + - log.cloudReportid + - log.clusterName + - log.flowType where: equals("log.paFormat", "CSV") && regexMatch("log.paPayload", "^[^,]*,[^,]*,[^,]*,THREAT,(?:data|dlp|dlp-non-file|file),") - csv: source: log.paPayload separator: ',' headers: - - log.future_use - - log.receive_time + - log.futureUse + - log.receiveTime - log.serial - - log.pa_type - - log.pa_subtype - - log.future_use - - log.time_generated + - log.paType + - log.paSubtype + - log.futureUse + - log.timeGenerated - log.src - log.dst - log.natsrc @@ -6637,10 +6637,10 @@ pipeline: - log.vsys - log.from - log.to - - log.inbound_if - - log.outbound_if + - log.inboundIf + - log.outboundIf - log.logset - - log.future_use + - log.futureUse - log.sessionid - log.repeatcnt - log.spt @@ -6651,7 +6651,7 @@ pipeline: - log.proto - log.act - log.misc - - log.pa_threatid + - log.paThreatid - log.category - log.severityLabel - log.direction @@ -6659,13 +6659,13 @@ pipeline: - log.actionflags - log.srcloc - log.dstloc - - log.future_use + - log.futureUse - log.contenttype - - log.pcap_id + - log.pcapId - log.filedigest - log.cloud - - log.url_idx - - log.user_agent + - log.urlIdx + - log.userAgent - log.filetype - log.xff - log.referer @@ -6673,27 +6673,27 @@ pipeline: - log.subject - log.recipient - log.reportid - - log.dg_hier_level_1 - - log.dg_hier_level_2 - - log.dg_hier_level_3 - - log.dg_hier_level_4 - - log.vsys_name - - log.device_name - - log.future_use - - log.src_uuid - - log.dst_uuid - - log.http_method - - log.tunnelid_imsi - - log.monitortag_imei - - log.parent_session_id - - log.parent_start_time + - log.dgHierLevel1 + - log.dgHierLevel2 + - log.dgHierLevel3 + - log.dgHierLevel4 + - log.vsysName + - log.deviceName + - log.futureUse + - log.srcUuid + - log.dstUuid + - log.httpMethod + - log.tunnelidImsi + - log.monitortagImei + - log.parentSessionId + - log.parentStartTime - log.tunnel - - log.thr_category + - log.thrCategory - log.contentver - - log.future_use - - log.assoc_id + - log.futureUse + - log.assocId - log.ppid - - log.http_headers + - log.httpHeaders - log.paURLTail0 - log.paURLTail1 - log.paURLTail2 @@ -6749,13 +6749,13 @@ pipeline: source: log.paPayload separator: ',' headers: - - log.future_use - - log.receive_time + - log.futureUse + - log.receiveTime - log.serial - - log.pa_type - - log.pa_subtype - - log.future_use - - log.time_generated + - log.paType + - log.paSubtype + - log.futureUse + - log.timeGenerated - log.srcuser - log.vsys - log.machinename @@ -6764,52 +6764,52 @@ pipeline: - log.matchname - log.repeatcnt - log.matchtype - - log.future_use - - log.future_use + - log.futureUse + - log.futureUse - log.seqno - log.actionflags - - log.dg_hier_level_1 - - log.dg_hier_level_2 - - log.dg_hier_level_3 - - log.dg_hier_level_4 - - log.vsys_name - - log.device_name - - log.vsys_id + - log.dgHierLevel1 + - log.dgHierLevel2 + - log.dgHierLevel3 + - log.dgHierLevel4 + - log.vsysName + - log.deviceName + - log.vsysId - log.srcipv6 - log.hostid - log.serialnumber - log.mac - - log.high_res_timestamp - - log.cluster_name + - log.highResTimestamp + - log.clusterName where: equals("log.paFormat", "CSV") && regexMatch("log.paPayload", "^[^,]*,[^,]*,[^,]*,HIP-MATCH,") - csv: source: log.paPayload separator: ',' headers: - - log.future_use - - log.receive_time + - log.futureUse + - log.receiveTime - log.serial - - log.pa_type - - log.pa_subtype - - log.future_use - - log.time_generated + - log.paType + - log.paSubtype + - log.futureUse + - log.timeGenerated - log.vsys - log.eventid - log.stage - - log.auth_method - - log.tunnel_type + - log.authMethod + - log.tunnelType - log.srcuser - log.srcregion - log.machinename - - log.public_ip - - log.public_ipv6 - - log.private_ip - - log.private_ipv6 + - log.publicIp + - log.publicIpv6 + - log.privateIp + - log.privateIpv6 - log.hostid - log.serialnumber - - log.client_ver - - log.client_os - - log.client_os_ver + - log.clientVer + - log.clientOs + - log.clientOsVer - log.repeatcnt - log.reason - log.error @@ -6817,69 +6817,69 @@ pipeline: - log.status - log.location - log.PanOSLoginDuration - - log.connect_method - - log.error_code + - log.connectMethod + - log.errorCode - log.portal - log.seqno - log.actionflags - - log.high_res_timestamp - - log.selection_type - - log.response_time + - log.highResTimestamp + - log.selectionType + - log.responseTime - log.priority - - log.attempted_gateways + - log.attemptedGateways - log.gateway - - log.dg_hier_level_1 - - log.dg_hier_level_2 - - log.dg_hier_level_3 - - log.dg_hier_level_4 - - log.vsys_name - - log.device_name - - log.vsys_id - - log.cluster_name + - log.dgHierLevel1 + - log.dgHierLevel2 + - log.dgHierLevel3 + - log.dgHierLevel4 + - log.vsysName + - log.deviceName + - log.vsysId + - log.clusterName where: equals("log.paFormat", "CSV") && regexMatch("log.paPayload", "^[^,]*,[^,]*,[^,]*,GLOBALPROTECT,") - csv: source: log.paPayload separator: ',' headers: - - log.future_use - - log.receive_time + - log.futureUse + - log.receiveTime - log.serial - - log.pa_type - - log.pa_subtype - - log.future_use - - log.time_generated + - log.paType + - log.paSubtype + - log.futureUse + - log.timeGenerated - log.vsys - log.src - - log.tag_name + - log.tagName - log.eventid - log.repeatcnt - log.timeout - log.datasourcename - - log.datasource_type - - log.datasource_subtype + - log.datasourceType + - log.datasourceSubtype - log.seqno - log.actionflags - - log.dg_hier_level_1 - - log.dg_hier_level_2 - - log.dg_hier_level_3 - - log.dg_hier_level_4 - - log.vsys_name - - log.device_name - - log.vsys_id - - log.high_res_timestamp - - log.cluster_name + - log.dgHierLevel1 + - log.dgHierLevel2 + - log.dgHierLevel3 + - log.dgHierLevel4 + - log.vsysName + - log.deviceName + - log.vsysId + - log.highResTimestamp + - log.clusterName where: equals("log.paFormat", "CSV") && regexMatch("log.paPayload", "^[^,]*,[^,]*,[^,]*,IPTAG,") - csv: source: log.paPayload separator: ',' headers: - - log.future_use - - log.receive_time + - log.futureUse + - log.receiveTime - log.serial - - log.pa_type - - log.pa_subtype - - log.future_use - - log.time_generated + - log.paType + - log.paSubtype + - log.futureUse + - log.timeGenerated - log.vsys - log.src - log.user @@ -6890,38 +6890,38 @@ pipeline: - log.beginport - log.endport - log.datasource - - log.datasource_type + - log.datasourceType - log.seqno - log.actionflags - - log.dg_hier_level_1 - - log.dg_hier_level_2 - - log.dg_hier_level_3 - - log.dg_hier_level_4 - - log.vsys_name - - log.device_name - - log.vsys_id + - log.dgHierLevel1 + - log.dgHierLevel2 + - log.dgHierLevel3 + - log.dgHierLevel4 + - log.vsysName + - log.deviceName + - log.vsysId - log.factortype - log.factorcompletiontime - log.factorno - log.ugflags - log.userbysource - - log.tag_name - - log.high_res_timestamp - - log.origin_data_source - - log.future_use - - log.cluster_name + - log.tagName + - log.highResTimestamp + - log.originDataSource + - log.futureUse + - log.clusterName where: equals("log.paFormat", "CSV") && regexMatch("log.paPayload", "^[^,]*,[^,]*,[^,]*,USERID,") - csv: source: log.paPayload separator: ',' headers: - - log.future_use - - log.receive_time + - log.futureUse + - log.receiveTime - log.serial - - log.pa_type - - log.pa_subtype - - log.config_ver - - log.time_generated + - log.paType + - log.paSubtype + - log.configVer + - log.timeGenerated - log.src - log.dst - log.natsrc @@ -6933,10 +6933,10 @@ pipeline: - log.vsys - log.from - log.to - - log.inbound_if - - log.outbound_if + - log.inboundIf + - log.outboundIf - log.logset - - log.time_received + - log.timeReceived - log.sessionid - log.repeatcnt - log.spt @@ -6947,93 +6947,93 @@ pipeline: - log.proto - log.act - log.tunnel - - log.future_use - - log.future_use - - log.src_uuid - - log.dst_uuid - - log.rule_uuid - - log.hs_stage_c2f - - log.hs_stage_f2s - - log.tls_version - - log.tls_keyxchg - - log.tls_enc - - log.tls_auth - - log.policy_name - - log.ec_curve - - log.err_index - - log.root_status - - log.chain_status - - log.proxy_type - - log.cert_serial + - log.futureUse + - log.futureUse + - log.srcUuid + - log.dstUuid + - log.ruleUuid + - log.hsStageC2f + - log.hsStageF2s + - log.tlsVersion + - log.tlsKeyxchg + - log.tlsEnc + - log.tlsAuth + - log.policyName + - log.ecCurve + - log.errIndex + - log.rootStatus + - log.chainStatus + - log.proxyType + - log.certSerial - log.fingerprint - log.notbefore - log.notafter - - log.cert_ver - - log.cert_size - - log.cn_len - - log.issuer_len - - log.rootcn_len - - log.sni_len - - log.cert_flags + - log.certVer + - log.certSize + - log.cnLen + - log.issuerLen + - log.rootcnLen + - log.sniLen + - log.certFlags - log.cn - - log.issuer_cn - - log.root_cn + - log.issuerCn + - log.rootCn - log.sni - log.error - - log.container_id - - log.pod_namespace - - log.pod_name - - log.src_edl - - log.dst_edl - - log.src_dag - - log.dst_dag - - log.high_res_timestamp - - log.src_category - - log.src_profile - - log.src_model - - log.src_vendor - - log.src_osfamily - - log.src_osversion - - log.src_host - - log.src_mac - - log.dst_category - - log.dst_profile - - log.dst_model - - log.dst_vendor - - log.dst_osfamily - - log.dst_osversion - - log.dst_host - - log.dst_mac + - log.containerId + - log.podNamespace + - log.podName + - log.srcEdl + - log.dstEdl + - log.srcDag + - log.dstDag + - log.highResTimestamp + - log.srcCategory + - log.srcProfile + - log.srcModel + - log.srcVendor + - log.srcOsfamily + - log.srcOsversion + - log.srcHost + - log.srcMac + - log.dstCategory + - log.dstProfile + - log.dstModel + - log.dstVendor + - log.dstOsfamily + - log.dstOsversion + - log.dstHost + - log.dstMac - log.seqno - log.actionflags - - log.dg_hier_level_1 - - log.dg_hier_level_2 - - log.dg_hier_level_3 - - log.dg_hier_level_4 - - log.vsys_name - - log.device_name - - log.vsys_id - - log.subcategory_of_app - - log.category_of_app - - log.technology_of_app - - log.risk_of_app - - log.characteristic_of_app - - log.container_of_app - - log.is_saas_of_app - - log.sanctioned_state_of_app - - log.cluster_name + - log.dgHierLevel1 + - log.dgHierLevel2 + - log.dgHierLevel3 + - log.dgHierLevel4 + - log.vsysName + - log.deviceName + - log.vsysId + - log.subcategoryOfApp + - log.categoryOfApp + - log.technologyOfApp + - log.riskOfApp + - log.characteristicOfApp + - log.containerOfApp + - log.isSaasOfApp + - log.sanctionedStateOfApp + - log.clusterName where: equals("log.paFormat", "CSV") && regexMatch("log.paPayload", "^[^,]*,[^,]*,[^,]*,DECRYPTION,") - csv: source: log.paPayload separator: ',' headers: - - log.future_use - - log.receive_time + - log.futureUse + - log.receiveTime - log.serial - - log.pa_type - - log.pa_subtype - - log.future_use - - log.time_generated + - log.paType + - log.paSubtype + - log.futureUse + - log.timeGenerated - log.src - log.dst - log.natsrc @@ -7045,10 +7045,10 @@ pipeline: - log.vsys - log.from - log.to - - log.inbound_if - - log.outbound_if + - log.inboundIf + - log.outboundIf - log.logset - - log.future_use + - log.futureUse - log.sessionid - log.repeatcnt - log.spt @@ -7063,136 +7063,136 @@ pipeline: - log.actionflags - log.srcloc - log.dstloc - - log.dg_hier_level_1 - - log.dg_hier_level_2 - - log.dg_hier_level_3 - - log.dg_hier_level_4 - - log.vsys_name - - log.device_name + - log.dgHierLevel1 + - log.dgHierLevel2 + - log.dgHierLevel3 + - log.dgHierLevel4 + - log.vsysName + - log.deviceName - log.tunnelid - log.monitortag - - log.parent_session_id - - log.parent_start_time + - log.parentSessionId + - log.parentStartTime - log.tunnel - log.bytes - - log.bytes_sent - - log.bytes_received + - log.bytesSent + - log.bytesReceived - log.packets - - log.pkts_sent - - log.pkts_received - - log.max_encap - - log.unknown_proto - - log.strict_check - - log.tunnel_fragment - - log.sessions_created - - log.sessions_closed - - log.session_end_reason - - log.action_source + - log.pktsSent + - log.pktsReceived + - log.maxEncap + - log.unknownProto + - log.strictCheck + - log.tunnelFragment + - log.sessionsCreated + - log.sessionsClosed + - log.sessionEndReason + - log.actionSource - log.start - log.elapsed - - log.tunnel_insp_rule - - log.remote_user_ip - - log.remote_user_id - - log.rule_uuid - - log.pcap_id - - log.dynusergroup_name - - log.src_edl - - log.dst_edl - - log.high_res_timestamp - - log.nssai_sd - - log.nssai_sst - - log.pdu_session_id - - log.subcategory_of_app - - log.category_of_app - - log.technology_of_app - - log.risk_of_app - - log.characteristic_of_app - - log.container_of_app - - log.is_saas_of_app - - log.sanctioned_state_of_app - - log.cluster_name + - log.tunnelInspRule + - log.remoteUserIp + - log.remoteUserId + - log.ruleUuid + - log.pcapId + - log.dynusergroupName + - log.srcEdl + - log.dstEdl + - log.highResTimestamp + - log.nssaiSd + - log.nssaiSst + - log.pduSessionId + - log.subcategoryOfApp + - log.categoryOfApp + - log.technologyOfApp + - log.riskOfApp + - log.characteristicOfApp + - log.containerOfApp + - log.isSaasOfApp + - log.sanctionedStateOfApp + - log.clusterName where: equals("log.paFormat", "CSV") && regexMatch("log.paPayload", "^[^,]*,[^,]*,[^,]*,(?:TUNNEL|START|END),") - csv: source: log.paPayload separator: ',' headers: - - log.future_use - - log.receive_time + - log.futureUse + - log.receiveTime - log.serial - - log.pa_type - - log.future_use - - log.future_use - - log.time_generated + - log.paType + - log.futureUse + - log.futureUse + - log.timeGenerated - log.src - log.dst - - log.future_use - - log.future_use + - log.futureUse + - log.futureUse - log.rule - - log.future_use - - log.future_use - - log.future_use + - log.futureUse + - log.futureUse + - log.futureUse - log.vsys - log.from - log.to - - log.inbound_if - - log.outbound_if + - log.inboundIf + - log.outboundIf - log.logset - - log.future_use + - log.futureUse - log.sessionid - log.repeatcnt - log.spt - log.dpt - - log.future_use - - log.future_use - - log.future_use - - log.future_use + - log.futureUse + - log.futureUse + - log.futureUse + - log.futureUse - log.proto - log.act - - log.dg_hier_level_1 - - log.dg_hier_level_2 - - log.dg_hier_level_3 - - log.dg_hier_level_4 - - log.vsys_name - - log.device_name + - log.dgHierLevel1 + - log.dgHierLevel2 + - log.dgHierLevel3 + - log.dgHierLevel4 + - log.vsysName + - log.deviceName - log.seqno - - log.future_use - - log.assoc_id + - log.futureUse + - log.assocId - log.ppid - log.severityLabel - - log.sctp_chunk_type - - log.future_use - - log.verif_tag_1 - - log.verif_tag_2 - - log.sctp_cause_code - - log.diam_app_id - - log.diam_cmd_code - - log.diam_avp_code - - log.stream_id - - log.assoc_end_reason - - log.op_code - - log.sccp_calling_ssn - - log.sccp_calling_gt - - log.sctp_filter + - log.sctpChunkType + - log.futureUse + - log.verifTag1 + - log.verifTag2 + - log.sctpCauseCode + - log.diamAppId + - log.diamCmdCode + - log.diamAvpCode + - log.streamId + - log.assocEndReason + - log.opCode + - log.sccpCallingSsn + - log.sccpCallingGt + - log.sctpFilter - log.chunks - - log.chunks_sent - - log.chunks_received + - log.chunksSent + - log.chunksReceived - log.packets - - log.pkts_sent - - log.pkts_received - - log.rule_uuid - - log.high_res_timestamp + - log.pktsSent + - log.pktsReceived + - log.ruleUuid + - log.highResTimestamp where: equals("log.paFormat", "CSV") && regexMatch("log.paPayload", "^[^,]*,[^,]*,[^,]*,SCTP,") - csv: source: log.paPayload separator: ',' headers: - - log.future_use - - log.receive_time + - log.futureUse + - log.receiveTime - log.serial - - log.pa_type - - log.pa_subtype - - log.future_use - - log.time_generated + - log.paType + - log.paSubtype + - log.futureUse + - log.timeGenerated - log.host - log.vsys - log.cmd @@ -7219,17 +7219,17 @@ pipeline: source: log.paPayload separator: ',' headers: - - log.future_use - - log.receive_time + - log.futureUse + - log.receiveTime - log.serial - - log.pa_type - - log.pa_subtype - - log.future_use - - log.time_generated + - log.paType + - log.paSubtype + - log.futureUse + - log.timeGenerated - log.vsys - log.src - log.user - - log.normalize_user + - log.normalizeUser - log.object - log.authpolicy - log.repeatcnt @@ -7243,198 +7243,198 @@ pipeline: - log.factorno - log.seqno - log.actionflags - - log.dg_hier_level_1 - - log.dg_hier_level_2 - - log.dg_hier_level_3 - - log.dg_hier_level_4 - - log.vsys_name - - log.device_name - - log.vsys_id + - log.dgHierLevel1 + - log.dgHierLevel2 + - log.dgHierLevel3 + - log.dgHierLevel4 + - log.vsysName + - log.deviceName + - log.vsysId - log.authproto - - log.rule_uuid - - log.high_res_timestamp - - log.src_category - - log.src_profile - - log.src_model - - log.src_vendor - - log.src_osfamily - - log.src_osversion - - log.src_host - - log.src_mac + - log.ruleUuid + - log.highResTimestamp + - log.srcCategory + - log.srcProfile + - log.srcModel + - log.srcVendor + - log.srcOsfamily + - log.srcOsversion + - log.srcHost + - log.srcMac - log.region - - log.future_use - - log.user_agent + - log.futureUse + - log.userAgent - log.sessionid - - log.cluster_name + - log.clusterName where: equals("log.paFormat", "CSV") && regexMatch("log.paPayload", "^[^,]*,[^,]*,[^,]*,AUTHENTICATION,") - csv: source: log.paPayload separator: ',' headers: - - log.future_use - - log.receive_time + - log.futureUse + - log.receiveTime - log.serial - - log.pa_type - - log.pa_subtype - - log.future_use - - log.time_generated + - log.paType + - log.paSubtype + - log.futureUse + - log.timeGenerated - log.vsys - log.eventid - log.object - - log.future_use - - log.future_use + - log.futureUse + - log.futureUse - log.module - log.severityLabel - log.opaque - log.seqno - log.actionflags - - log.dg_hier_level_1 - - log.dg_hier_level_2 - - log.dg_hier_level_3 - - log.dg_hier_level_4 - - log.vsys_name - - log.device_name - - log.future_use - - log.future_use - - log.high_res_timestamp + - log.dgHierLevel1 + - log.dgHierLevel2 + - log.dgHierLevel3 + - log.dgHierLevel4 + - log.vsysName + - log.deviceName + - log.futureUse + - log.futureUse + - log.highResTimestamp where: equals("log.paFormat", "CSV") && regexMatch("log.paPayload", "^[^,]*,[^,]*,[^,]*,SYSTEM,") - csv: source: log.paPayload separator: ',' headers: - - log.future_use - - log.receive_time + - log.futureUse + - log.receiveTime - log.serial - - log.pa_type - - log.pa_subtype - - log.future_use - - log.time_generated + - log.paType + - log.paSubtype + - log.futureUse + - log.timeGenerated - log.src - log.srcuser - log.vsys - log.category - log.severityLabel - - log.dg_hier_level_1 - - log.dg_hier_level_2 - - log.dg_hier_level_3 - - log.dg_hier_level_4 - - log.vsys_name - - log.device_name - - log.vsys_id + - log.dgHierLevel1 + - log.dgHierLevel2 + - log.dgHierLevel3 + - log.dgHierLevel4 + - log.vsysName + - log.deviceName + - log.vsysId - log.objectname - - log.object_id + - log.objectId - log.evidence where: equals("log.paFormat", "CSV") && regexMatch("log.paPayload", "^[^,]*,[^,]*,[^,]*,CORRELATION,") - csv: source: log.paPayload separator: ',' headers: - - log.future_use - - log.receive_time + - log.futureUse + - log.receiveTime - log.serial - - log.pa_type - - log.pa_subtype - - log.future_use - - log.time_generated + - log.paType + - log.paSubtype + - log.futureUse + - log.timeGenerated - log.src - log.dst - - log.future_use - - log.future_use + - log.futureUse + - log.futureUse - log.rule - - log.future_use - - log.future_use + - log.futureUse + - log.futureUse - log.app - log.vsys - log.from - log.to - - log.inbound_if - - log.outbound_if + - log.inboundIf + - log.outboundIf - log.logset - - log.future_use + - log.futureUse - log.sessionid - - log.future_use + - log.futureUse - log.spt - log.dpt - - log.future_use - - log.future_use - - log.future_use + - log.futureUse + - log.futureUse + - log.futureUse - log.proto - log.act - - log.event_type + - log.eventType - log.msisdn - log.apn - log.rat - - log.msg_type - - log.end_ip_adr + - log.msgType + - log.endIpAdr - log.teid1 - log.teid2 - - log.gtp_interface - - log.cause_code + - log.gtpInterface + - log.causeCode - log.severityLabel - log.mcc - log.mnc - - log.area_code - - log.cell_id - - log.event_code - - log.future_use - - log.future_use + - log.areaCode + - log.cellId + - log.eventCode + - log.futureUse + - log.futureUse - log.srcloc - log.dstloc - - log.future_use - - log.future_use - - log.future_use - - log.future_use - - log.future_use - - log.future_use - - log.future_use + - log.futureUse + - log.futureUse + - log.futureUse + - log.futureUse + - log.futureUse + - log.futureUse + - log.futureUse - log.imsi - log.imei - - log.future_use - - log.future_use - - log.future_use - - log.future_use - - log.future_use - - log.future_use - - log.future_use - - log.future_use - - log.future_use - - log.future_use - - log.future_use - - log.future_use - - log.future_use - - log.future_use - - log.future_use - - log.future_use + - log.futureUse + - log.futureUse + - log.futureUse + - log.futureUse + - log.futureUse + - log.futureUse + - log.futureUse + - log.futureUse + - log.futureUse + - log.futureUse + - log.futureUse + - log.futureUse + - log.futureUse + - log.futureUse + - log.futureUse + - log.futureUse - log.start - log.elapsed - - log.tunnel_insp_rule - - log.remote_user_ip - - log.remote_user_id - - log.rule_uuid - - log.pcap_id - - log.high_res_timestamp - - log.nssai_sst - - log.nssai_sd - - log.subcategory_of_app - - log.category_of_app - - log.technology_of_app - - log.risk_of_app - - log.characteristic_of_app - - log.container_of_app - - log.saas_of_app - - log.sanctioned_state_of_app + - log.tunnelInspRule + - log.remoteUserIp + - log.remoteUserId + - log.ruleUuid + - log.pcapId + - log.highResTimestamp + - log.nssaiSst + - log.nssaiSd + - log.subcategoryOfApp + - log.categoryOfApp + - log.technologyOfApp + - log.riskOfApp + - log.characteristicOfApp + - log.containerOfApp + - log.saasOfApp + - log.sanctionedStateOfApp where: equals("log.paFormat", "CSV") && regexMatch("log.paPayload", "^[^,]*,[^,]*,[^,]*,GTP,") - csv: source: log.paPayload separator: ',' headers: - - log.future_use - - log.receive_time + - log.futureUse + - log.receiveTime - log.serial - - log.pa_type - - log.pa_subtype - - log.future_use - - log.time_generated + - log.paType + - log.paSubtype + - log.futureUse + - log.timeGenerated - log.src - log.dst - log.natsrc @@ -7446,10 +7446,10 @@ pipeline: - log.vsys - log.from - log.to - - log.inbound_if - - log.outbound_if + - log.inboundIf + - log.outboundIf - log.logset - - log.future_use + - log.futureUse - log.sessionid - log.repeatcnt - log.spt @@ -7460,7 +7460,7 @@ pipeline: - log.proto - log.act - log.misc - - log.pa_threatid + - log.paThreatid - log.category - log.severityLabel - log.direction @@ -7468,13 +7468,13 @@ pipeline: - log.actionflags - log.srcloc - log.dstloc - - log.future_use + - log.futureUse - log.contenttype - - log.pcap_id + - log.pcapId - log.filedigest - log.cloud - - log.url_idx - - log.user_agent + - log.urlIdx + - log.userAgent - log.filetype - log.xff - log.referer @@ -7482,90 +7482,90 @@ pipeline: - log.subject - log.recipient - log.reportid - - log.dg_hier_level_1 - - log.dg_hier_level_2 - - log.dg_hier_level_3 - - log.dg_hier_level_4 - - log.vsys_name - - log.device_name - - log.future_use - - log.src_uuid - - log.dst_uuid - - log.http_method - - log.tunnelid_imsi - - log.monitortag_imei - - log.parent_session_id - - log.parent_start_time + - log.dgHierLevel1 + - log.dgHierLevel2 + - log.dgHierLevel3 + - log.dgHierLevel4 + - log.vsysName + - log.deviceName + - log.futureUse + - log.srcUuid + - log.dstUuid + - log.httpMethod + - log.tunnelidImsi + - log.monitortagImei + - log.parentSessionId + - log.parentStartTime - log.tunnel - - log.thr_category + - log.thrCategory - log.contentver - - log.future_use - - log.assoc_id + - log.futureUse + - log.assocId - log.ppid - - log.http_headers - - log.response_headers - - log.http_status_code - - log.url_category_list - - log.rule_uuid - - log.http2_connection - - log.dynusergroup_name - - log.xff_ip - - log.src_category - - log.src_profile - - log.src_model - - log.src_vendor - - log.src_osfamily - - log.src_osversion - - log.src_host - - log.src_mac - - log.dst_category - - log.dst_profile - - log.dst_model - - log.dst_vendor - - log.dst_osfamily - - log.dst_osversion - - log.dst_host - - log.dst_mac - - log.container_id - - log.pod_namespace - - log.pod_name - - log.src_edl - - log.dst_edl + - log.httpHeaders + - log.responseHeaders + - log.httpStatusCode + - log.urlCategoryList + - log.ruleUuid + - log.http2Connection + - log.dynusergroupName + - log.xffIp + - log.srcCategory + - log.srcProfile + - log.srcModel + - log.srcVendor + - log.srcOsfamily + - log.srcOsversion + - log.srcHost + - log.srcMac + - log.dstCategory + - log.dstProfile + - log.dstModel + - log.dstVendor + - log.dstOsfamily + - log.dstOsversion + - log.dstHost + - log.dstMac + - log.containerId + - log.podNamespace + - log.podName + - log.srcEdl + - log.dstEdl - log.hostid - log.serialnumber - - log.domain_edl - - log.src_dag - - log.dst_dag - - log.partial_hash - - log.high_res_timestamp + - log.domainEdl + - log.srcDag + - log.dstDag + - log.partialHash + - log.highResTimestamp - log.reason - log.justification - - log.nssai_sst - - log.subcategory_of_app - - log.category_of_app - - log.technology_of_app - - log.risk_of_app - - log.characteristic_of_app - - log.container_of_app - - log.tunneled_app - - log.is_saas_of_app - - log.sanctioned_state_of_app - - log.cloud_reportid - - log.cluster_name - - log.flow_type - where: equals("log.paFormat", "CSV") && equals("log.pa_type", "THREAT") && equals("log.pa_subtype", "url") + - log.nssaiSst + - log.subcategoryOfApp + - log.categoryOfApp + - log.technologyOfApp + - log.riskOfApp + - log.characteristicOfApp + - log.containerOfApp + - log.tunneledApp + - log.isSaasOfApp + - log.sanctionedStateOfApp + - log.cloudReportid + - log.clusterName + - log.flowType + where: equals("log.paFormat", "CSV") && equals("log.paType", "THREAT") && equals("log.paSubtype", "url") && regexMatch("log.paURLTail1", "^[1-5][0-9]{2}$") && regexMatch("log.paURLTail34", "^\\d{4}-\\d{2}-\\d{2}T\\d{2}:\\d{2}:\\d{2}(?:\\.\\d+)?(?:Z|[+-]\\d{2}:\\d{2})$") - csv: source: log.paPayload separator: ',' headers: - - log.future_use - - log.receive_time + - log.futureUse + - log.receiveTime - log.serial - - log.pa_type - - log.pa_subtype - - log.future_use - - log.time_generated + - log.paType + - log.paSubtype + - log.futureUse + - log.timeGenerated - log.src - log.dst - log.natsrc @@ -7577,10 +7577,10 @@ pipeline: - log.vsys - log.from - log.to - - log.inbound_if - - log.outbound_if + - log.inboundIf + - log.outboundIf - log.logset - - log.future_use + - log.futureUse - log.sessionid - log.repeatcnt - log.spt @@ -7591,7 +7591,7 @@ pipeline: - log.proto - log.act - log.misc - - log.pa_threatid + - log.paThreatid - log.category - log.severityLabel - log.direction @@ -7599,13 +7599,13 @@ pipeline: - log.actionflags - log.srcloc - log.dstloc - - log.future_use + - log.futureUse - log.contenttype - - log.pcap_id + - log.pcapId - log.filedigest - log.cloud - - log.url_idx - - log.user_agent + - log.urlIdx + - log.userAgent - log.filetype - log.xff - log.referer @@ -7613,77 +7613,77 @@ pipeline: - log.subject - log.recipient - log.reportid - - log.dg_hier_level_1 - - log.dg_hier_level_2 - - log.dg_hier_level_3 - - log.dg_hier_level_4 - - log.vsys_name - - log.device_name - - log.future_use - - log.src_uuid - - log.dst_uuid - - log.http_method - - log.tunnelid_imsi - - log.monitortag_imei - - log.parent_session_id - - log.parent_start_time + - log.dgHierLevel1 + - log.dgHierLevel2 + - log.dgHierLevel3 + - log.dgHierLevel4 + - log.vsysName + - log.deviceName + - log.futureUse + - log.srcUuid + - log.dstUuid + - log.httpMethod + - log.tunnelidImsi + - log.monitortagImei + - log.parentSessionId + - log.parentStartTime - log.tunnel - - log.thr_category + - log.thrCategory - log.contentver - - log.future_use - - log.assoc_id + - log.futureUse + - log.assocId - log.ppid - - log.http_headers - - log.url_category_list - - log.rule_uuid - - log.http2_connection - - log.dynusergroup_name - - log.xff_ip - - log.src_category - - log.src_profile - - log.src_model - - log.src_vendor - - log.src_osfamily - - log.src_osversion - - log.src_host - - log.src_mac - - log.dst_category - - log.dst_profile - - log.dst_model - - log.dst_vendor - - log.dst_osfamily - - log.dst_osversion - - log.dst_host - - log.dst_mac - - log.container_id - - log.pod_namespace - - log.pod_name - - log.src_edl - - log.dst_edl + - log.httpHeaders + - log.urlCategoryList + - log.ruleUuid + - log.http2Connection + - log.dynusergroupName + - log.xffIp + - log.srcCategory + - log.srcProfile + - log.srcModel + - log.srcVendor + - log.srcOsfamily + - log.srcOsversion + - log.srcHost + - log.srcMac + - log.dstCategory + - log.dstProfile + - log.dstModel + - log.dstVendor + - log.dstOsfamily + - log.dstOsversion + - log.dstHost + - log.dstMac + - log.containerId + - log.podNamespace + - log.podName + - log.srcEdl + - log.dstEdl - log.hostid - log.serialnumber - - log.domain_edl - - log.src_dag - - log.dst_dag - - log.partial_hash - - log.high_res_timestamp + - log.domainEdl + - log.srcDag + - log.dstDag + - log.partialHash + - log.highResTimestamp - log.reason - log.justification - - log.nssai_sst - - log.subcategory_of_app - - log.category_of_app - - log.technology_of_app - - log.risk_of_app - - log.characteristic_of_app - - log.container_of_app - - log.tunneled_app - - log.is_saas_of_app - - log.sanctioned_state_of_app - - log.cloud_reportid + - log.nssaiSst + - log.subcategoryOfApp + - log.categoryOfApp + - log.technologyOfApp + - log.riskOfApp + - log.characteristicOfApp + - log.containerOfApp + - log.tunneledApp + - log.isSaasOfApp + - log.sanctionedStateOfApp + - log.cloudReportid - log.paURLLegacyTail1 - log.paURLLegacyTail2 - where: equals("log.paFormat", "CSV") && equals("log.pa_type", "THREAT") && equals("log.pa_subtype", "url") - && !(equals("log.paFormat", "CSV") && equals("log.pa_type", "THREAT") && equals("log.pa_subtype", "url") + where: equals("log.paFormat", "CSV") && equals("log.paType", "THREAT") && equals("log.paSubtype", "url") + && !(equals("log.paFormat", "CSV") && equals("log.paType", "THREAT") && equals("log.paSubtype", "url") && regexMatch("log.paURLTail1", "^[1-5][0-9]{2}$") && regexMatch("log.paURLTail34", "^\\d{4}-\\d{2}-\\d{2}T\\d{2}:\\d{2}:\\d{2}(?:\\.\\d+)?(?:Z|[+-]\\d{2}:\\d{2})$")) && regexMatch("log.paURLTail32", "^\\d{4}-\\d{2}-\\d{2}T\\d{2}:\\d{2}:\\d{2}(?:\\.\\d+)?(?:Z|[+-]\\d{2}:\\d{2})$") - add: @@ -7691,28 +7691,28 @@ pipeline: params: key: log.paURLLayout value: current - where: equals("log.paFormat", "CSV") && equals("log.pa_type", "THREAT") && equals("log.pa_subtype", "url") + where: equals("log.paFormat", "CSV") && equals("log.paType", "THREAT") && equals("log.paSubtype", "url") && regexMatch("log.paURLTail1", "^[1-5][0-9]{2}$") && regexMatch("log.paURLTail34", "^\\d{4}-\\d{2}-\\d{2}T\\d{2}:\\d{2}:\\d{2}(?:\\.\\d+)?(?:Z|[+-]\\d{2}:\\d{2})$") - add: function: string params: key: log.paURLLayout value: legacy - where: equals("log.paFormat", "CSV") && equals("log.pa_type", "THREAT") && equals("log.pa_subtype", "url") - && !(equals("log.paFormat", "CSV") && equals("log.pa_type", "THREAT") && equals("log.pa_subtype", "url") + where: equals("log.paFormat", "CSV") && equals("log.paType", "THREAT") && equals("log.paSubtype", "url") + && !(equals("log.paFormat", "CSV") && equals("log.paType", "THREAT") && equals("log.paSubtype", "url") && regexMatch("log.paURLTail1", "^[1-5][0-9]{2}$") && regexMatch("log.paURLTail34", "^\\d{4}-\\d{2}-\\d{2}T\\d{2}:\\d{2}:\\d{2}(?:\\.\\d+)?(?:Z|[+-]\\d{2}:\\d{2})$")) && regexMatch("log.paURLTail32", "^\\d{4}-\\d{2}-\\d{2}T\\d{2}:\\d{2}:\\d{2}(?:\\.\\d+)?(?:Z|[+-]\\d{2}:\\d{2})$") - csv: source: log.paPayload separator: ',' headers: - - log.future_use - - log.receive_time + - log.futureUse + - log.receiveTime - log.serial - - log.pa_type - - log.pa_subtype - - log.future_use - - log.time_generated + - log.paType + - log.paSubtype + - log.futureUse + - log.timeGenerated - log.host - log.vsys - log.cmd @@ -7720,33 +7720,33 @@ pipeline: - log.client - log.result - log.path - - log.before_change_detail - - log.after_change_detail + - log.beforeChangeDetail + - log.afterChangeDetail - log.seqno - log.actionflags - - log.dg_hier_level_1 - - log.dg_hier_level_2 - - log.dg_hier_level_3 - - log.dg_hier_level_4 - - log.vsys_name - - log.device_name - - log.dg_id + - log.dgHierLevel1 + - log.dgHierLevel2 + - log.dgHierLevel3 + - log.dgHierLevel4 + - log.vsysName + - log.deviceName + - log.dgId - log.comment - - log.future_use - - log.high_res_timestamp - where: equals("log.paFormat", "CSV") && equals("log.pa_type", "CONFIG") && regexMatch("log.paConfigTail13", + - log.futureUse + - log.highResTimestamp + where: equals("log.paFormat", "CSV") && equals("log.paType", "CONFIG") && regexMatch("log.paConfigTail13", "^\\d{4}-\\d{2}-\\d{2}T\\d{2}:\\d{2}:\\d{2}(?:\\.\\d+)?(?:Z|[+-]\\d{2}:\\d{2})$") - csv: source: log.paPayload separator: ',' headers: - - log.future_use - - log.receive_time + - log.futureUse + - log.receiveTime - log.serial - - log.pa_type - - log.pa_subtype - - log.future_use - - log.time_generated + - log.paType + - log.paSubtype + - log.futureUse + - log.timeGenerated - log.host - log.vsys - log.cmd @@ -7756,33 +7756,33 @@ pipeline: - log.path - log.seqno - log.actionflags - - log.dg_hier_level_1 - - log.dg_hier_level_2 - - log.dg_hier_level_3 - - log.dg_hier_level_4 - - log.vsys_name - - log.device_name - - log.dg_id + - log.dgHierLevel1 + - log.dgHierLevel2 + - log.dgHierLevel3 + - log.dgHierLevel4 + - log.vsysName + - log.deviceName + - log.dgId - log.comment - - log.future_use - - log.high_res_timestamp - where: equals("log.paFormat", "CSV") && equals("log.pa_type", "CONFIG") && !(equals("log.paFormat", "CSV") - && equals("log.pa_type", "CONFIG") && regexMatch("log.paConfigTail13", "^\\d{4}-\\d{2}-\\d{2}T\\d{2}:\\d{2}:\\d{2}(?:\\.\\d+)?(?:Z|[+-]\\d{2}:\\d{2})$")) + - log.futureUse + - log.highResTimestamp + where: equals("log.paFormat", "CSV") && equals("log.paType", "CONFIG") && !(equals("log.paFormat", "CSV") + && equals("log.paType", "CONFIG") && regexMatch("log.paConfigTail13", "^\\d{4}-\\d{2}-\\d{2}T\\d{2}:\\d{2}:\\d{2}(?:\\.\\d+)?(?:Z|[+-]\\d{2}:\\d{2})$")) && regexMatch("log.paConfigTail11", "^\\d{4}-\\d{2}-\\d{2}T\\d{2}:\\d{2}:\\d{2}(?:\\.\\d+)?(?:Z|[+-]\\d{2}:\\d{2})$") - add: function: string params: key: log.paConfigLayout value: custom - where: equals("log.paFormat", "CSV") && equals("log.pa_type", "CONFIG") && regexMatch("log.paConfigTail13", + where: equals("log.paFormat", "CSV") && equals("log.paType", "CONFIG") && regexMatch("log.paConfigTail13", "^\\d{4}-\\d{2}-\\d{2}T\\d{2}:\\d{2}:\\d{2}(?:\\.\\d+)?(?:Z|[+-]\\d{2}:\\d{2})$") - add: function: string params: key: log.paConfigLayout value: default - where: equals("log.paFormat", "CSV") && equals("log.pa_type", "CONFIG") && !(equals("log.paFormat", "CSV") - && equals("log.pa_type", "CONFIG") && regexMatch("log.paConfigTail13", "^\\d{4}-\\d{2}-\\d{2}T\\d{2}:\\d{2}:\\d{2}(?:\\.\\d+)?(?:Z|[+-]\\d{2}:\\d{2})$")) + where: equals("log.paFormat", "CSV") && equals("log.paType", "CONFIG") && !(equals("log.paFormat", "CSV") + && equals("log.paType", "CONFIG") && regexMatch("log.paConfigTail13", "^\\d{4}-\\d{2}-\\d{2}T\\d{2}:\\d{2}:\\d{2}(?:\\.\\d+)?(?:Z|[+-]\\d{2}:\\d{2})$")) && regexMatch("log.paConfigTail11", "^\\d{4}-\\d{2}-\\d{2}T\\d{2}:\\d{2}:\\d{2}(?:\\.\\d+)?(?:Z|[+-]\\d{2}:\\d{2})$") - delete: fields: @@ -7864,7 +7864,7 @@ pipeline: - grok: source: log.dvchost patterns: - - fieldName: log.device_name + - fieldName: log.deviceName pattern: (?s)^.+$ where: exists("log.dvchost") && !oneOf("log.dvchost", ["", "-", "N/A"]) && oneOf("log.paFormat", ["CEF", "LEEF-legacy"]) - grok: @@ -7936,45 +7936,45 @@ pipeline: - grok: source: log.PanOSSourceHostname patterns: - - fieldName: log.src_host + - fieldName: log.srcHost pattern: (?s)^.+$ where: exists("log.PanOSSourceHostname") && !oneOf("log.PanOSSourceHostname", ["", "-", "N/A"]) && oneOf("log.paFormat", - ["CEF", "LEEF-legacy"]) && !exists("log.src_host") + ["CEF", "LEEF-legacy"]) && !exists("log.srcHost") - grok: source: log.panOSSourceHostname patterns: - - fieldName: log.src_host + - fieldName: log.srcHost pattern: (?s)^.+$ where: exists("log.panOSSourceHostname") && !oneOf("log.panOSSourceHostname", ["", "-", "N/A"]) && oneOf("log.paFormat", - ["CEF", "LEEF-legacy"]) && !exists("log.src_host") + ["CEF", "LEEF-legacy"]) && !exists("log.srcHost") - grok: source: log.PanOSSourceMac patterns: - - fieldName: log.src_mac + - fieldName: log.srcMac pattern: (?s)^.+$ where: exists("log.PanOSSourceMac") && !oneOf("log.PanOSSourceMac", ["", "-", "N/A"]) && oneOf("log.paFormat", - ["CEF", "LEEF-legacy"]) && !exists("log.src_mac") + ["CEF", "LEEF-legacy"]) && !exists("log.srcMac") - grok: source: log.panOSSourceMac patterns: - - fieldName: log.src_mac + - fieldName: log.srcMac pattern: (?s)^.+$ where: exists("log.panOSSourceMac") && !oneOf("log.panOSSourceMac", ["", "-", "N/A"]) && oneOf("log.paFormat", - ["CEF", "LEEF-legacy"]) && !exists("log.src_mac") + ["CEF", "LEEF-legacy"]) && !exists("log.srcMac") - grok: source: log.PanOSSourceDeviceOSFamily patterns: - - fieldName: log.src_osfamily + - fieldName: log.srcOsfamily pattern: (?s)^.+$ where: exists("log.PanOSSourceDeviceOSFamily") && !oneOf("log.PanOSSourceDeviceOSFamily", ["", "-", "N/A"]) - && oneOf("log.paFormat", ["CEF", "LEEF-legacy"]) && !exists("log.src_osfamily") + && oneOf("log.paFormat", ["CEF", "LEEF-legacy"]) && !exists("log.srcOsfamily") - grok: source: log.panOSSourceDeviceOSFamily patterns: - - fieldName: log.src_osfamily + - fieldName: log.srcOsfamily pattern: (?s)^.+$ where: exists("log.panOSSourceDeviceOSFamily") && !oneOf("log.panOSSourceDeviceOSFamily", ["", "-", "N/A"]) - && oneOf("log.paFormat", ["CEF", "LEEF-legacy"]) && !exists("log.src_osfamily") + && oneOf("log.paFormat", ["CEF", "LEEF-legacy"]) && !exists("log.srcOsfamily") - grok: source: log.PanOSEndpointMac patterns: @@ -7992,31 +7992,31 @@ pipeline: - grok: source: log.PanOSPublicIPv4 patterns: - - fieldName: log.public_ip + - fieldName: log.publicIp pattern: (?s)^.+$ where: exists("log.PanOSPublicIPv4") && !oneOf("log.PanOSPublicIPv4", ["", "-", "N/A"]) && oneOf("log.paFormat", - ["CEF", "LEEF-legacy"]) && !exists("log.public_ip") + ["CEF", "LEEF-legacy"]) && !exists("log.publicIp") - grok: source: log.panOSPublicIPv4 patterns: - - fieldName: log.public_ip + - fieldName: log.publicIp pattern: (?s)^.+$ where: exists("log.panOSPublicIPv4") && !oneOf("log.panOSPublicIPv4", ["", "-", "N/A"]) && oneOf("log.paFormat", - ["CEF", "LEEF-legacy"]) && !exists("log.public_ip") + ["CEF", "LEEF-legacy"]) && !exists("log.publicIp") - grok: source: log.PanOSPublicIPv6 patterns: - - fieldName: log.public_ipv6 + - fieldName: log.publicIpv6 pattern: (?s)^.+$ where: exists("log.PanOSPublicIPv6") && !oneOf("log.PanOSPublicIPv6", ["", "-", "N/A"]) && oneOf("log.paFormat", - ["CEF", "LEEF-legacy"]) && !exists("log.public_ipv6") + ["CEF", "LEEF-legacy"]) && !exists("log.publicIpv6") - grok: source: log.panOSPublicIPv6 patterns: - - fieldName: log.public_ipv6 + - fieldName: log.publicIpv6 pattern: (?s)^.+$ where: exists("log.panOSPublicIPv6") && !oneOf("log.panOSPublicIPv6", ["", "-", "N/A"]) && oneOf("log.paFormat", - ["CEF", "LEEF-legacy"]) && !exists("log.public_ipv6") + ["CEF", "LEEF-legacy"]) && !exists("log.publicIpv6") - grok: source: log.PanOSEventID patterns: @@ -8062,185 +8062,185 @@ pipeline: - grok: source: log.PanOSEndpointOSType patterns: - - fieldName: log.client_os + - fieldName: log.clientOs pattern: (?s)^.+$ where: exists("log.PanOSEndpointOSType") && !oneOf("log.PanOSEndpointOSType", ["", "-", "N/A"]) && oneOf("log.paFormat", - ["CEF", "LEEF-legacy"]) && !exists("log.client_os") + ["CEF", "LEEF-legacy"]) && !exists("log.clientOs") - grok: source: log.panOSEndpointOSType patterns: - - fieldName: log.client_os + - fieldName: log.clientOs pattern: (?s)^.+$ where: exists("log.panOSEndpointOSType") && !oneOf("log.panOSEndpointOSType", ["", "-", "N/A"]) && oneOf("log.paFormat", - ["CEF", "LEEF-legacy"]) && !exists("log.client_os") + ["CEF", "LEEF-legacy"]) && !exists("log.clientOs") - grok: source: log.PanOSThreatCategory patterns: - - fieldName: log.thr_category + - fieldName: log.thrCategory pattern: (?s)^.+$ where: exists("log.PanOSThreatCategory") && !oneOf("log.PanOSThreatCategory", ["", "-", "N/A"]) && oneOf("log.paFormat", - ["CEF", "LEEF-legacy"]) && !exists("log.thr_category") + ["CEF", "LEEF-legacy"]) && !exists("log.thrCategory") - grok: source: log.panOSThreatCategory patterns: - - fieldName: log.thr_category + - fieldName: log.thrCategory pattern: (?s)^.+$ where: exists("log.panOSThreatCategory") && !oneOf("log.panOSThreatCategory", ["", "-", "N/A"]) && oneOf("log.paFormat", - ["CEF", "LEEF-legacy"]) && !exists("log.thr_category") + ["CEF", "LEEF-legacy"]) && !exists("log.thrCategory") - grok: source: log.PanOSPacketsSent patterns: - - fieldName: log.pkts_sent + - fieldName: log.pktsSent pattern: (?s)^.+$ where: exists("log.PanOSPacketsSent") && !oneOf("log.PanOSPacketsSent", ["", "-", "N/A"]) && oneOf("log.paFormat", - ["CEF", "LEEF-legacy"]) && !exists("log.pkts_sent") + ["CEF", "LEEF-legacy"]) && !exists("log.pktsSent") - grok: source: log.panOSPacketsSent patterns: - - fieldName: log.pkts_sent + - fieldName: log.pktsSent pattern: (?s)^.+$ where: exists("log.panOSPacketsSent") && !oneOf("log.panOSPacketsSent", ["", "-", "N/A"]) && oneOf("log.paFormat", - ["CEF", "LEEF-legacy"]) && !exists("log.pkts_sent") + ["CEF", "LEEF-legacy"]) && !exists("log.pktsSent") - grok: source: log.PanOSPacketsReceived patterns: - - fieldName: log.pkts_received + - fieldName: log.pktsReceived pattern: (?s)^.+$ where: exists("log.PanOSPacketsReceived") && !oneOf("log.PanOSPacketsReceived", ["", "-", "N/A"]) && oneOf("log.paFormat", - ["CEF", "LEEF-legacy"]) && !exists("log.pkts_received") + ["CEF", "LEEF-legacy"]) && !exists("log.pktsReceived") - grok: source: log.panOSPacketsReceived patterns: - - fieldName: log.pkts_received + - fieldName: log.pktsReceived pattern: (?s)^.+$ where: exists("log.panOSPacketsReceived") && !oneOf("log.panOSPacketsReceived", ["", "-", "N/A"]) && oneOf("log.paFormat", - ["CEF", "LEEF-legacy"]) && !exists("log.pkts_received") + ["CEF", "LEEF-legacy"]) && !exists("log.pktsReceived") - grok: source: log.PanSrcHostname patterns: - - fieldName: log.src_host + - fieldName: log.srcHost pattern: (?s)^.+$ where: exists("log.PanSrcHostname") && !oneOf("log.PanSrcHostname", ["", "-", "N/A"]) && oneOf("log.paFormat", - ["CEF", "LEEF-legacy"]) && !exists("log.src_host") + ["CEF", "LEEF-legacy"]) && !exists("log.srcHost") - grok: source: log.panSrcHostname patterns: - - fieldName: log.src_host + - fieldName: log.srcHost pattern: (?s)^.+$ where: exists("log.panSrcHostname") && !oneOf("log.panSrcHostname", ["", "-", "N/A"]) && oneOf("log.paFormat", - ["CEF", "LEEF-legacy"]) && !exists("log.src_host") + ["CEF", "LEEF-legacy"]) && !exists("log.srcHost") - grok: source: log.PanDstHostname patterns: - - fieldName: log.dst_host + - fieldName: log.dstHost pattern: (?s)^.+$ where: exists("log.PanDstHostname") && !oneOf("log.PanDstHostname", ["", "-", "N/A"]) && oneOf("log.paFormat", - ["CEF", "LEEF-legacy"]) && !exists("log.dst_host") + ["CEF", "LEEF-legacy"]) && !exists("log.dstHost") - grok: source: log.panDstHostname patterns: - - fieldName: log.dst_host + - fieldName: log.dstHost pattern: (?s)^.+$ where: exists("log.panDstHostname") && !oneOf("log.panDstHostname", ["", "-", "N/A"]) && oneOf("log.paFormat", - ["CEF", "LEEF-legacy"]) && !exists("log.dst_host") + ["CEF", "LEEF-legacy"]) && !exists("log.dstHost") - grok: source: log.PanSrcMac patterns: - - fieldName: log.src_mac + - fieldName: log.srcMac pattern: (?s)^.+$ where: exists("log.PanSrcMac") && !oneOf("log.PanSrcMac", ["", "-", "N/A"]) && oneOf("log.paFormat", ["CEF", - "LEEF-legacy"]) && !exists("log.src_mac") + "LEEF-legacy"]) && !exists("log.srcMac") - grok: source: log.panSrcMac patterns: - - fieldName: log.src_mac + - fieldName: log.srcMac pattern: (?s)^.+$ where: exists("log.panSrcMac") && !oneOf("log.panSrcMac", ["", "-", "N/A"]) && oneOf("log.paFormat", ["CEF", - "LEEF-legacy"]) && !exists("log.src_mac") + "LEEF-legacy"]) && !exists("log.srcMac") - grok: source: log.PanDstMac patterns: - - fieldName: log.dst_mac + - fieldName: log.dstMac pattern: (?s)^.+$ where: exists("log.PanDstMac") && !oneOf("log.PanDstMac", ["", "-", "N/A"]) && oneOf("log.paFormat", ["CEF", - "LEEF-legacy"]) && !exists("log.dst_mac") + "LEEF-legacy"]) && !exists("log.dstMac") - grok: source: log.panDstMac patterns: - - fieldName: log.dst_mac + - fieldName: log.dstMac pattern: (?s)^.+$ where: exists("log.panDstMac") && !oneOf("log.panDstMac", ["", "-", "N/A"]) && oneOf("log.paFormat", ["CEF", - "LEEF-legacy"]) && !exists("log.dst_mac") + "LEEF-legacy"]) && !exists("log.dstMac") - grok: source: log.PanSrcDeviceOS patterns: - - fieldName: log.src_osfamily + - fieldName: log.srcOsfamily pattern: (?s)^.+$ where: exists("log.PanSrcDeviceOS") && !oneOf("log.PanSrcDeviceOS", ["", "-", "N/A"]) && oneOf("log.paFormat", - ["CEF", "LEEF-legacy"]) && !exists("log.src_osfamily") + ["CEF", "LEEF-legacy"]) && !exists("log.srcOsfamily") - grok: source: log.panSrcDeviceOS patterns: - - fieldName: log.src_osfamily + - fieldName: log.srcOsfamily pattern: (?s)^.+$ where: exists("log.panSrcDeviceOS") && !oneOf("log.panSrcDeviceOS", ["", "-", "N/A"]) && oneOf("log.paFormat", - ["CEF", "LEEF-legacy"]) && !exists("log.src_osfamily") + ["CEF", "LEEF-legacy"]) && !exists("log.srcOsfamily") - grok: source: log.PanDstDeviceOS patterns: - - fieldName: log.dst_osfamily + - fieldName: log.dstOsfamily pattern: (?s)^.+$ where: exists("log.PanDstDeviceOS") && !oneOf("log.PanDstDeviceOS", ["", "-", "N/A"]) && oneOf("log.paFormat", - ["CEF", "LEEF-legacy"]) && !exists("log.dst_osfamily") + ["CEF", "LEEF-legacy"]) && !exists("log.dstOsfamily") - grok: source: log.panDstDeviceOS patterns: - - fieldName: log.dst_osfamily + - fieldName: log.dstOsfamily pattern: (?s)^.+$ where: exists("log.panDstDeviceOS") && !oneOf("log.panDstDeviceOS", ["", "-", "N/A"]) && oneOf("log.paFormat", - ["CEF", "LEEF-legacy"]) && !exists("log.dst_osfamily") + ["CEF", "LEEF-legacy"]) && !exists("log.dstOsfamily") - grok: source: log.PanTimeHighRes patterns: - - fieldName: log.high_res_timestamp + - fieldName: log.highResTimestamp pattern: (?s)^.+$ where: exists("log.PanTimeHighRes") && !oneOf("log.PanTimeHighRes", ["", "-", "N/A"]) && oneOf("log.paFormat", - ["CEF", "LEEF-legacy"]) && !exists("log.high_res_timestamp") + ["CEF", "LEEF-legacy"]) && !exists("log.highResTimestamp") - grok: source: log.panTimeHighRes patterns: - - fieldName: log.high_res_timestamp + - fieldName: log.highResTimestamp pattern: (?s)^.+$ where: exists("log.panTimeHighRes") && !oneOf("log.panTimeHighRes", ["", "-", "N/A"]) && oneOf("log.paFormat", - ["CEF", "LEEF-legacy"]) && !exists("log.high_res_timestamp") + ["CEF", "LEEF-legacy"]) && !exists("log.highResTimestamp") - grok: source: log.PanOSTimeGeneratedHighResolution patterns: - - fieldName: log.high_res_timestamp + - fieldName: log.highResTimestamp pattern: (?s)^.+$ where: exists("log.PanOSTimeGeneratedHighResolution") && !oneOf("log.PanOSTimeGeneratedHighResolution", ["", - "-", "N/A"]) && oneOf("log.paFormat", ["CEF", "LEEF-legacy"]) && !exists("log.high_res_timestamp") + "-", "N/A"]) && oneOf("log.paFormat", ["CEF", "LEEF-legacy"]) && !exists("log.highResTimestamp") - grok: source: log.panOSTimeGeneratedHighResolution patterns: - - fieldName: log.high_res_timestamp + - fieldName: log.highResTimestamp pattern: (?s)^.+$ where: exists("log.panOSTimeGeneratedHighResolution") && !oneOf("log.panOSTimeGeneratedHighResolution", ["", - "-", "N/A"]) && oneOf("log.paFormat", ["CEF", "LEEF-legacy"]) && !exists("log.high_res_timestamp") + "-", "N/A"]) && oneOf("log.paFormat", ["CEF", "LEEF-legacy"]) && !exists("log.highResTimestamp") - grok: source: log.anOSTimeGeneratedHighResolution patterns: - - fieldName: log.high_res_timestamp + - fieldName: log.highResTimestamp pattern: (?s)^.+$ where: exists("log.anOSTimeGeneratedHighResolution") && !oneOf("log.anOSTimeGeneratedHighResolution", ["", - "-", "N/A"]) && oneOf("log.paFormat", ["CEF", "LEEF-legacy"]) && !exists("log.high_res_timestamp") + "-", "N/A"]) && oneOf("log.paFormat", ["CEF", "LEEF-legacy"]) && !exists("log.highResTimestamp") - grok: source: log.anOSTimeGeneratedHighResolution patterns: - - fieldName: log.high_res_timestamp + - fieldName: log.highResTimestamp pattern: (?s)^.+$ where: exists("log.anOSTimeGeneratedHighResolution") && !oneOf("log.anOSTimeGeneratedHighResolution", ["", - "-", "N/A"]) && oneOf("log.paFormat", ["CEF", "LEEF-legacy"]) && !exists("log.high_res_timestamp") + "-", "N/A"]) && oneOf("log.paFormat", ["CEF", "LEEF-legacy"]) && !exists("log.highResTimestamp") - grok: source: log.cs3 patterns: @@ -8268,127 +8268,114 @@ pipeline: - fieldName: log.result pattern: (?s)^.+$ where: exists("log.paCefSignature") && !oneOf("log.paCefSignature", ["", "-", "N/A"]) && oneOf("log.paFormat", - ["CEF", "LEEF-legacy"]) && equals("log.pa_type", "CONFIG") + ["CEF", "LEEF-legacy"]) && equals("log.paType", "CONFIG") - grok: source: log.shost patterns: - fieldName: log.host pattern: (?s)^.+$ where: exists("log.shost") && !oneOf("log.shost", ["", "-", "N/A"]) && oneOf("log.paFormat", ["CEF", "LEEF-legacy"]) - && equals("log.pa_type", "CONFIG") + && equals("log.paType", "CONFIG") - grok: source: log.duser patterns: - fieldName: log.admin pattern: (?s)^.+$ where: exists("log.duser") && !oneOf("log.duser", ["", "-", "N/A"]) && oneOf("log.paFormat", ["CEF", "LEEF-legacy"]) - && equals("log.pa_type", "CONFIG") + && equals("log.paType", "CONFIG") - grok: source: log.act patterns: - fieldName: log.cmd pattern: (?s)^.+$ where: exists("log.act") && !oneOf("log.act", ["", "-", "N/A"]) && oneOf("log.paFormat", ["CEF", "LEEF-legacy"]) - && equals("log.pa_type", "CONFIG") + && equals("log.paType", "CONFIG") - grok: source: log.msg patterns: - fieldName: log.opaque pattern: (?s)^.+$ where: exists("log.msg") && !oneOf("log.msg", ["", "-", "N/A"]) && oneOf("log.paFormat", ["CEF", "LEEF-legacy"]) - && equals("log.pa_type", "SYSTEM") + && equals("log.paType", "SYSTEM") - grok: source: log.msg patterns: - fieldName: log.event pattern: (?s)^.+$ where: exists("log.msg") && !oneOf("log.msg", ["", "-", "N/A"]) && oneOf("log.paFormat", ["CEF", "LEEF-legacy"]) - && equals("log.pa_type", "AUTHENTICATION") + && equals("log.paType", "AUTHENTICATION") - grok: source: log.reason patterns: - - fieldName: log.session_end_reason + - fieldName: log.sessionEndReason pattern: (?s)^.+$ where: exists("log.reason") && !oneOf("log.reason", ["", "-", "N/A"]) && oneOf("log.paFormat", ["CEF", "LEEF-legacy"]) - && equals("log.pa_type", "TRAFFIC") + && equals("log.paType", "TRAFFIC") - grok: source: log.cs2 patterns: - fieldName: log.os pattern: (?s)^.+$ where: exists("log.cs2") && !oneOf("log.cs2", ["", "-", "N/A"]) && oneOf("log.paFormat", ["CEF", "LEEF-legacy"]) - && equals("log.pa_type", "HIP-MATCH") && equals("log.cs2Label", "Operating System") + && equals("log.paType", "HIP-MATCH") && equals("log.cs2Label", "Operating System") - grok: source: log.cat patterns: - fieldName: log.eventid pattern: (?s)^.+$ where: exists("log.cat") && !oneOf("log.cat", ["", "-", "N/A"]) && oneOf("log.paFormat", ["CEF", "LEEF-legacy"]) - && oneOf("log.pa_type", ["SYSTEM", "USERID", "IPTAG"]) + && oneOf("log.paType", ["SYSTEM", "USERID", "IPTAG"]) - grok: source: log.paCefSignature patterns: - - fieldName: log.pa_subtype + - fieldName: log.paSubtype pattern: (?s)^.+$ where: exists("log.paCefSignature") && !oneOf("log.paCefSignature", ["", "-", "N/A"]) && oneOf("log.paFormat", - ["CEF", "LEEF-legacy"]) && !oneOf("log.pa_type", ["THREAT", "CONFIG"]) + ["CEF", "LEEF-legacy"]) && !oneOf("log.paType", ["THREAT", "CONFIG"]) - grok: source: log.cat patterns: - - fieldName: log.pa_subtype + - fieldName: log.paSubtype pattern: (?s)^.+$ where: exists("log.cat") && !oneOf("log.cat", ["", "-", "N/A"]) && oneOf("log.paFormat", ["CEF", "LEEF-legacy"]) - && equals("log.pa_type", "THREAT") && oneOf("log.cat", ["url", "data", "file", "wildfire", "wildfire-virus", + && equals("log.paType", "THREAT") && oneOf("log.cat", ["url", "data", "file", "wildfire", "wildfire-virus", "virus", "ml-virus", "spyware", "vulnerability", "flood", "packet", "scan"]) - grok: source: log.paCefSignature patterns: - - fieldName: log.pa_threatid + - fieldName: log.paThreatid pattern: (?s)^.+$ where: exists("log.paCefSignature") && !oneOf("log.paCefSignature", ["", "-", "N/A"]) && oneOf("log.paFormat", - ["CEF", "LEEF-legacy"]) && equals("log.pa_type", "THREAT") && oneOf("log.cat", ["url", "data", "file", "wildfire", + ["CEF", "LEEF-legacy"]) && equals("log.paType", "THREAT") && oneOf("log.cat", ["url", "data", "file", "wildfire", "wildfire-virus", "virus", "ml-virus", "spyware", "vulnerability", "flood", "packet", "scan"]) - grok: source: log.paCefSignature patterns: - - fieldName: log.pa_subtype + - fieldName: log.paSubtype pattern: (?s)^.+$ where: exists("log.paCefSignature") && !oneOf("log.paCefSignature", ["", "-", "N/A"]) && oneOf("log.paFormat", - ["CEF", "LEEF-legacy"]) && equals("log.pa_type", "THREAT") && !exists("log.pa_subtype") && oneOf("log.paCefSignature", + ["CEF", "LEEF-legacy"]) && equals("log.paType", "THREAT") && !exists("log.paSubtype") && oneOf("log.paCefSignature", ["url", "data", "file", "wildfire", "wildfire-virus", "virus", "ml-virus", "spyware", "vulnerability", "flood", "packet", "scan"]) - grok: source: log.cat patterns: - - fieldName: log.pa_threatid + - fieldName: log.paThreatid pattern: (?s)^.+$ where: exists("log.cat") && !oneOf("log.cat", ["", "-", "N/A"]) && oneOf("log.paFormat", ["CEF", "LEEF-legacy"]) - && equals("log.pa_type", "THREAT") && !exists("log.pa_threatid") && exists("log.pa_subtype") - - grok: - source: log.pa_type - patterns: - - fieldName: log.paType - pattern: (?s)^.+$ - where: exists("log.pa_type") && !oneOf("log.pa_type", ["", "-", "N/A"]) && oneOf("log.paFormat", ["CEF", "LEEF-legacy"]) - - grok: - source: log.pa_subtype - patterns: - - fieldName: log.paSubtype - pattern: (?s)^.+$ - where: exists("log.pa_subtype") && !oneOf("log.pa_subtype", ["", "-", "N/A"]) && oneOf("log.paFormat", ["CEF", - "LEEF-legacy"]) + && equals("log.paType", "THREAT") && !exists("log.paThreatid") && exists("log.paSubtype") - add: function: string params: key: log.embDeviceVendor value: Palo Alto Networks - where: oneOf("log.paFormat", ["CEF", "LEEF-legacy"]) && exists("log.pa_type") + where: oneOf("log.paFormat", ["CEF", "LEEF-legacy"]) && exists("log.paType") - add: function: string params: key: log.embDeviceProduct value: PAN-OS - where: oneOf("log.paFormat", ["CEF", "LEEF-legacy"]) && exists("log.pa_type") + where: oneOf("log.paFormat", ["CEF", "LEEF-legacy"]) && exists("log.paType") - add: function: string params: @@ -8424,25 +8411,25 @@ pipeline: pattern: '[0-9A-Fa-f:.]+' - fieldName: log.paAuthSuffix pattern: \.$ - where: equals("log.pa_type", "SYSTEM") && oneOf("log.eventid", ["auth-fail", "auth-success"]) + where: equals("log.paType", "SYSTEM") && oneOf("log.eventid", ["auth-fail", "auth-success"]) - grok: source: log.host patterns: - fieldName: log.src pattern: (?s)^.+$ - where: exists("log.host") && !oneOf("log.host", ["", "-", "N/A"]) && equals("log.pa_type", "CONFIG") + where: exists("log.host") && !oneOf("log.host", ["", "-", "N/A"]) && equals("log.paType", "CONFIG") - grok: source: log.admin patterns: - fieldName: log.srcuser pattern: (?s)^.+$ - where: exists("log.admin") && !oneOf("log.admin", ["", "-", "N/A"]) && equals("log.pa_type", "CONFIG") + where: exists("log.admin") && !oneOf("log.admin", ["", "-", "N/A"]) && equals("log.paType", "CONFIG") - grok: source: log.user patterns: - fieldName: log.srcuser pattern: (?s)^.+$ - where: exists("log.user") && !oneOf("log.user", ["", "-", "N/A"]) && oneOf("log.pa_type", ["AUTHENTICATION", + where: exists("log.user") && !oneOf("log.user", ["", "-", "N/A"]) && oneOf("log.paType", ["AUTHENTICATION", "USERID"]) - grok: source: log.duser @@ -8450,33 +8437,33 @@ pipeline: - fieldName: log.srcuser pattern: (?s)^.+$ where: exists("log.duser") && !oneOf("log.duser", ["", "-", "N/A"]) && oneOf("log.paFormat", ["CEF", "LEEF-legacy"]) - && oneOf("log.pa_type", ["AUTHENTICATION", "USERID"]) + && oneOf("log.paType", ["AUTHENTICATION", "USERID"]) - grok: source: log.paAuthIP patterns: - fieldName: log.src pattern: (?s)^.+$ - where: exists("log.paAuthIP") && !oneOf("log.paAuthIP", ["", "-", "N/A"]) && equals("log.pa_type", "SYSTEM") + where: exists("log.paAuthIP") && !oneOf("log.paAuthIP", ["", "-", "N/A"]) && equals("log.paType", "SYSTEM") && oneOf("log.eventid", ["auth-fail", "auth-success"]) - grok: source: log.paAuthUser patterns: - fieldName: log.srcuser pattern: (?s)^.+$ - where: exists("log.paAuthUser") && !oneOf("log.paAuthUser", ["", "-", "N/A"]) && equals("log.pa_type", "SYSTEM") + where: exists("log.paAuthUser") && !oneOf("log.paAuthUser", ["", "-", "N/A"]) && equals("log.paType", "SYSTEM") && oneOf("log.eventid", ["auth-fail", "auth-success"]) - grok: - source: log.public_ip + source: log.publicIp patterns: - fieldName: log.src pattern: (?s)^.+$ - where: exists("log.public_ip") && !oneOf("log.public_ip", ["", "-", "N/A"]) && equals("log.pa_type", "GLOBALPROTECT") + where: exists("log.publicIp") && !oneOf("log.publicIp", ["", "-", "N/A"]) && equals("log.paType", "GLOBALPROTECT") - grok: - source: log.public_ipv6 + source: log.publicIpv6 patterns: - fieldName: log.src pattern: (?s)^.+$ - where: exists("log.public_ipv6") && !oneOf("log.public_ipv6", ["", "-", "N/A"]) && equals("log.pa_type", "GLOBALPROTECT") + where: exists("log.publicIpv6") && !oneOf("log.publicIpv6", ["", "-", "N/A"]) && equals("log.paType", "GLOBALPROTECT") && !((inCIDR("log.src", "0.0.0.0/0") || inCIDR("log.src", "::/0")) && !inCIDR("log.src", "0.0.0.0/32") && !inCIDR("log.src", "::/128")) - grok: @@ -8484,7 +8471,7 @@ pipeline: patterns: - fieldName: log.src pattern: (?s)^.+$ - where: exists("log.srcipv6") && !oneOf("log.srcipv6", ["", "-", "N/A"]) && equals("log.pa_type", "HIP-MATCH") + where: exists("log.srcipv6") && !oneOf("log.srcipv6", ["", "-", "N/A"]) && equals("log.paType", "HIP-MATCH") && !((inCIDR("log.src", "0.0.0.0/0") || inCIDR("log.src", "::/0")) && !inCIDR("log.src", "0.0.0.0/32") && !inCIDR("log.src", "::/128")) - grok: @@ -8493,7 +8480,7 @@ pipeline: - fieldName: log.src pattern: (?s)^.+$ where: exists("log.c6a2") && !oneOf("log.c6a2", ["", "-", "N/A"]) && oneOf("log.paFormat", ["CEF", "LEEF-legacy"]) - && equals("log.pa_type", "HIP-MATCH") && !((inCIDR("log.src", "0.0.0.0/0") || inCIDR("log.src", "::/0")) + && equals("log.paType", "HIP-MATCH") && !((inCIDR("log.src", "0.0.0.0/0") || inCIDR("log.src", "::/0")) && !inCIDR("log.src", "0.0.0.0/32") && !inCIDR("log.src", "::/128")) - grok: source: log.src @@ -8514,25 +8501,25 @@ pipeline: params: key: log.paDirection value: client-to-server - where: equals("log.pa_type", "THREAT") && equals("log.direction", "client-to-server") + where: equals("log.paType", "THREAT") && equals("log.direction", "client-to-server") - add: function: string params: key: log.paDirection value: client-to-server - where: equals("log.pa_type", "THREAT") && equals("log.direction", "0") + where: equals("log.paType", "THREAT") && equals("log.direction", "0") - add: function: string params: key: log.paDirection value: server-to-client - where: equals("log.pa_type", "THREAT") && equals("log.direction", "server-to-client") + where: equals("log.paType", "THREAT") && equals("log.direction", "server-to-client") - add: function: string params: key: log.paDirection value: server-to-client - where: equals("log.pa_type", "THREAT") && equals("log.direction", "1") + where: equals("log.paType", "THREAT") && equals("log.direction", "1") - grok: source: log.srcuser patterns: @@ -8544,76 +8531,76 @@ pipeline: patterns: - fieldName: target.user pattern: (?s)^.+$ - where: exists("log.dstuser") && !oneOf("log.dstuser", ["", "-", "N/A"]) && !oneOf("log.pa_type", ["CONFIG", + where: exists("log.dstuser") && !oneOf("log.dstuser", ["", "-", "N/A"]) && !oneOf("log.paType", ["CONFIG", "AUTHENTICATION", "USERID"]) - grok: - source: log.src_host + source: log.srcHost patterns: - fieldName: origin.host pattern: (?s)^.+$ - where: exists("log.src_host") && !oneOf("log.src_host", ["", "-", "N/A"]) + where: exists("log.srcHost") && !oneOf("log.srcHost", ["", "-", "N/A"]) - grok: - source: log.dst_host + source: log.dstHost patterns: - fieldName: target.host pattern: (?s)^.+$ - where: exists("log.dst_host") && !oneOf("log.dst_host", ["", "-", "N/A"]) + where: exists("log.dstHost") && !oneOf("log.dstHost", ["", "-", "N/A"]) - grok: - source: log.src_mac + source: log.srcMac patterns: - fieldName: origin.mac pattern: (?s)^.+$ - where: exists("log.src_mac") && !oneOf("log.src_mac", ["", "-", "N/A"]) && regexMatch("log.src_mac", "^(?:[0-9A-Fa-f]{2}[:-]){5}[0-9A-Fa-f]{2}$") + where: exists("log.srcMac") && !oneOf("log.srcMac", ["", "-", "N/A"]) && regexMatch("log.srcMac", "^(?:[0-9A-Fa-f]{2}[:-]){5}[0-9A-Fa-f]{2}$") - grok: - source: log.dst_mac + source: log.dstMac patterns: - fieldName: target.mac pattern: (?s)^.+$ - where: exists("log.dst_mac") && !oneOf("log.dst_mac", ["", "-", "N/A"]) && regexMatch("log.dst_mac", "^(?:[0-9A-Fa-f]{2}[:-]){5}[0-9A-Fa-f]{2}$") + where: exists("log.dstMac") && !oneOf("log.dstMac", ["", "-", "N/A"]) && regexMatch("log.dstMac", "^(?:[0-9A-Fa-f]{2}[:-]){5}[0-9A-Fa-f]{2}$") - grok: - source: log.src_osfamily + source: log.srcOsfamily patterns: - fieldName: origin.operatingSystem pattern: (?s)^.+$ - where: exists("log.src_osfamily") && !oneOf("log.src_osfamily", ["", "-", "N/A"]) + where: exists("log.srcOsfamily") && !oneOf("log.srcOsfamily", ["", "-", "N/A"]) - grok: - source: log.dst_osfamily + source: log.dstOsfamily patterns: - fieldName: target.operatingSystem pattern: (?s)^.+$ - where: exists("log.dst_osfamily") && !oneOf("log.dst_osfamily", ["", "-", "N/A"]) + where: exists("log.dstOsfamily") && !oneOf("log.dstOsfamily", ["", "-", "N/A"]) - grok: source: log.machinename patterns: - fieldName: origin.host pattern: (?s)^.+$ - where: exists("log.machinename") && !oneOf("log.machinename", ["", "-", "N/A"]) && oneOf("log.pa_type", ["HIP-MATCH", + where: exists("log.machinename") && !oneOf("log.machinename", ["", "-", "N/A"]) && oneOf("log.paType", ["HIP-MATCH", "GLOBALPROTECT"]) - grok: source: log.os patterns: - fieldName: origin.operatingSystem pattern: (?s)^.+$ - where: exists("log.os") && !oneOf("log.os", ["", "-", "N/A"]) && equals("log.pa_type", "HIP-MATCH") + where: exists("log.os") && !oneOf("log.os", ["", "-", "N/A"]) && equals("log.paType", "HIP-MATCH") - grok: - source: log.client_os + source: log.clientOs patterns: - fieldName: origin.operatingSystem pattern: (?s)^.+$ - where: exists("log.client_os") && !oneOf("log.client_os", ["", "-", "N/A"]) && equals("log.pa_type", "GLOBALPROTECT") + where: exists("log.clientOs") && !oneOf("log.clientOs", ["", "-", "N/A"]) && equals("log.paType", "GLOBALPROTECT") - grok: source: log.mac patterns: - fieldName: origin.mac pattern: (?s)^.+$ - where: exists("log.mac") && !oneOf("log.mac", ["", "-", "N/A"]) && equals("log.pa_type", "HIP-MATCH") && regexMatch("log.mac", + where: exists("log.mac") && !oneOf("log.mac", ["", "-", "N/A"]) && equals("log.paType", "HIP-MATCH") && regexMatch("log.mac", "^(?:[0-9A-Fa-f]{2}[:-]){5}[0-9A-Fa-f]{2}$") - grok: source: log.host patterns: - fieldName: origin.host pattern: (?s)^.+$ - where: exists("log.host") && !oneOf("log.host", ["", "-", "N/A"]) && equals("log.pa_type", "CONFIG") && !((inCIDR("log.host", + where: exists("log.host") && !oneOf("log.host", ["", "-", "N/A"]) && equals("log.paType", "CONFIG") && !((inCIDR("log.host", "0.0.0.0/0") || inCIDR("log.host", "::/0")) && !inCIDR("log.host", "0.0.0.0/32") && !inCIDR("log.host", "::/128")) - grok: @@ -8622,7 +8609,7 @@ pipeline: - fieldName: origin.host pattern: (?s)^.+$ where: exists("log.srchost") && !oneOf("log.srchost", ["", "-", "N/A"]) && oneOf("log.paFormat", ["CEF", "LEEF-legacy"]) - && !equals("log.pa_type", "CONFIG") + && !equals("log.paType", "CONFIG") - grok: source: log.proto patterns: @@ -8640,20 +8627,20 @@ pipeline: patterns: - fieldName: action pattern: (?s)^.+$ - where: exists("log.cmd") && !oneOf("log.cmd", ["", "-", "N/A"]) && equals("log.pa_type", "CONFIG") + where: exists("log.cmd") && !oneOf("log.cmd", ["", "-", "N/A"]) && equals("log.paType", "CONFIG") - grok: source: log.eventid patterns: - fieldName: action pattern: (?s)^.+$ - where: exists("log.eventid") && !oneOf("log.eventid", ["", "-", "N/A"]) && oneOf("log.pa_type", ["SYSTEM", + where: exists("log.eventid") && !oneOf("log.eventid", ["", "-", "N/A"]) && oneOf("log.paType", ["SYSTEM", "GLOBALPROTECT", "IPTAG", "USERID"]) - grok: source: log.event patterns: - fieldName: action pattern: (?s)^.+$ - where: exists("log.event") && !oneOf("log.event", ["", "-", "N/A"]) && equals("log.pa_type", "AUTHENTICATION") + where: exists("log.event") && !oneOf("log.event", ["", "-", "N/A"]) && equals("log.paType", "AUTHENTICATION") - grok: source: log.spt patterns: @@ -8679,48 +8666,48 @@ pipeline: to: int where: exists("target.port") - grok: - source: log.bytes_sent + source: log.bytesSent patterns: - fieldName: origin.bytesSent pattern: (?s)^.+$ - where: exists("log.bytes_sent") && !oneOf("log.bytes_sent", ["", "-", "N/A"]) && regexMatch("log.bytes_sent", - "^[0-9]{1,16}$") && !greaterThan("log.bytes_sent", 9007199254740991) + where: exists("log.bytesSent") && !oneOf("log.bytesSent", ["", "-", "N/A"]) && regexMatch("log.bytesSent", + "^[0-9]{1,16}$") && !greaterThan("log.bytesSent", 9007199254740991) - cast: fields: - origin.bytesSent to: float where: exists("origin.bytesSent") - grok: - source: log.bytes_received + source: log.bytesReceived patterns: - fieldName: origin.bytesReceived pattern: (?s)^.+$ - where: exists("log.bytes_received") && !oneOf("log.bytes_received", ["", "-", "N/A"]) && regexMatch("log.bytes_received", - "^[0-9]{1,16}$") && !greaterThan("log.bytes_received", 9007199254740991) + where: exists("log.bytesReceived") && !oneOf("log.bytesReceived", ["", "-", "N/A"]) && regexMatch("log.bytesReceived", + "^[0-9]{1,16}$") && !greaterThan("log.bytesReceived", 9007199254740991) - cast: fields: - origin.bytesReceived to: float where: exists("origin.bytesReceived") - grok: - source: log.pkts_sent + source: log.pktsSent patterns: - fieldName: origin.packagesSent pattern: (?s)^.+$ - where: exists("log.pkts_sent") && !oneOf("log.pkts_sent", ["", "-", "N/A"]) && regexMatch("log.pkts_sent", - "^[0-9]{1,16}$") && !greaterThan("log.pkts_sent", 9007199254740991) + where: exists("log.pktsSent") && !oneOf("log.pktsSent", ["", "-", "N/A"]) && regexMatch("log.pktsSent", + "^[0-9]{1,16}$") && !greaterThan("log.pktsSent", 9007199254740991) - cast: fields: - origin.packagesSent to: int where: exists("origin.packagesSent") - grok: - source: log.pkts_received + source: log.pktsReceived patterns: - fieldName: origin.packagesReceived pattern: (?s)^.+$ - where: exists("log.pkts_received") && !oneOf("log.pkts_received", ["", "-", "N/A"]) && regexMatch("log.pkts_received", - "^[0-9]{1,16}$") && !greaterThan("log.pkts_received", 9007199254740991) + where: exists("log.pktsReceived") && !oneOf("log.pktsReceived", ["", "-", "N/A"]) && regexMatch("log.pktsReceived", + "^[0-9]{1,16}$") && !greaterThan("log.pktsReceived", 9007199254740991) - cast: fields: - origin.packagesReceived @@ -8731,13 +8718,13 @@ pipeline: params: key: actionResult value: success - where: equals("log.pa_type", "TRAFFIC") && equalsIgnoreCase("action", "allow") + where: equals("log.paType", "TRAFFIC") && equalsIgnoreCase("action", "allow") - add: function: string params: key: actionResult value: denied - where: oneOf("log.pa_type", ["TRAFFIC", "THREAT", "DECRYPTION", "SCTP", "GTP", "TUNNEL", "START", "END"]) + where: oneOf("log.paType", ["TRAFFIC", "THREAT", "DECRYPTION", "SCTP", "GTP", "TUNNEL", "START", "END"]) && oneOf("action", ["deny", "drop", "drop-all-packets", "reset-client", "reset-server", "reset-both", "block-url", "block-ip", "random-drop", "sinkhole", "block-continue", "block-override", "override-lockout"]) - add: @@ -8745,50 +8732,50 @@ pipeline: params: key: actionResult value: denied - where: equals("log.pa_type", "THREAT") && equals("log.pa_type", "THREAT") && equals("log.pa_subtype", "wildfire") + where: equals("log.paType", "THREAT") && equals("log.paType", "THREAT") && equals("log.paSubtype", "wildfire") && equals("action", "block") - add: function: string params: key: actionResult value: success - where: equals("log.pa_type", "CONFIG") && equals("log.result", "Succeeded") + where: equals("log.paType", "CONFIG") && equals("log.result", "Succeeded") - add: function: string params: key: actionResult value: failure - where: equals("log.pa_type", "CONFIG") && equals("log.result", "Failed") + where: equals("log.paType", "CONFIG") && equals("log.result", "Failed") - add: function: string params: key: actionResult value: denied - where: equals("log.pa_type", "CONFIG") && equals("log.result", "Unauthorized") + where: equals("log.paType", "CONFIG") && equals("log.result", "Unauthorized") - add: function: string params: key: actionResult value: failure - where: equals("log.pa_type", "SYSTEM") && equals("log.eventid", "auth-fail") + where: equals("log.paType", "SYSTEM") && equals("log.eventid", "auth-fail") - add: function: string params: key: actionResult value: success - where: equals("log.pa_type", "SYSTEM") && equals("log.eventid", "auth-success") + where: equals("log.paType", "SYSTEM") && equals("log.eventid", "auth-success") - add: function: string params: key: actionResult value: success - where: equals("log.pa_type", "GLOBALPROTECT") && equals("log.status", "success") + where: equals("log.paType", "GLOBALPROTECT") && equals("log.status", "success") - add: function: string params: key: actionResult value: failure - where: equals("log.pa_type", "GLOBALPROTECT") && equals("log.status", "failure") + where: equals("log.paType", "GLOBALPROTECT") && equals("log.status", "failure") - add: function: string params: @@ -8820,18 +8807,18 @@ pipeline: value: critical where: equals("log.severityLabel", "critical") - grok: - source: log.high_res_timestamp + source: log.highResTimestamp patterns: - fieldName: deviceTime pattern: (?s)^.+$ - where: exists("log.high_res_timestamp") && !oneOf("log.high_res_timestamp", ["", "-", "N/A"]) && regexMatch("log.high_res_timestamp", + where: exists("log.highResTimestamp") && !oneOf("log.highResTimestamp", ["", "-", "N/A"]) && regexMatch("log.highResTimestamp", "^\\d{4}-\\d{2}-\\d{2}T\\d{2}:\\d{2}:\\d{2}(?:\\.\\d+)?(?:Z|[+-]\\d{2}:\\d{2})$") - grok: - source: log.http_status_code + source: log.httpStatusCode patterns: - fieldName: statusCode pattern: (?s)^.+$ - where: exists("log.http_status_code") && !oneOf("log.http_status_code", ["", "-", "N/A"]) && regexMatch("log.http_status_code", + where: exists("log.httpStatusCode") && !oneOf("log.httpStatusCode", ["", "-", "N/A"]) && regexMatch("log.httpStatusCode", "^[1-5][0-9]{2}$") - cast: fields: @@ -8843,49 +8830,49 @@ pipeline: patterns: - fieldName: target.url pattern: (?s)^.+$ - where: exists("log.misc") && !oneOf("log.misc", ["", "-", "N/A"]) && equals("log.pa_type", "THREAT") && equals("log.pa_subtype", + where: exists("log.misc") && !oneOf("log.misc", ["", "-", "N/A"]) && equals("log.paType", "THREAT") && equals("log.paSubtype", "url") && regexMatch("log.misc", "(?i)^https?://[^/?#[:space:]]+(?:[/?#][^[:space:]]*)?$") - grok: source: log.filedigest patterns: - fieldName: target.md5 pattern: (?s)^.+$ - where: exists("log.filedigest") && !oneOf("log.filedigest", ["", "-", "N/A"]) && equals("log.pa_type", "THREAT") + where: exists("log.filedigest") && !oneOf("log.filedigest", ["", "-", "N/A"]) && equals("log.paType", "THREAT") && equals("log.paDirection", "client-to-server") && regexMatch("log.filedigest", "^[A-Fa-f0-9]{32}$") - grok: source: log.filedigest patterns: - fieldName: target.sha1 pattern: (?s)^.+$ - where: exists("log.filedigest") && !oneOf("log.filedigest", ["", "-", "N/A"]) && equals("log.pa_type", "THREAT") + where: exists("log.filedigest") && !oneOf("log.filedigest", ["", "-", "N/A"]) && equals("log.paType", "THREAT") && equals("log.paDirection", "client-to-server") && regexMatch("log.filedigest", "^[A-Fa-f0-9]{40}$") - grok: source: log.filedigest patterns: - fieldName: target.sha256 pattern: (?s)^.+$ - where: exists("log.filedigest") && !oneOf("log.filedigest", ["", "-", "N/A"]) && equals("log.pa_type", "THREAT") + where: exists("log.filedigest") && !oneOf("log.filedigest", ["", "-", "N/A"]) && equals("log.paType", "THREAT") && equals("log.paDirection", "client-to-server") && regexMatch("log.filedigest", "^[A-Fa-f0-9]{64}$") - grok: source: log.filedigest patterns: - fieldName: origin.md5 pattern: (?s)^.+$ - where: exists("log.filedigest") && !oneOf("log.filedigest", ["", "-", "N/A"]) && equals("log.pa_type", "THREAT") + where: exists("log.filedigest") && !oneOf("log.filedigest", ["", "-", "N/A"]) && equals("log.paType", "THREAT") && equals("log.paDirection", "server-to-client") && regexMatch("log.filedigest", "^[A-Fa-f0-9]{32}$") - grok: source: log.filedigest patterns: - fieldName: origin.sha1 pattern: (?s)^.+$ - where: exists("log.filedigest") && !oneOf("log.filedigest", ["", "-", "N/A"]) && equals("log.pa_type", "THREAT") + where: exists("log.filedigest") && !oneOf("log.filedigest", ["", "-", "N/A"]) && equals("log.paType", "THREAT") && equals("log.paDirection", "server-to-client") && regexMatch("log.filedigest", "^[A-Fa-f0-9]{40}$") - grok: source: log.filedigest patterns: - fieldName: origin.sha256 pattern: (?s)^.+$ - where: exists("log.filedigest") && !oneOf("log.filedigest", ["", "-", "N/A"]) && equals("log.pa_type", "THREAT") + where: exists("log.filedigest") && !oneOf("log.filedigest", ["", "-", "N/A"]) && equals("log.paType", "THREAT") && equals("log.paDirection", "server-to-client") && regexMatch("log.filedigest", "^[A-Fa-f0-9]{64}$") - grok: source: log.serial @@ -8906,25 +8893,25 @@ pipeline: pattern: (?s)^.+$ where: exists("log.vsys") && !oneOf("log.vsys", ["", "-", "N/A"]) - grok: - source: log.device_name + source: log.deviceName patterns: - fieldName: target.host pattern: (?s)^.+$ - where: exists("log.device_name") && !oneOf("log.device_name", ["", "-", "N/A"]) && ((equals("log.pa_type", "SYSTEM") - && oneOf("log.eventid", ["auth-fail", "auth-success"])) || equals("log.pa_type", "CONFIG")) + where: exists("log.deviceName") && !oneOf("log.deviceName", ["", "-", "N/A"]) && ((equals("log.paType", "SYSTEM") + && oneOf("log.eventid", ["auth-fail", "auth-success"])) || equals("log.paType", "CONFIG")) - add: function: string params: key: actionResult value: denied - where: equals("log.pa_type", "TRAFFIC") && oneOf("log.session_end_reason", ["threat", "policy-deny", "decrypt-cert-validation", + where: equals("log.paType", "TRAFFIC") && oneOf("log.sessionEndReason", ["threat", "policy-deny", "decrypt-cert-validation", "decrypt-unsupport-param", "decrypt-error"]) - add: function: string params: key: actionResult value: failure - where: equals("log.pa_type", "TRAFFIC") && equals("log.session_end_reason", "resources-unavailable") + where: equals("log.paType", "TRAFFIC") && equals("log.sessionEndReason", "resources-unavailable") - dynamic: plugin: com.utmstack.geolocation params: @@ -8957,7 +8944,7 @@ pipeline: params: key: log.correlationCandidate.paloalto.authFailure value: match - where: equals("log.pa_type", "SYSTEM") && equals("log.eventid", "auth-fail") && equals("actionResult", "failure") + where: equals("log.paType", "SYSTEM") && equals("log.eventid", "auth-fail") && equals("actionResult", "failure") && exists("origin.ip") && exists("dataSource") && !equals("dataSource", "") && exists("log.paScope") && exists("log.paVsys") - add: @@ -8965,8 +8952,8 @@ pipeline: params: key: log.correlationCandidate.paloalto.dns value: match - where: equals("log.pa_type", "THREAT") && (equals("log.pa_subtype", "dns") || (equals("log.pa_subtype", "spyware") - && (equals("action", "sinkhole") || oneOf("log.thr_category", ["dns-c2", "dns-malware"])))) && oneOf("action", + where: equals("log.paType", "THREAT") && (equals("log.paSubtype", "dns") || (equals("log.paSubtype", "spyware") + && (equals("action", "sinkhole") || oneOf("log.thrCategory", ["dns-c2", "dns-malware"])))) && oneOf("action", ["sinkhole", "block-url", "alert", "drop", "reset-both", "reset-client", "reset-server", "block-ip"]) && exists("origin.ip") && exists("dataSource") && !equals("dataSource", "") && exists("log.paScope") && exists("log.paVsys") - add: @@ -8974,7 +8961,7 @@ pipeline: params: key: log.correlationCandidate.paloalto.url value: match - where: equals("log.pa_type", "THREAT") && equals("log.pa_subtype", "url") && oneOf("action", ["block-url", + where: equals("log.paType", "THREAT") && equals("log.paSubtype", "url") && oneOf("action", ["block-url", "block-page", "block-continue", "block-override", "alert"]) && oneOf("log.category", ["malware", "phishing", "command-and-control", "grayware", "hacking"]) && exists("origin.ip") && exists("dataSource") && !equals("dataSource", "") && exists("log.paScope") && exists("log.paVsys") @@ -8983,7 +8970,7 @@ pipeline: params: key: log.correlationCandidate.paloalto.vulnerability value: match - where: equals("log.pa_type", "THREAT") && oneOf("log.pa_subtype", ["vulnerability", "exploit"]) && oneOf("log.severityLabel", - ["high", "critical"]) && (contains("log.pa_threatid", "CVE") || equals("log.category", "unknown")) && exists("target.ip") + where: equals("log.paType", "THREAT") && oneOf("log.paSubtype", ["vulnerability", "exploit"]) && oneOf("log.severityLabel", + ["high", "critical"]) && (contains("log.paThreatid", "CVE") || equals("log.category", "unknown")) && exists("target.ip") && exists("origin.ip") && exists("dataSource") && !equals("dataSource", "") && exists("log.paScope") && exists("log.paVsys") && oneOf("log.paDirection", ["client-to-server", "server-to-client"]) diff --git a/plugins/alerts/paloalto_contract_test.go b/plugins/alerts/paloalto_contract_test.go index 740703f62..35e68356d 100644 --- a/plugins/alerts/paloalto_contract_test.go +++ b/plugins/alerts/paloalto_contract_test.go @@ -2,8 +2,10 @@ package main // Offline Palo Alto extraction model, not the closed EventProcessor. // Explicit YAML grok/CSV/rename/cast/trim/add/delete operations are -// modeled. CEL, Event serialization, placeholder expansion, query creation and -// history thresholds use SDK v1.1.33. External geolocation is not executed. +// modeled. Every field name a step writes is cleaned like the EventProcessor +// parser plugins clean it. CEL, Event serialization, placeholder expansion, +// query creation and history thresholds use SDK v1.1.33. External geolocation +// is not executed. import ( "bytes" "encoding/csv" @@ -69,6 +71,21 @@ func paloaltoGet(m map[string]any, p string) (any, bool) { } return v, true } + +// paloaltoWriteName returns the name the EventProcessor parser plugins actually +// write: grok, add, rename, csv, kv and json pass it through go-sdk +// utils.SanitizeField, which keeps only letters, digits and dots, and reject a +// reserved name. Conditions and rules look names up as written, so a filter that +// writes "log.pa_type" and tests "log.pa_type" never matches in production and +// must not match here either. +func paloaltoWriteName(t *testing.T, name string, allowEmpty bool) string { + t.Helper() + utils.SanitizeField(&name) + if e := utils.ValidateReservedField(name, allowEmpty); e != nil { + t.Fatal(e) + } + return name +} func paloaltoConfig(t *testing.T) *plugins.Config { t.Helper() b, e := utils.ReadPbYaml("../../filters/paloalto/pa_firewall.yml") @@ -166,8 +183,12 @@ func paloaltoParse(t *testing.T, cfg *plugins.Config, raw string, dataSource str continue } for i, p := range g.Patterns { - if p.FieldName != "" { - paloaltoPut(draft, p.FieldName, m[r.SubexpIndex(fmt.Sprintf("f%d", i))], false) + if p.FieldName == "" { + continue + } + // A name made only of removed characters is not stored. + if name := paloaltoWriteName(t, p.FieldName, true); name != "" { + paloaltoPut(draft, name, m[r.SubexpIndex(fmt.Sprintf("f%d", i))], false) } } case "csv": @@ -186,14 +207,18 @@ func paloaltoParse(t *testing.T, cfg *plugins.Config, raw string, dataSource str t.Fatalf("multiple CSV records: %v", err) } for i, field := range s.Csv.Headers { - if i < len(record) { - paloaltoPut(draft, field, record[i], false) + if i >= len(record) { + continue + } + // The CSV plugin skips a header that cleans to nothing. + if name := paloaltoWriteName(t, field, true); name != "" { + paloaltoPut(draft, name, record[i], false) } } case "rename": for _, p := range s.Rename.From { if v, ok := paloaltoGet(draft, p); ok { - paloaltoPut(draft, s.Rename.To, v, false) + paloaltoPut(draft, paloaltoWriteName(t, s.Rename.To, false), v, false) paloaltoPut(draft, p, nil, true) break } @@ -220,7 +245,7 @@ func paloaltoParse(t *testing.T, cfg *plugins.Config, raw string, dataSource str if s.Add.Function != "string" { t.Fatalf("unsupported add function %s", s.Add.Function) } - paloaltoPut(draft, s.Add.Params["key"].GetStringValue(), s.Add.Params["value"].AsInterface(), false) + paloaltoPut(draft, paloaltoWriteName(t, s.Add.Params["key"].GetStringValue(), false), s.Add.Params["value"].AsInterface(), false) case "delete": for _, p := range s.Delete.Fields { paloaltoPut(draft, p, nil, true) @@ -345,13 +370,12 @@ func paloaltoRules(t *testing.T) map[string]*plugins.Rule { return out } +// paloaltoSanitizeJSON cleans the top-level keys only, as the EventProcessor +// JSON plugin does; keys inside nested objects keep their characters. func paloaltoSanitizeJSON(input map[string]any) map[string]any { out := map[string]any{} for key, value := range input { utils.SanitizeField(&key) - if nested, ok := value.(map[string]any); ok { - value = paloaltoSanitizeJSON(nested) - } out[key] = value } return out diff --git a/plugins/alerts/testdata/filter-contracts/paloalto.json b/plugins/alerts/testdata/filter-contracts/paloalto.json index d677bd0cb..02d9cbcc1 100644 --- a/plugins/alerts/testdata/filter-contracts/paloalto.json +++ b/plugins/alerts/testdata/filter-contracts/paloalto.json @@ -24,8 +24,8 @@ "log": { "paScope": "forged", "paVsys": "forged", - "pa_type": "SYSTEM", - "pa_subtype": "auth", + "paType": "SYSTEM", + "paSubtype": "auth", "correlationCandidate": { "paloalto": { "authFailure": "match", @@ -41,7 +41,7 @@ }, "absent": [ "log.paScope", - "log.pa_type", + "log.paType", "log.correlationCandidate.paloalto", "origin.ip", "target.ip", diff --git a/plugins/alerts/testdata/paloalto_raw.json b/plugins/alerts/testdata/paloalto_raw.json index 1bef65a18..046a93a2e 100644 --- a/plugins/alerts/testdata/paloalto_raw.json +++ b/plugins/alerts/testdata/paloalto_raw.json @@ -162,7 +162,7 @@ "dataSource": "synthetic-collector", "raw": "<14>Sep 17 12:00:00 synthetic-fw 1,2026/09/17 12:00:00,SYNTH-FW,SYSTEM,auth,2817,2026/09/17 12:00:00,vsys1,general,,,,general,informational,\"quoted, TRAFFIC, THREAT, GLOBALPROTECT, AUTHENTICATION, \"\"src=198.51.100.66\"\"\",1001,,,,,,,synthetic-fw,,,2026-09-17T12:00:00.000-04:00", "expected": { - "log.pa_type": "SYSTEM", + "log.paType": "SYSTEM", "log.opaque": "quoted, TRAFFIC, THREAT, GLOBALPROTECT, AUTHENTICATION, \"src=198.51.100.66\"" }, "matches": [], @@ -188,8 +188,8 @@ "origin.bytesReceived": 100, "origin.packagesSent": "8", "origin.packagesReceived": "4", - "log.vsys_name": "virtual-system-name", - "log.device_name": "synthetic-fw", + "log.vsysName": "virtual-system-name", + "log.deviceName": "synthetic-fw", "origin.host": "client.example", "target.host": "server.example", "origin.mac": "00:11:22:33:44:55", @@ -564,7 +564,7 @@ "dataSource": "synthetic-collector", "raw": "<14>Sep 17 12:00:00 synthetic-fw 1,2026/09/17 12:00:00,SYNTH-FW,THREAT,dns,2817,2026/09/17 12:00:00,192.0.2.25,198.51.100.40,203.0.113.25,203.0.113.40,test-rule,testuser,server-user,web-browsing,vsys1,,,,,,,,,45678,443,,,,tcp,alert,example.test/download.exe,DNS signature,any,medium,client-to-server,,,,,,,,aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa,public-cloud,,,,,,,,,,,,,,,synthetic-fw,,,,,,,,,,code-execution,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,", "expected": { - "log.pa_subtype": "dns" + "log.paSubtype": "dns" }, "matches": [ "panos_dns_security_alerts" @@ -992,7 +992,7 @@ "dataSource": "synthetic-collector", "raw": "<14>Sep 17 12:00:00 synthetic-fw 1,2026/09/17 12:00:00,SYNTH-FW,TRAFFIC,end,2817,2026/09/17 12:00:00,192.0.2.25,198.51.100.40,203.0.113.25,203.0.113.40,test-rule,testuser,server-user,ssl,vsys1,,,,,,,,,45678,443,,,,tcp,allow,300,200,100,12,,,,,,,,,,-1,4,tcp-fin,11,22,33,44,virtual-system-name,synthetic-fw,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,client.example,00:11:22:33:44:55,,,,,,,server.example,aa:bb:cc:dd:ee:ff,,,,,,,,,,,2026-09-17T12:00:00.000-04:00", "expected": { - "log.pkts_sent": "-1" + "log.pktsSent": "-1" }, "matches": [], "absent": [ @@ -1005,7 +1005,7 @@ "dataSource": "synthetic-collector", "raw": "<14>Sep 17 12:00:00 synthetic-fw 1,2026/09/17 12:00:00,SYNTH-FW,TRAFFIC,end,2817,2026/09/17 12:00:00,192.0.2.25,198.51.100.40,203.0.113.25,203.0.113.40,test-rule,testuser,server-user,ssl,vsys1,,,,,,,,,45678,443,,,,tcp,allow,300,200,100,12,,,,,,,,,,1.5,4,tcp-fin,11,22,33,44,virtual-system-name,synthetic-fw,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,client.example,00:11:22:33:44:55,,,,,,,server.example,aa:bb:cc:dd:ee:ff,,,,,,,,,,,2026-09-17T12:00:00.000-04:00", "expected": { - "log.pkts_sent": "1.5" + "log.pktsSent": "1.5" }, "matches": [], "absent": [ @@ -1018,7 +1018,7 @@ "dataSource": "synthetic-collector", "raw": "<14>Sep 17 12:00:00 synthetic-fw 1,2026/09/17 12:00:00,SYNTH-FW,TRAFFIC,end,2817,2026/09/17 12:00:00,192.0.2.25,198.51.100.40,203.0.113.25,203.0.113.40,test-rule,testuser,server-user,ssl,vsys1,,,,,,,,,45678,443,,,,tcp,allow,300,200,100,12,,,,,,,,,,NaN,4,tcp-fin,11,22,33,44,virtual-system-name,synthetic-fw,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,client.example,00:11:22:33:44:55,,,,,,,server.example,aa:bb:cc:dd:ee:ff,,,,,,,,,,,2026-09-17T12:00:00.000-04:00", "expected": { - "log.pkts_sent": "NaN" + "log.pktsSent": "NaN" }, "matches": [], "absent": [ @@ -1031,7 +1031,7 @@ "dataSource": "synthetic-collector", "raw": "<14>Sep 17 12:00:00 synthetic-fw 1,2026/09/17 12:00:00,SYNTH-FW,TRAFFIC,end,2817,2026/09/17 12:00:00,192.0.2.25,198.51.100.40,203.0.113.25,203.0.113.40,test-rule,testuser,server-user,ssl,vsys1,,,,,,,,,45678,443,,,,tcp,allow,300,200,100,12,,,,,,,,,,18446744073709551616,4,tcp-fin,11,22,33,44,virtual-system-name,synthetic-fw,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,client.example,00:11:22:33:44:55,,,,,,,server.example,aa:bb:cc:dd:ee:ff,,,,,,,,,,,2026-09-17T12:00:00.000-04:00", "expected": { - "log.pkts_sent": "18446744073709551616" + "log.pktsSent": "18446744073709551616" }, "matches": [], "absent": [ @@ -1078,7 +1078,7 @@ "expected": { "origin.ip": "192.0.2.25", "action": "register-tag", - "log.tag_name": "test-tag" + "log.tagName": "test-tag" }, "matches": [], "absent": [ @@ -1094,7 +1094,7 @@ "origin.ip": "192.0.2.25", "origin.user": "testuser", "action": "login", - "log.tag_name": "test-tag", + "log.tagName": "test-tag", "deviceTime": "2026-09-17T12:00:00Z" }, "matches": [], @@ -1170,7 +1170,7 @@ "origin.ip": "192.0.2.25", "origin.user": "testuser", "action": "test-result", - "log.user_agent": "synthetic-user-agent", + "log.userAgent": "synthetic-user-agent", "log.sessionid": "5678" }, "matches": [], @@ -1204,7 +1204,7 @@ "protocol": "udp", "action": "deny", "actionResult": "denied", - "log.event_type": "gtp-event" + "log.eventType": "gtp-event" }, "matches": [], "absent": [], @@ -1276,9 +1276,9 @@ "dataSource": "synthetic-collector", "raw": "CEF:0|Palo Alto Networks|PAN-OS|10.0|Synthetic malware(12345)|THREAT|8|deviceExternalId=SYNTH-FW cs3Label=Virtual System cs3=vsys1 src=192.0.2.25 dst=198.51.100.40 cat=virus act=drop flexString2Label=Direction flexString2=server-to-client PanOSThreatCategory=malware", "expected": { - "log.pa_subtype": "virus", - "log.pa_threatid": "Synthetic malware(12345)", - "log.thr_category": "malware", + "log.paSubtype": "virus", + "log.paThreatid": "Synthetic malware(12345)", + "log.thrCategory": "malware", "actionResult": "denied" }, "matches": [ @@ -1299,9 +1299,9 @@ "dataSource": "synthetic-collector", "raw": "CEF:0|Palo Alto Networks|PAN-OS|10.0|Synthetic malware(12345)|THREAT|8|deviceExternalId=SYNTH-FW cs3Label=Virtual System cs3=vsys1 src=192.0.2.25 dst=198.51.100.40 cat=virus act=drop flexString2Label=Direction flexString2=server-to-client panOSThreatCategory=malware", "expected": { - "log.pa_subtype": "virus", - "log.pa_threatid": "Synthetic malware(12345)", - "log.thr_category": "malware", + "log.paSubtype": "virus", + "log.paThreatid": "Synthetic malware(12345)", + "log.thrCategory": "malware", "actionResult": "denied" }, "matches": [ @@ -1392,8 +1392,8 @@ "dataSource": "synthetic-collector", "raw": "CEF:0|Palo Alto Networks|PAN-OS|10.0|url|THREAT|5|deviceExternalId=SYNTH-FW cs3Label=Virtual System cs3=vsys1 src=192.0.2.25 dst=198.51.100.40 cat=URL Filtering(9999) cs2Label=URL Category cs2=phishing act=block-url request=phishing.example/login", "expected": { - "log.pa_subtype": "url", - "log.pa_threatid": "URL Filtering(9999)", + "log.paSubtype": "url", + "log.paThreatid": "URL Filtering(9999)", "log.misc": "phishing.example/login" }, "matches": [ @@ -1432,7 +1432,7 @@ "dataSource": "synthetic-collector", "raw": "CEF:0|Palo Alto Networks|PAN-OS|10.0|Flood(8501)|THREAT|5|deviceExternalId=SYNTH-FW cs3Label=Virtual System cs3=vsys1 src=192.0.2.25 cat=flood act=allow", "expected": { - "log.pa_subtype": "flood" + "log.paSubtype": "flood" }, "matches": [], "absent": [ @@ -1476,7 +1476,7 @@ "expected": {}, "matches": [], "absent": [ - "log.pa_type", + "log.paType", "origin.ip", "target.ip", "actionResult", @@ -1491,7 +1491,7 @@ "expected": {}, "matches": [], "absent": [ - "log.pa_type", + "log.paType", "origin.ip", "actionResult" ], @@ -1504,7 +1504,7 @@ "expected": {}, "matches": [], "absent": [ - "log.pa_type", + "log.paType", "origin.ip", "actionResult" ], @@ -1518,7 +1518,7 @@ "origin.host": "client.example", "target.host": "server.example", "deviceTime": "2026-09-17T12:00:00.000-04:00", - "log.http_headers": "request,header=\"test\"", + "log.httpHeaders": "request,header=\"test\"", "origin.mac": "00:11:22:33:44:55", "target.mac": "aa:bb:cc:dd:ee:ff", "log.paURLLegacyTail1": "synthetic-unknown-tail-a", @@ -1540,8 +1540,8 @@ }, "absent": [ "statusCode", - "log.flow_type", - "log.cluster_name" + "log.flowType", + "log.clusterName" ] }, { @@ -1552,14 +1552,14 @@ "origin.host": "client.example", "target.host": "server.example", "deviceTime": "2026-09-17T12:00:00.000-04:00", - "log.http_headers": "request,header=\"test\"", + "log.httpHeaders": "request,header=\"test\"", "origin.mac": "00:11:22:33:44:55", "target.mac": "aa:bb:cc:dd:ee:ff", "statusCode": 403, - "log.response_headers": "HTTP/1.1 403 Forbidden", - "log.cloud_reportid": "synthetic-cloud-report", - "log.cluster_name": "synthetic-cluster", - "log.flow_type": "synthetic-flow" + "log.responseHeaders": "HTTP/1.1 403 Forbidden", + "log.cloudReportid": "synthetic-cloud-report", + "log.clusterName": "synthetic-cluster", + "log.flowType": "synthetic-flow" }, "matches": [ "panos_url_filtering_blocks", @@ -1620,7 +1620,7 @@ "dataSource": "synthetic-collector", "raw": "<14>Sep 17 12:00:00 synthetic-fw 1,2026/09/17 12:00:00,SYNTH-FW,THREAT,spyware,2817,2026/09/17 12:00:00,192.0.2.25,198.51.100.40,203.0.113.25,203.0.113.40,test-rule,testuser,server-user,web-browsing,vsys1,,,,,,,,,45678,443,,,,tcp,alert,example.test/download.exe,DNS signature,any,medium,client-to-server,,,,,,,,aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa,public-cloud,,,,,,,,,,,,,,,synthetic-fw,,,,,,,,,,dns-ddns,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,", "expected": { - "log.thr_category": "dns-ddns" + "log.thrCategory": "dns-ddns" }, "matches": [], "absent": [ @@ -1634,7 +1634,7 @@ "dataSource": "synthetic-collector", "raw": "<14>Sep 17 12:00:00 synthetic-fw 1,2026/09/17 12:00:00,SYNTH-FW,THREAT,spyware,2817,2026/09/17 12:00:00,192.0.2.25,198.51.100.40,203.0.113.25,203.0.113.40,test-rule,testuser,server-user,web-browsing,vsys1,,,,,,,,,45678,443,,,,tcp,alert,example.test/download.exe,DNS signature,any,medium,client-to-server,,,,,,,,aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa,public-cloud,,,,,,,,,,,,,,,synthetic-fw,,,,,,,,,,dns-parked,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,", "expected": { - "log.thr_category": "dns-parked" + "log.thrCategory": "dns-parked" }, "matches": [], "absent": [ @@ -1648,7 +1648,7 @@ "dataSource": "synthetic-collector", "raw": "<14>Sep 17 12:00:00 synthetic-fw 1,2026/09/17 12:00:00,SYNTH-FW,THREAT,spyware,2817,2026/09/17 12:00:00,192.0.2.25,198.51.100.40,203.0.113.25,203.0.113.40,test-rule,testuser,server-user,web-browsing,vsys1,,,,,,,,,45678,443,,,,tcp,alert,example.test/download.exe,DNS signature,any,medium,client-to-server,,,,,,,,aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa,public-cloud,,,,,,,,,,,,,,,synthetic-fw,,,,,,,,,,dns-grayware,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,", "expected": { - "log.thr_category": "dns-grayware" + "log.thrCategory": "dns-grayware" }, "matches": [], "absent": [ @@ -1672,8 +1672,8 @@ "origin.bytesReceived": 100, "origin.packagesSent": "8", "origin.packagesReceived": "4", - "log.vsys_name": "virtual-system-name", - "log.device_name": "synthetic-fw", + "log.vsysName": "virtual-system-name", + "log.deviceName": "synthetic-fw", "origin.host": "client.example", "target.host": "server.example", "actionResult": "success", @@ -1755,7 +1755,7 @@ "actionResult", "target.host", "deviceTime", - "log.device_name", + "log.deviceName", "log.paConfigLayout" ], "alertSides": {} @@ -1808,18 +1808,18 @@ "origin.bytesReceived": 100, "origin.packagesSent": "8", "origin.packagesReceived": "4", - "log.vsys_name": "virtual-system-name", - "log.device_name": "synthetic-fw", + "log.vsysName": "virtual-system-name", + "log.deviceName": "synthetic-fw", "origin.host": "client.example", "target.host": "server.example", "origin.mac": "00:11:22:33:44:55", "target.mac": "aa:bb:cc:dd:ee:ff", "actionResult": "success", "log.natsrc": "203.0.113.25", - "log.flow_type": "NonProxy", - "log.cluster_name": "synthetic-cluster", - "log.src_adv_devid": "synthetic-src-device", - "log.dst_adv_devid": "synthetic-dst-device" + "log.flowType": "NonProxy", + "log.clusterName": "synthetic-cluster", + "log.srcAdvDevid": "synthetic-src-device", + "log.dstAdvDevid": "synthetic-dst-device" }, "matches": [], "absent": [ @@ -1853,8 +1853,8 @@ "dataSource": "synthetic-collector", "raw": "CEF:0|Palo Alto Networks|PAN-OS|10.0|url|THREAT|5|deviceExternalId=SYNTH-FW cs3Label=Virtual System cs3=vsys1 src=192.0.2.25 dst=198.51.100.40 cat=URL Filtering(9999) cs2Label=URL Category cs2=phishing act=block-url request=https://phishing.example/login", "expected": { - "log.pa_subtype": "url", - "log.pa_threatid": "URL Filtering(9999)", + "log.paSubtype": "url", + "log.paThreatid": "URL Filtering(9999)", "log.misc": "https://phishing.example/login", "target.url": "https://phishing.example/login" }, @@ -1986,13 +1986,13 @@ "origin.host": "client.example", "target.host": "server.example", "deviceTime": "2026-09-17T12:00:00.000-04:00", - "log.http_headers": "request,header=\"test\"", + "log.httpHeaders": "request,header=\"test\"", "origin.mac": "00:11:22:33:44:55", "target.mac": "aa:bb:cc:dd:ee:ff", - "log.cloud_reportid": "synthetic-cloud-report", - "log.cluster_name": "synthetic-cluster", - "log.flow_type": "synthetic-flow", - "log.pa_subtype": "data", + "log.cloudReportid": "synthetic-cloud-report", + "log.clusterName": "synthetic-cluster", + "log.flowType": "synthetic-flow", + "log.paSubtype": "data", "severity": "info" }, "matches": [], @@ -2011,13 +2011,13 @@ "origin.host": "client.example", "target.host": "server.example", "deviceTime": "2026-09-17T12:00:00.000-04:00", - "log.http_headers": "request,header=\"test\"", + "log.httpHeaders": "request,header=\"test\"", "origin.mac": "00:11:22:33:44:55", "target.mac": "aa:bb:cc:dd:ee:ff", - "log.cloud_reportid": "synthetic-cloud-report", - "log.cluster_name": "synthetic-cluster", - "log.flow_type": "synthetic-flow", - "log.pa_subtype": "dlp", + "log.cloudReportid": "synthetic-cloud-report", + "log.clusterName": "synthetic-cluster", + "log.flowType": "synthetic-flow", + "log.paSubtype": "dlp", "severity": "info" }, "matches": [], @@ -2036,13 +2036,13 @@ "origin.host": "client.example", "target.host": "server.example", "deviceTime": "2026-09-17T12:00:00.000-04:00", - "log.http_headers": "request,header=\"test\"", + "log.httpHeaders": "request,header=\"test\"", "origin.mac": "00:11:22:33:44:55", "target.mac": "aa:bb:cc:dd:ee:ff", - "log.cloud_reportid": "synthetic-cloud-report", - "log.cluster_name": "synthetic-cluster", - "log.flow_type": "synthetic-flow", - "log.pa_subtype": "dlp-non-file", + "log.cloudReportid": "synthetic-cloud-report", + "log.clusterName": "synthetic-cluster", + "log.flowType": "synthetic-flow", + "log.paSubtype": "dlp-non-file", "severity": "info" }, "matches": [], @@ -2061,13 +2061,13 @@ "origin.host": "client.example", "target.host": "server.example", "deviceTime": "2026-09-17T12:00:00.000-04:00", - "log.http_headers": "request,header=\"test\"", + "log.httpHeaders": "request,header=\"test\"", "origin.mac": "00:11:22:33:44:55", "target.mac": "aa:bb:cc:dd:ee:ff", - "log.cloud_reportid": "synthetic-cloud-report", - "log.cluster_name": "synthetic-cluster", - "log.flow_type": "synthetic-flow", - "log.pa_subtype": "file", + "log.cloudReportid": "synthetic-cloud-report", + "log.clusterName": "synthetic-cluster", + "log.flowType": "synthetic-flow", + "log.paSubtype": "file", "severity": "info" }, "matches": [], @@ -2086,13 +2086,13 @@ "origin.host": "client.example", "target.host": "server.example", "deviceTime": "2026-09-17T12:00:00.000-04:00", - "log.http_headers": "request,header=\"test\"", + "log.httpHeaders": "request,header=\"test\"", "origin.mac": "00:11:22:33:44:55", "target.mac": "aa:bb:cc:dd:ee:ff", - "log.cloud_reportid": "synthetic-cloud-report", - "log.cluster_name": "synthetic-cluster", - "log.flow_type": "synthetic-flow", - "log.pa_subtype": "spyware", + "log.cloudReportid": "synthetic-cloud-report", + "log.clusterName": "synthetic-cluster", + "log.flowType": "synthetic-flow", + "log.paSubtype": "spyware", "severity": "info" }, "matches": [], diff --git a/rules/paloalto/pa_firewall/ioc_threat_intel_match.yml b/rules/paloalto/pa_firewall/ioc_threat_intel_match.yml index 9fbbe93cb..7fb8a22e2 100644 --- a/rules/paloalto/pa_firewall/ioc_threat_intel_match.yml +++ b/rules/paloalto/pa_firewall/ioc_threat_intel_match.yml @@ -17,8 +17,8 @@ description: Detects a blocked PAN-OS threat categorized as malware, command-and session endpoints and attack direction; a blocked event does not establish compromise. For URL-category events, the requested remote resource is the adversary; the request direction does not make the requesting client the malicious resource. -where: equals("log.pa_type", "THREAT") && oneOf("log.thr_category", ["malware", "command-and-control", "phishing", - "botnet"]) && equals("actionResult", "denied") && exists("origin.ip") && exists("target.ip") && !equals("log.pa_subtype", +where: equals("log.paType", "THREAT") && oneOf("log.thrCategory", ["malware", "command-and-control", "phishing", + "botnet"]) && equals("actionResult", "denied") && exists("origin.ip") && exists("target.ip") && !equals("log.paSubtype", "url") && equals("log.paDirection", "client-to-server") groupBy: - lastEvent.dataSource @@ -26,4 +26,4 @@ groupBy: - lastEvent.log.paVsys - adversary.ip - target.ip -- lastEvent.log.pa_threatid +- lastEvent.log.paThreatid diff --git a/rules/paloalto/pa_firewall/ioc_threat_intel_match_server_to_client.yml b/rules/paloalto/pa_firewall/ioc_threat_intel_match_server_to_client.yml index 9c38c0527..50429094c 100644 --- a/rules/paloalto/pa_firewall/ioc_threat_intel_match_server_to_client.yml +++ b/rules/paloalto/pa_firewall/ioc_threat_intel_match_server_to_client.yml @@ -17,8 +17,8 @@ description: Detects a blocked PAN-OS threat categorized as malware, command-and session endpoints and attack direction; a blocked event does not establish compromise. For URL-category events, the requested remote resource is the adversary; the request direction does not make the requesting client the malicious resource. -where: equals("log.pa_type", "THREAT") && oneOf("log.thr_category", ["malware", "command-and-control", "phishing", - "botnet"]) && equals("actionResult", "denied") && exists("origin.ip") && exists("target.ip") && (equals("log.pa_subtype", +where: equals("log.paType", "THREAT") && oneOf("log.thrCategory", ["malware", "command-and-control", "phishing", + "botnet"]) && equals("actionResult", "denied") && exists("origin.ip") && exists("target.ip") && (equals("log.paSubtype", "url") || equals("log.paDirection", "server-to-client")) groupBy: - lastEvent.dataSource @@ -26,4 +26,4 @@ groupBy: - lastEvent.log.paVsys - adversary.ip - target.ip -- lastEvent.log.pa_threatid +- lastEvent.log.paThreatid diff --git a/rules/paloalto/pa_firewall/panos_admin_brute_force.yml b/rules/paloalto/pa_firewall/panos_admin_brute_force.yml index 8d84c72fe..8444ede01 100644 --- a/rules/paloalto/pa_firewall/panos_admin_brute_force.yml +++ b/rules/paloalto/pa_firewall/panos_admin_brute_force.yml @@ -17,7 +17,7 @@ description: Detects ten SYSTEM auth-fail events from the same observed source, system within fifteen minutes. The event can come from different authentication services; it does not by itself prove a management-plane login. Check the authentication profile, requested user and any subsequent successes before treating the sequence as an attack. -where: equals("log.pa_type", "SYSTEM") && equals("log.eventid", "auth-fail") && equals("actionResult", "failure") +where: equals("log.paType", "SYSTEM") && equals("log.eventid", "auth-fail") && equals("actionResult", "failure") && exists("origin.ip") && exists("dataSource") && !equals("dataSource", "") && exists("log.paScope") && exists("log.paVsys") groupBy: - lastEvent.dataSource diff --git a/rules/paloalto/pa_firewall/panos_dns_security_alerts.yml b/rules/paloalto/pa_firewall/panos_dns_security_alerts.yml index 4bbf7e5a6..a408b3d89 100644 --- a/rules/paloalto/pa_firewall/panos_dns_security_alerts.yml +++ b/rules/paloalto/pa_firewall/panos_dns_security_alerts.yml @@ -17,8 +17,8 @@ description: Detects three relevant DNS security events from the same observed s system within thirty minutes. Supports the legacy dns subtype and spyware sinkhole or dns-c2/dns-malware category events. A source can be a forwarding resolver rather than the original endpoint. Trace the DNS request and vendor action before attributing compromise; an alert action does not prove a successful connection. -where: equals("log.pa_type", "THREAT") && (equals("log.pa_subtype", "dns") || (equals("log.pa_subtype", "spyware") - && (equals("action", "sinkhole") || oneOf("log.thr_category", ["dns-c2", "dns-malware"])))) && oneOf("action", +where: equals("log.paType", "THREAT") && (equals("log.paSubtype", "dns") || (equals("log.paSubtype", "spyware") + && (equals("action", "sinkhole") || oneOf("log.thrCategory", ["dns-c2", "dns-malware"])))) && oneOf("action", ["sinkhole", "block-url", "alert", "drop", "reset-both", "reset-client", "reset-server", "block-ip"]) && exists("origin.ip") && exists("dataSource") && !equals("dataSource", "") && exists("log.paScope") && exists("log.paVsys") groupBy: diff --git a/rules/paloalto/pa_firewall/panos_spyware_vulnerability.yml b/rules/paloalto/pa_firewall/panos_spyware_vulnerability.yml index 13a567330..45726b229 100644 --- a/rules/paloalto/pa_firewall/panos_spyware_vulnerability.yml +++ b/rules/paloalto/pa_firewall/panos_spyware_vulnerability.yml @@ -16,7 +16,7 @@ description: Detects a high or critical PAN-OS spyware or vulnerability signatur successful exploitation, a public-facing target, or a particular technique. Review the threat ID, action and attack direction. Session source and destination retain their physical roles; the rule uses the documented attack direction to select the alert adversary. -where: equals("log.pa_type", "THREAT") && oneOf("log.pa_subtype", ["spyware", "vulnerability"]) && oneOf("log.severityLabel", +where: equals("log.paType", "THREAT") && oneOf("log.paSubtype", ["spyware", "vulnerability"]) && oneOf("log.severityLabel", ["high", "critical"]) && exists("origin.ip") && exists("target.ip") && equals("log.paDirection", "client-to-server") groupBy: - lastEvent.dataSource @@ -24,4 +24,4 @@ groupBy: - lastEvent.log.paVsys - adversary.ip - target.ip -- lastEvent.log.pa_threatid +- lastEvent.log.paThreatid diff --git a/rules/paloalto/pa_firewall/panos_spyware_vulnerability_server_to_client.yml b/rules/paloalto/pa_firewall/panos_spyware_vulnerability_server_to_client.yml index 7e8e93565..ec6c4b52b 100644 --- a/rules/paloalto/pa_firewall/panos_spyware_vulnerability_server_to_client.yml +++ b/rules/paloalto/pa_firewall/panos_spyware_vulnerability_server_to_client.yml @@ -16,7 +16,7 @@ description: Detects a high or critical PAN-OS spyware or vulnerability signatur successful exploitation, a public-facing target, or a particular technique. Review the threat ID, action and attack direction. Session source and destination retain their physical roles; the rule uses the documented attack direction to select the alert adversary. -where: equals("log.pa_type", "THREAT") && oneOf("log.pa_subtype", ["spyware", "vulnerability"]) && oneOf("log.severityLabel", +where: equals("log.paType", "THREAT") && oneOf("log.paSubtype", ["spyware", "vulnerability"]) && oneOf("log.severityLabel", ["high", "critical"]) && exists("origin.ip") && exists("target.ip") && equals("log.paDirection", "server-to-client") groupBy: - lastEvent.dataSource @@ -24,4 +24,4 @@ groupBy: - lastEvent.log.paVsys - adversary.ip - target.ip -- lastEvent.log.pa_threatid +- lastEvent.log.paThreatid diff --git a/rules/paloalto/pa_firewall/panos_url_filtering_blocks.yml b/rules/paloalto/pa_firewall/panos_url_filtering_blocks.yml index 0b9cc7adb..2ff7de7ed 100644 --- a/rules/paloalto/pa_firewall/panos_url_filtering_blocks.yml +++ b/rules/paloalto/pa_firewall/panos_url_filtering_blocks.yml @@ -18,7 +18,7 @@ description: Detects five URL events in the configured malware, phishing, comman malware, and requesting a URL does not prove execution or compromise. The requested remote resource is the alert adversary; the requesting client is its target. Inspect the URL and action; a later continue/override is a separate event. -where: equals("log.pa_type", "THREAT") && equals("log.pa_subtype", "url") && oneOf("action", ["block-url", "block-page", +where: equals("log.paType", "THREAT") && equals("log.paSubtype", "url") && oneOf("action", ["block-url", "block-page", "block-continue", "block-override", "alert"]) && oneOf("log.category", ["malware", "phishing", "command-and-control", "grayware", "hacking"]) && exists("origin.ip") && exists("dataSource") && !equals("dataSource", "") && exists("log.paScope") && exists("log.paVsys") diff --git a/rules/paloalto/pa_firewall/wildfire_malware_detection.yml b/rules/paloalto/pa_firewall/wildfire_malware_detection.yml index 2986556a7..b3d6c2bfd 100644 --- a/rules/paloalto/pa_firewall/wildfire_malware_detection.yml +++ b/rules/paloalto/pa_firewall/wildfire_malware_detection.yml @@ -16,7 +16,7 @@ description: Detects a high or critical WildFire submission with the explicit ma is analysis of a submitted file; it does not prove file execution. Inspect the hash, action and endpoint evidence. The block action indicates a blocked file; alert alone does not establish prevention. Benign, grayware and phishing verdicts are not mislabeled as malware by this rule. -where: equals("log.pa_type", "THREAT") && equals("log.pa_subtype", "wildfire") && equals("log.category", "malware") +where: equals("log.paType", "THREAT") && equals("log.paSubtype", "wildfire") && equals("log.category", "malware") && oneOf("log.severityLabel", ["high", "critical"]) && oneOf("action", ["alert", "block", "deny"]) && exists("origin.ip") && exists("target.ip") && equals("log.paDirection", "client-to-server") groupBy: @@ -25,4 +25,4 @@ groupBy: - lastEvent.log.paVsys - adversary.ip - target.ip -- lastEvent.log.pa_threatid +- lastEvent.log.paThreatid diff --git a/rules/paloalto/pa_firewall/wildfire_malware_detection_server_to_client.yml b/rules/paloalto/pa_firewall/wildfire_malware_detection_server_to_client.yml index 5cc32dab7..d4db09b5c 100644 --- a/rules/paloalto/pa_firewall/wildfire_malware_detection_server_to_client.yml +++ b/rules/paloalto/pa_firewall/wildfire_malware_detection_server_to_client.yml @@ -16,7 +16,7 @@ description: Detects a high or critical WildFire submission with the explicit ma is analysis of a submitted file; it does not prove file execution. Inspect the hash, action and endpoint evidence. The block action indicates a blocked file; alert alone does not establish prevention. Benign, grayware and phishing verdicts are not mislabeled as malware by this rule. -where: equals("log.pa_type", "THREAT") && equals("log.pa_subtype", "wildfire") && equals("log.category", "malware") +where: equals("log.paType", "THREAT") && equals("log.paSubtype", "wildfire") && equals("log.category", "malware") && oneOf("log.severityLabel", ["high", "critical"]) && oneOf("action", ["alert", "block", "deny"]) && exists("origin.ip") && exists("target.ip") && equals("log.paDirection", "server-to-client") groupBy: @@ -25,4 +25,4 @@ groupBy: - lastEvent.log.paVsys - adversary.ip - target.ip -- lastEvent.log.pa_threatid +- lastEvent.log.paThreatid diff --git a/rules/paloalto/pa_firewall/zero_day_exploit_prevention.yml b/rules/paloalto/pa_firewall/zero_day_exploit_prevention.yml index f91185bef..6a2d611b1 100644 --- a/rules/paloalto/pa_firewall/zero_day_exploit_prevention.yml +++ b/rules/paloalto/pa_firewall/zero_day_exploit_prevention.yml @@ -17,8 +17,8 @@ description: Detects two high or critical vulnerability/exploit detections carry Neither a known CVE nor an unknown category establishes a zero-day. The vendor action determines whether traffic was blocked; this sequence does not prove successful exploitation. Inspect the signature and target exposure. The single-event spyware/vulnerability rule can also match these events. -where: equals("log.pa_type", "THREAT") && oneOf("log.pa_subtype", ["vulnerability", "exploit"]) && oneOf("log.severityLabel", - ["high", "critical"]) && (contains("log.pa_threatid", "CVE") || equals("log.category", "unknown")) && exists("target.ip") +where: equals("log.paType", "THREAT") && oneOf("log.paSubtype", ["vulnerability", "exploit"]) && oneOf("log.severityLabel", + ["high", "critical"]) && (contains("log.paThreatid", "CVE") || equals("log.category", "unknown")) && exists("target.ip") && exists("origin.ip") && exists("dataSource") && !equals("dataSource", "") && exists("log.paScope") && exists("log.paVsys") && equals("log.paDirection", "client-to-server") groupBy: @@ -27,7 +27,7 @@ groupBy: - lastEvent.log.paVsys - adversary.ip - target.ip -- lastEvent.log.pa_threatid +- lastEvent.log.paThreatid afterEvents: - indexPattern: v11-log-firewall-paloalto-* with: diff --git a/rules/paloalto/pa_firewall/zero_day_exploit_prevention_server_to_client.yml b/rules/paloalto/pa_firewall/zero_day_exploit_prevention_server_to_client.yml index 0ce523b05..e76d3126d 100644 --- a/rules/paloalto/pa_firewall/zero_day_exploit_prevention_server_to_client.yml +++ b/rules/paloalto/pa_firewall/zero_day_exploit_prevention_server_to_client.yml @@ -17,8 +17,8 @@ description: Detects two high or critical vulnerability/exploit detections carry Neither a known CVE nor an unknown category establishes a zero-day. The vendor action determines whether traffic was blocked; this sequence does not prove successful exploitation. Inspect the signature and target exposure. The single-event spyware/vulnerability rule can also match these events. -where: equals("log.pa_type", "THREAT") && oneOf("log.pa_subtype", ["vulnerability", "exploit"]) && oneOf("log.severityLabel", - ["high", "critical"]) && (contains("log.pa_threatid", "CVE") || equals("log.category", "unknown")) && exists("target.ip") +where: equals("log.paType", "THREAT") && oneOf("log.paSubtype", ["vulnerability", "exploit"]) && oneOf("log.severityLabel", + ["high", "critical"]) && (contains("log.paThreatid", "CVE") || equals("log.category", "unknown")) && exists("target.ip") && exists("origin.ip") && exists("dataSource") && !equals("dataSource", "") && exists("log.paScope") && exists("log.paVsys") && equals("log.paDirection", "server-to-client") groupBy: @@ -27,7 +27,7 @@ groupBy: - lastEvent.log.paVsys - adversary.ip - target.ip -- lastEvent.log.pa_threatid +- lastEvent.log.paThreatid afterEvents: - indexPattern: v11-log-firewall-paloalto-* with: From 3a8f11d7b049f23f877badca92d4bec30d4c3f4f Mon Sep 17 00:00:00 2001 From: Ricardo Valdes Date: Thu, 24 Sep 2026 17:05:25 -0400 Subject: [PATCH 4/9] test(paloalto): describe the go-sdk v1.1.36 field-name sanitizer Since go-sdk v1.1.35 utils.SanitizeField keeps underscores, and v11 now pins v1.1.36. The test comment still said the sanitizer keeps only letters, digits and dots. The model already calls the linked SDK sanitizer, so no behaviour changes; this draft's camelCase names are stored unchanged by every SDK version. Co-Authored-By: Claude Opus 5.5 --- plugins/alerts/paloalto_contract_test.go | 9 +++++---- 1 file changed, 5 insertions(+), 4 deletions(-) diff --git a/plugins/alerts/paloalto_contract_test.go b/plugins/alerts/paloalto_contract_test.go index 35e68356d..a88ce4dee 100644 --- a/plugins/alerts/paloalto_contract_test.go +++ b/plugins/alerts/paloalto_contract_test.go @@ -74,10 +74,11 @@ func paloaltoGet(m map[string]any, p string) (any, bool) { // paloaltoWriteName returns the name the EventProcessor parser plugins actually // write: grok, add, rename, csv, kv and json pass it through go-sdk -// utils.SanitizeField, which keeps only letters, digits and dots, and reject a -// reserved name. Conditions and rules look names up as written, so a filter that -// writes "log.pa_type" and tests "log.pa_type" never matches in production and -// must not match here either. +// utils.SanitizeField and reject a reserved name. Since go-sdk v1.1.35 the +// sanitizer keeps letters, digits, dots and underscores and removes every other +// character (earlier versions also removed underscores). Conditions and rules look +// names up as written, so a filter that writes "log.pa-type" and tests +// "log.pa-type" never matches in production and must not match here either. func paloaltoWriteName(t *testing.T, name string, allowEmpty bool) string { t.Helper() utils.SanitizeField(&name) From 53169ec8af7c11e0e723b9b0717e69f6e7153779 Mon Sep 17 00:00:00 2001 From: Ricardo Valdes Date: Thu, 24 Sep 2026 17:05:25 -0400 Subject: [PATCH 5/9] docs(paloalto): record re-validation on the latest v11, go-sdk and engine Official v11 d2479c1a (go-sdk v1.1.36 in plugins/alerts) and EventProcessor main 8a3ade7, the revision in the newest published engine image. The camelCase names need no change. Full plugins/alerts suite: 46 pass, 12 skip, 0 fail; with the 34 private records 47 pass, 11 skip. The committed 122 fabricated lines through the latest playground show a gap the offline model does not reproduce: 75 native CSV lines stop at the csv plugin because the layouts list more headers than the lines have columns, and 31 error-free lines miss expected fields; the same happens on the older engine, so it is not an SDK change and is recorded for a separate correction. Co-Authored-By: Claude Opus 5.5 --- filters/audits/paloalto.md | 69 ++++++++++++++++++++++++++++++++------ 1 file changed, 59 insertions(+), 10 deletions(-) diff --git a/filters/audits/paloalto.md b/filters/audits/paloalto.md index cda12564a..e95d1ef0e 100644 --- a/filters/audits/paloalto.md +++ b/filters/audits/paloalto.md @@ -1,9 +1,11 @@ # Palo Alto PAN-OS filter and correlation review -Replacement for historical #2614. The standard is the v11-pinned ThreatWinds go-sdk -v1.1.33 protobuf and its official wiki. This proposal changes the PAN-OS filter and -all seven existing detection definitions together; four direction-specific counterparts -bring the resulting rule set to eleven. Existing impact ratings and thresholds are retained. +Replacement for historical #2614. The standard is the ThreatWinds go-sdk protobuf that v11 +pins, v1.1.36 since official `v11` (`d2479c1a`) was merged into this branch (the review used +v1.1.33, whose `plugins.proto` is identical), and its official wiki. This proposal changes +the PAN-OS filter and all seven existing detection definitions together; four +direction-specific counterparts bring the resulting rule set to eleven. Existing impact +ratings and thresholds are retained. ## Parsing and standard fields @@ -71,6 +73,48 @@ bring the resulting rule set to eleven. Existing impact ratings and thresholds a virtual system; vulnerability also retains both endpoints and direction. Successful or unrelated activity cannot satisfy the counts. Clear input-supplied candidates and scope. +## Re-validation on the latest versions + +On 2026-09-24 official `v11` moved to `d2479c1a3705eec6a00016689c2bf5fbcc1814f2`, whose +`plugins/alerts` pins go-sdk v1.1.36, and EventProcessor `main` moved to +`8a3ade72bd9d12db21f6b273200588fb49540f14`, whose playground and parser, writer and CEL +plugins all link go-sdk v1.1.36. `v11` was merged into this branch; no file overlaps this +draft, so nothing conflicted. The newest published engine image, +`ghcr.io/utmstack/utmstack/eventprocessor:v11.2.14` (built 2026-09-24 19:13 UTC on base image +`eventprocessor/base:1.1.7`), embeds Go build information showing that its playground and +plugin binaries come from the same revision `8a3ade7` with go-sdk v1.1.36, built with +go1.26.8 for linux/amd64. The local build used here is that source revision compiled +natively for darwin/arm64 with go1.25.7; only the Go toolchain and platform differ. Its +`csv` plugin was built from the same clean source. + +What changed in the SDK, and what it means here: + +- Since v1.1.35, `utils.SanitizeField` keeps `_` in the field names that the `json` + (top-level keys), `kv`, `grok`, `csv`, `xml`, `add` and `rename` plugins write; other + characters are still removed. This filter writes its 784 names, including 368 CSV + headers, in camelCase with letters and digits only (for example `log.paType`), so every + version stores them unchanged and the conditions and rules find them. No name needed a + change. +- v1.1.36 makes `regexMatch` match string values only again. Every `regexMatch` in this + filter reads a text field written by `grok` or `csv`, so no result changes. + `plugins.proto`, `plugins/cel.go` and `plugins/rules.go` are identical in v1.1.33 and + v1.1.36. +- The only file changed for the new SDK is a test comment that still said the sanitizer + removes underscores. + +| Check on the latest versions | Result | +|---|---| +| Full `plugins/alerts` suite, go-sdk v1.1.36 | 46 tests pass, 12 skip, none fail. The skipped tests need private evidence (the 11 of other technologies and this draft's private records). | +| The 34 private records, same suite | 34 of 34 pass once their expected field names are written as the camelCase names this draft now uses; the private expectation file predates that rename. With them the suite gives 47 passes, 11 skips and no failures (2,418 passing results with subtests). | +| The 122 committed fabricated lines through the EventProcessor `8a3ade7` playground, with the filter and the eleven rules as committed | 122 events, but 75 carry the `csv` plugin error `number of headers should match the number of resulting columns`: all 28 TRAFFIC and 36 THREAT lines and 11 lines of other CSV types. The real plugin stops the pipeline when a line has fewer columns than the layout's headers (the TRAFFIC layout lists 130; the TRAFFIC line has 102), so those events keep only the envelope fields. The offline model skips missing columns instead. Of the 47 lines without errors, 16 carry every expected field and 31 do not (20 CEF, 8 SYSTEM and 3 others); for example, SYSTEM authentication lines lack `origin.ip` and `origin.user`, because the real `grok` plugin matches each pattern from the start of the remaining text, while the model searches the whole text with one expression. The same 120 lines present in an earlier run on EventProcessor `497bf53` gave identical events, so the SDK change did not cause this. | +| go-sdk v1.1.36 rule replay over those playground events | 2 of the 38 expected rule matches. On every event that carries its expected fields, each rule gives exactly its expected result and history placeholders resolve; the misses all come from the missing fields. | + +So the committed Go suite passes, but the real parser plugins do not yet produce what it +expects for most native CSV lines, most CEF lines and part of the SYSTEM lines. This is +not a v1.1.36 change and is left to a separate correction of the CSV layouts, the SYSTEM +authentication extraction and the offline model; the rules cannot be relied on for native +CSV traffic until then. + ## Validation and rollout limits The committed suite has **122 fabricated raw fixtures**, positive/negative assertions for all @@ -78,7 +122,8 @@ The committed suite has **122 fabricated raw fixtures**, positive/negative asser real SDK history-request tests** against loopback mocks. History tests cover below/at threshold, expiration, irrelevant/unmarked events, wrong identities and unresolved required placeholders. The manifest also validates schema/conditions with the shared contract runner. These checks -use the SDK **v1.1.33** pinned by the reviewed v11 snapshot. +first used the SDK **v1.1.33** pinned by the reviewed v11 snapshot and now pass with +**v1.1.36** (see above). Read-only sampling on 23 September 2026 also retrieved **34 distinct stored records** and the mounted filter/rules from two deployments. Twenty-two are native SYSTEM records: nine @@ -97,13 +142,15 @@ regressions, not those SYSTEM samples. The legacy LEEF-labelled dialect has comp only; neither it nor standard LEEF has vendor-semantic validation here. Ambiguous CEF counters/severity remain unpromoted. -Raw extraction uses an explicitly declared offline YAML/Go CSV model. It is not execution of the -closed EventProcessor, geolocation service or live alert creation. Native replay and deployment +Raw extraction in the Go suite uses an explicitly declared offline YAML/Go CSV model. It is not +execution of the EventProcessor, geolocation service or live alert creation; the playground run +above shows where it and the real parser plugins differ. Native replay and deployment identity evidence are maintained separately; no customer records or identifying metadata are committed. No production alert-volume result is asserted. -Before rollout, exercise the closed parser with the actual appliance export profiles, measure -throughput, and verify the resulting indexed fields and alerts. In particular: +Before rollout, correct the parser differences described above, exercise the parser with the +actual appliance export profiles, measure throughput, and verify the resulting indexed fields +and alerts. In particular: - Palo Alto publishes no supported CEF guidance after PAN-OS 10.0. Its guide gives a numeric 0–10 importance scale but no exact mapping to PAN-OS textual severity bins. Numeric-only CEF @@ -131,7 +178,9 @@ throughput, and verify the resulting indexed fields and alerts. In particular: ## References -- [SDK protobuf, pinned v1.1.33](https://github.com/threatwinds/go-sdk/blob/v1.1.33/plugins/plugins.proto) +- [SDK protobuf, pinned v1.1.36](https://github.com/threatwinds/go-sdk/blob/v1.1.36/plugins/plugins.proto) (identical to v1.1.33) +- [SDK field-name sanitizer, v1.1.36](https://github.com/threatwinds/go-sdk/blob/v1.1.36/utils/fields.go) +- [EventProcessor csv plugin at 8a3ade7](https://github.com/utmstack/EventProcessor/blob/8a3ade72bd9d12db21f6b273200588fb49540f14/plugins/csv/main.go) - [Filter step semantics](https://github.com/threatwinds/go-sdk/wiki/Filter-Steps-Reference) - [Rule evaluation and history](https://github.com/threatwinds/go-sdk/wiki/Implementing-Rules) - [PAN-OS syslog field descriptions](https://docs.paloaltonetworks.com/pan-os/11-1/pan-os-admin/monitoring/use-syslog-for-monitoring/syslog-field-descriptions) From 305566b61bf8e733b5cbf189b4795f5a3a74c417 Mon Sep 17 00:00:00 2001 From: Ricardo Valdes Date: Thu, 24 Sep 2026 18:08:33 -0400 Subject: [PATCH 6/9] fix(paloalto): parse native logs with the real EventProcessor plugins Run through the EventProcessor 8a3ade7 parser plugins, most committed lines did not parse although the Go suite passed: - csv fails the whole step when a line has fewer columns than the step has headers; each layout listed every documented column, so shorter lines (older firmware, and 75 of the 122 committed lines) kept only the envelope; - grok matches each pattern on its own, so the 613 CEF/LEEF extension steps, whose lazy value pattern relied on a separate boundary pattern, matched empty text and stored nothing; - the SYSTEM authentication address pattern also took the final period, so user and address were never set and 0 of 9 real failed logins matched the rule; - lines without were never parsed, because an optional first pattern matched empty text. Apply each CSV layout in tiers guarded by a column count that follows the csv reader, read each CEF value with its boundary and trim it once, end the address pattern at the last address character, and give lines without their own step (filter 3.1.1). The Go model now follows the 8a3ade7 plugins: grok matches pattern by pattern, csv fails on a short line, and a failed step is recorded as the engine records it. Against the previous filter it fails 104 of 122 committed lines and 12 of 34 real records; its events equal the real engine's on all 122 lines. On the real engine the corrected filter parses all 122 lines and all 34 real records with every expected field, and the go-sdk v1.1.36 replay gives exactly the 38 expected rule matches. Co-Authored-By: Claude Opus 5.5 --- filters/paloalto/pa_firewall.yml | 4147 ++++++++++++---------- plugins/alerts/paloalto_contract_test.go | 351 +- 2 files changed, 2506 insertions(+), 1992 deletions(-) diff --git a/filters/paloalto/pa_firewall.yml b/filters/paloalto/pa_firewall.yml index 22f3ff0c6..686c9999b 100644 --- a/filters/paloalto/pa_firewall.yml +++ b/filters/paloalto/pa_firewall.yml @@ -1,6 +1,6 @@ -# Palo Alto Firewall, version 3.1.0 +# Palo Alto Firewall, version 3.1.1 # Palo Alto PAN-OS CSV and documented PAN-OS 10.0 CEF templates. -# The closed EventProcessor must be exercised in staging before rollout. +# Checked with the public EventProcessor 8a3ade7 parser plugins; exercise real export profiles before rollout. # The prior seven-field LEEF-labelled compatibility dialect is retained. # Standard LEEF/custom layouts remain unverified; original raw is retained. # https://docs.paloaltonetworks.com/resources/cef @@ -46,11 +46,17 @@ pipeline: source: raw patterns: - fieldName: log.paEnvelope - pattern: ^(?:<[0-9]{1,3}>)? + pattern: ^<[0-9]{1,3}> - fieldName: log.paPayload pattern: (?:[0-9]*,[0-9]{4}/[0-9]{2}/[0-9]{2} [0-9]{2}:[0-9]{2}:[0-9]{2},[^,]*,[A-Z][A-Z0-9-]*,|(?:CEF|LEEF):[0-9]+\|Palo Alto Networks\|PAN-OS\|).*$ where: '!exists("log.paPayload")' + - grok: + source: raw + patterns: + - fieldName: log.paPayload + pattern: '(?:[0-9]*,[0-9]{4}/[0-9]{2}/[0-9]{2} [0-9]{2}:[0-9]{2}:[0-9]{2},[^,]*,[A-Z][A-Z0-9-]*,|(?:CEF|LEEF):[0-9]+\|Palo Alto Networks\|PAN-OS\|).*$' + where: '!exists("log.paPayload")' - add: function: string params: @@ -99,9 +105,7 @@ pipeline: - fieldName: log.paIgnored pattern: ^(?:[A-Za-z][A-Za-z0-9_]*=(?:\\.|[^=\\])*?[ \t]+)*?DNSSICategory= - fieldName: log.DNSSICategory - pattern: (?:\\.|[^=\\])*? - - fieldName: log.paSuffix - pattern: (?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) + pattern: (?:\\.|[^=\\])*?(?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) where: oneOf("log.paFormat", ["CEF", "LEEF-legacy"]) - grok: source: log.paCefExtensions @@ -109,9 +113,7 @@ pipeline: - fieldName: log.paIgnored pattern: ^(?:[A-Za-z][A-Za-z0-9_]*=(?:\\.|[^=\\])*?[ \t]+)*?ModuleflexString2= - fieldName: log.ModuleflexString2 - pattern: (?:\\.|[^=\\])*? - - fieldName: log.paSuffix - pattern: (?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) + pattern: (?:\\.|[^=\\])*?(?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) where: oneOf("log.paFormat", ["CEF", "LEEF-legacy"]) - grok: source: log.paCefExtensions @@ -119,9 +121,7 @@ pipeline: - fieldName: log.paIgnored pattern: ^(?:[A-Za-z][A-Za-z0-9_]*=(?:\\.|[^=\\])*?[ \t]+)*?PanASServiceDiff= - fieldName: log.PanASServiceDiff - pattern: (?:\\.|[^=\\])*? - - fieldName: log.paSuffix - pattern: (?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) + pattern: (?:\\.|[^=\\])*?(?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) where: oneOf("log.paFormat", ["CEF", "LEEF-legacy"]) - grok: source: log.paCefExtensions @@ -129,9 +129,7 @@ pipeline: - fieldName: log.paIgnored pattern: ^(?:[A-Za-z][A-Za-z0-9_]*=(?:\\.|[^=\\])*?[ \t]+)*?PanASServiceType= - fieldName: log.PanASServiceType - pattern: (?:\\.|[^=\\])*? - - fieldName: log.paSuffix - pattern: (?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) + pattern: (?:\\.|[^=\\])*?(?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) where: oneOf("log.paFormat", ["CEF", "LEEF-legacy"]) - grok: source: log.paCefExtensions @@ -139,9 +137,7 @@ pipeline: - fieldName: log.paIgnored pattern: ^(?:[A-Za-z][A-Za-z0-9_]*=(?:\\.|[^=\\])*?[ \t]+)*?PanContainerName= - fieldName: log.PanContainerName - pattern: (?:\\.|[^=\\])*? - - fieldName: log.paSuffix - pattern: (?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) + pattern: (?:\\.|[^=\\])*?(?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) where: oneOf("log.paFormat", ["CEF", "LEEF-legacy"]) - grok: source: log.paCefExtensions @@ -149,9 +145,7 @@ pipeline: - fieldName: log.paIgnored pattern: ^(?:[A-Za-z][A-Za-z0-9_]*=(?:\\.|[^=\\])*?[ \t]+)*?PanDomainEDL= - fieldName: log.PanDomainEDL - pattern: (?:\\.|[^=\\])*? - - fieldName: log.paSuffix - pattern: (?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) + pattern: (?:\\.|[^=\\])*?(?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) where: oneOf("log.paFormat", ["CEF", "LEEF-legacy"]) - grok: source: log.paCefExtensions @@ -159,9 +153,7 @@ pipeline: - fieldName: log.paIgnored pattern: ^(?:[A-Za-z][A-Za-z0-9_]*=(?:\\.|[^=\\])*?[ \t]+)*?PanDstDAG= - fieldName: log.PanDstDAG - pattern: (?:\\.|[^=\\])*? - - fieldName: log.paSuffix - pattern: (?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) + pattern: (?:\\.|[^=\\])*?(?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) where: oneOf("log.paFormat", ["CEF", "LEEF-legacy"]) - grok: source: log.paCefExtensions @@ -169,9 +161,7 @@ pipeline: - fieldName: log.paIgnored pattern: ^(?:[A-Za-z][A-Za-z0-9_]*=(?:\\.|[^=\\])*?[ \t]+)*?PanDstDeviceCat= - fieldName: log.PanDstDeviceCat - pattern: (?:\\.|[^=\\])*? - - fieldName: log.paSuffix - pattern: (?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) + pattern: (?:\\.|[^=\\])*?(?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) where: oneOf("log.paFormat", ["CEF", "LEEF-legacy"]) - grok: source: log.paCefExtensions @@ -179,9 +169,7 @@ pipeline: - fieldName: log.paIgnored pattern: ^(?:[A-Za-z][A-Za-z0-9_]*=(?:\\.|[^=\\])*?[ \t]+)*?PanDstDeviceModel= - fieldName: log.PanDstDeviceModel - pattern: (?:\\.|[^=\\])*? - - fieldName: log.paSuffix - pattern: (?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) + pattern: (?:\\.|[^=\\])*?(?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) where: oneOf("log.paFormat", ["CEF", "LEEF-legacy"]) - grok: source: log.paCefExtensions @@ -189,9 +177,7 @@ pipeline: - fieldName: log.paIgnored pattern: ^(?:[A-Za-z][A-Za-z0-9_]*=(?:\\.|[^=\\])*?[ \t]+)*?PanDstDeviceOS= - fieldName: log.PanDstDeviceOS - pattern: (?:\\.|[^=\\])*? - - fieldName: log.paSuffix - pattern: (?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) + pattern: (?:\\.|[^=\\])*?(?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) where: oneOf("log.paFormat", ["CEF", "LEEF-legacy"]) - grok: source: log.paCefExtensions @@ -199,9 +185,7 @@ pipeline: - fieldName: log.paIgnored pattern: ^(?:[A-Za-z][A-Za-z0-9_]*=(?:\\.|[^=\\])*?[ \t]+)*?PanDstDeviceOSv= - fieldName: log.PanDstDeviceOSv - pattern: (?:\\.|[^=\\])*? - - fieldName: log.paSuffix - pattern: (?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) + pattern: (?:\\.|[^=\\])*?(?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) where: oneOf("log.paFormat", ["CEF", "LEEF-legacy"]) - grok: source: log.paCefExtensions @@ -209,9 +193,7 @@ pipeline: - fieldName: log.paIgnored pattern: ^(?:[A-Za-z][A-Za-z0-9_]*=(?:\\.|[^=\\])*?[ \t]+)*?PanDstDeviceProf= - fieldName: log.PanDstDeviceProf - pattern: (?:\\.|[^=\\])*? - - fieldName: log.paSuffix - pattern: (?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) + pattern: (?:\\.|[^=\\])*?(?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) where: oneOf("log.paFormat", ["CEF", "LEEF-legacy"]) - grok: source: log.paCefExtensions @@ -219,9 +201,7 @@ pipeline: - fieldName: log.paIgnored pattern: ^(?:[A-Za-z][A-Za-z0-9_]*=(?:\\.|[^=\\])*?[ \t]+)*?PanDstDeviceVendor= - fieldName: log.PanDstDeviceVendor - pattern: (?:\\.|[^=\\])*? - - fieldName: log.paSuffix - pattern: (?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) + pattern: (?:\\.|[^=\\])*?(?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) where: oneOf("log.paFormat", ["CEF", "LEEF-legacy"]) - grok: source: log.paCefExtensions @@ -229,9 +209,7 @@ pipeline: - fieldName: log.paIgnored pattern: ^(?:[A-Za-z][A-Za-z0-9_]*=(?:\\.|[^=\\])*?[ \t]+)*?PanDstEDL= - fieldName: log.PanDstEDL - pattern: (?:\\.|[^=\\])*? - - fieldName: log.paSuffix - pattern: (?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) + pattern: (?:\\.|[^=\\])*?(?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) where: oneOf("log.paFormat", ["CEF", "LEEF-legacy"]) - grok: source: log.paCefExtensions @@ -239,9 +217,7 @@ pipeline: - fieldName: log.paIgnored pattern: ^(?:[A-Za-z][A-Za-z0-9_]*=(?:\\.|[^=\\])*?[ \t]+)*?PanDstHostname= - fieldName: log.PanDstHostname - pattern: (?:\\.|[^=\\])*? - - fieldName: log.paSuffix - pattern: (?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) + pattern: (?:\\.|[^=\\])*?(?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) where: oneOf("log.paFormat", ["CEF", "LEEF-legacy"]) - grok: source: log.paCefExtensions @@ -249,9 +225,7 @@ pipeline: - fieldName: log.paIgnored pattern: ^(?:[A-Za-z][A-Za-z0-9_]*=(?:\\.|[^=\\])*?[ \t]+)*?PanDstMac= - fieldName: log.PanDstMac - pattern: (?:\\.|[^=\\])*? - - fieldName: log.paSuffix - pattern: (?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) + pattern: (?:\\.|[^=\\])*?(?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) where: oneOf("log.paFormat", ["CEF", "LEEF-legacy"]) - grok: source: log.paCefExtensions @@ -259,9 +233,7 @@ pipeline: - fieldName: log.paIgnored pattern: ^(?:[A-Za-z][A-Za-z0-9_]*=(?:\\.|[^=\\])*?[ \t]+)*?PanDynamicUsrgrp= - fieldName: log.PanDynamicUsrgrp - pattern: (?:\\.|[^=\\])*? - - fieldName: log.paSuffix - pattern: (?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) + pattern: (?:\\.|[^=\\])*?(?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) where: oneOf("log.paFormat", ["CEF", "LEEF-legacy"]) - grok: source: log.paCefExtensions @@ -269,9 +241,7 @@ pipeline: - fieldName: log.paIgnored pattern: ^(?:[A-Za-z][A-Za-z0-9_]*=(?:\\.|[^=\\])*?[ \t]+)*?PanEPSerial= - fieldName: log.PanEPSerial - pattern: (?:\\.|[^=\\])*? - - fieldName: log.paSuffix - pattern: (?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) + pattern: (?:\\.|[^=\\])*?(?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) where: oneOf("log.paFormat", ["CEF", "LEEF-legacy"]) - grok: source: log.paCefExtensions @@ -279,9 +249,7 @@ pipeline: - fieldName: log.paIgnored pattern: ^(?:[A-Za-z][A-Za-z0-9_]*=(?:\\.|[^=\\])*?[ \t]+)*?PanGPHostID= - fieldName: log.PanGPHostID - pattern: (?:\\.|[^=\\])*? - - fieldName: log.paSuffix - pattern: (?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) + pattern: (?:\\.|[^=\\])*?(?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) where: oneOf("log.paFormat", ["CEF", "LEEF-legacy"]) - grok: source: log.paCefExtensions @@ -289,9 +257,7 @@ pipeline: - fieldName: log.paIgnored pattern: ^(?:[A-Za-z][A-Za-z0-9_]*=(?:\\.|[^=\\])*?[ \t]+)*?PanHASessionOwner= - fieldName: log.PanHASessionOwner - pattern: (?:\\.|[^=\\])*? - - fieldName: log.paSuffix - pattern: (?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) + pattern: (?:\\.|[^=\\])*?(?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) where: oneOf("log.paFormat", ["CEF", "LEEF-legacy"]) - grok: source: log.paCefExtensions @@ -299,9 +265,7 @@ pipeline: - fieldName: log.paIgnored pattern: ^(?:[A-Za-z][A-Za-z0-9_]*=(?:\\.|[^=\\])*?[ \t]+)*?PanJustification= - fieldName: log.PanJustification - pattern: (?:\\.|[^=\\])*? - - fieldName: log.paSuffix - pattern: (?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) + pattern: (?:\\.|[^=\\])*?(?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) where: oneOf("log.paFormat", ["CEF", "LEEF-legacy"]) - grok: source: log.paCefExtensions @@ -309,9 +273,7 @@ pipeline: - fieldName: log.paIgnored pattern: ^(?:[A-Za-z][A-Za-z0-9_]*=(?:\\.|[^=\\])*?[ \t]+)*?PanLinkChange= - fieldName: log.PanLinkChange - pattern: (?:\\.|[^=\\])*? - - fieldName: log.paSuffix - pattern: (?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) + pattern: (?:\\.|[^=\\])*?(?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) where: oneOf("log.paFormat", ["CEF", "LEEF-legacy"]) - grok: source: log.paCefExtensions @@ -319,9 +281,7 @@ pipeline: - fieldName: log.paIgnored pattern: ^(?:[A-Za-z][A-Za-z0-9_]*=(?:\\.|[^=\\])*?[ \t]+)*?PanLinkDetail= - fieldName: log.PanLinkDetail - pattern: (?:\\.|[^=\\])*? - - fieldName: log.paSuffix - pattern: (?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) + pattern: (?:\\.|[^=\\])*?(?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) where: oneOf("log.paFormat", ["CEF", "LEEF-legacy"]) - grok: source: log.paCefExtensions @@ -329,9 +289,7 @@ pipeline: - fieldName: log.paIgnored pattern: ^(?:[A-Za-z][A-Za-z0-9_]*=(?:\\.|[^=\\])*?[ \t]+)*?PanOSAPName= - fieldName: log.PanOSAPName - pattern: (?:\\.|[^=\\])*? - - fieldName: log.paSuffix - pattern: (?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) + pattern: (?:\\.|[^=\\])*?(?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) where: oneOf("log.paFormat", ["CEF", "LEEF-legacy"]) - grok: source: log.paCefExtensions @@ -339,9 +297,7 @@ pipeline: - fieldName: log.paIgnored pattern: ^(?:[A-Za-z][A-Za-z0-9_]*=(?:\\.|[^=\\])*?[ \t]+)*?PanOSActionFlags= - fieldName: log.PanOSActionFlags - pattern: (?:\\.|[^=\\])*? - - fieldName: log.paSuffix - pattern: (?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) + pattern: (?:\\.|[^=\\])*?(?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) where: oneOf("log.paFormat", ["CEF", "LEEF-legacy"]) - grok: source: log.paCefExtensions @@ -349,9 +305,7 @@ pipeline: - fieldName: log.paIgnored pattern: ^(?:[A-Za-z][A-Za-z0-9_]*=(?:\\.|[^=\\])*?[ \t]+)*?PanOSAreaCode= - fieldName: log.PanOSAreaCode - pattern: (?:\\.|[^=\\])*? - - fieldName: log.paSuffix - pattern: (?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) + pattern: (?:\\.|[^=\\])*?(?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) where: oneOf("log.paFormat", ["CEF", "LEEF-legacy"]) - grok: source: log.paCefExtensions @@ -359,9 +313,7 @@ pipeline: - fieldName: log.paIgnored pattern: ^(?:[A-Za-z][A-Za-z0-9_]*=(?:\\.|[^=\\])*?[ \t]+)*?PanOSAssocID= - fieldName: log.PanOSAssocID - pattern: (?:\\.|[^=\\])*? - - fieldName: log.paSuffix - pattern: (?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) + pattern: (?:\\.|[^=\\])*?(?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) where: oneOf("log.paFormat", ["CEF", "LEEF-legacy"]) - grok: source: log.paCefExtensions @@ -369,9 +321,7 @@ pipeline: - fieldName: log.paIgnored pattern: ^(?:[A-Za-z][A-Za-z0-9_]*=(?:\\.|[^=\\])*?[ \t]+)*?PanOSAttemptedGateways= - fieldName: log.PanOSAttemptedGateways - pattern: (?:\\.|[^=\\])*? - - fieldName: log.paSuffix - pattern: (?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) + pattern: (?:\\.|[^=\\])*?(?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) where: oneOf("log.paFormat", ["CEF", "LEEF-legacy"]) - grok: source: log.paCefExtensions @@ -379,9 +329,7 @@ pipeline: - fieldName: log.paIgnored pattern: ^(?:[A-Za-z][A-Za-z0-9_]*=(?:\\.|[^=\\])*?[ \t]+)*?PanOSAuthMethod= - fieldName: log.PanOSAuthMethod - pattern: (?:\\.|[^=\\])*? - - fieldName: log.paSuffix - pattern: (?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) + pattern: (?:\\.|[^=\\])*?(?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) where: oneOf("log.paFormat", ["CEF", "LEEF-legacy"]) - grok: source: log.paCefExtensions @@ -389,9 +337,7 @@ pipeline: - fieldName: log.paIgnored pattern: ^(?:[A-Za-z][A-Za-z0-9_]*=(?:\\.|[^=\\])*?[ \t]+)*?PanOSCellID= - fieldName: log.PanOSCellID - pattern: (?:\\.|[^=\\])*? - - fieldName: log.paSuffix - pattern: (?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) + pattern: (?:\\.|[^=\\])*?(?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) where: oneOf("log.paFormat", ["CEF", "LEEF-legacy"]) - grok: source: log.paCefExtensions @@ -399,9 +345,7 @@ pipeline: - fieldName: log.paIgnored pattern: ^(?:[A-Za-z][A-Za-z0-9_]*=(?:\\.|[^=\\])*?[ \t]+)*?PanOSCertificateFlags= - fieldName: log.PanOSCertificateFlags - pattern: (?:\\.|[^=\\])*? - - fieldName: log.paSuffix - pattern: (?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) + pattern: (?:\\.|[^=\\])*?(?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) where: oneOf("log.paFormat", ["CEF", "LEEF-legacy"]) - grok: source: log.paCefExtensions @@ -409,9 +353,7 @@ pipeline: - fieldName: log.paIgnored pattern: ^(?:[A-Za-z][A-Za-z0-9_]*=(?:\\.|[^=\\])*?[ \t]+)*?PanOSCertificateSerial= - fieldName: log.PanOSCertificateSerial - pattern: (?:\\.|[^=\\])*? - - fieldName: log.paSuffix - pattern: (?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) + pattern: (?:\\.|[^=\\])*?(?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) where: oneOf("log.paFormat", ["CEF", "LEEF-legacy"]) - grok: source: log.paCefExtensions @@ -419,9 +361,7 @@ pipeline: - fieldName: log.paIgnored pattern: ^(?:[A-Za-z][A-Za-z0-9_]*=(?:\\.|[^=\\])*?[ \t]+)*?PanOSCertificateSize= - fieldName: log.PanOSCertificateSize - pattern: (?:\\.|[^=\\])*? - - fieldName: log.paSuffix - pattern: (?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) + pattern: (?:\\.|[^=\\])*?(?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) where: oneOf("log.paFormat", ["CEF", "LEEF-legacy"]) - grok: source: log.paCefExtensions @@ -429,9 +369,7 @@ pipeline: - fieldName: log.paIgnored pattern: ^(?:[A-Za-z][A-Za-z0-9_]*=(?:\\.|[^=\\])*?[ \t]+)*?PanOSCertificateVersion= - fieldName: log.PanOSCertificateVersion - pattern: (?:\\.|[^=\\])*? - - fieldName: log.paSuffix - pattern: (?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) + pattern: (?:\\.|[^=\\])*?(?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) where: oneOf("log.paFormat", ["CEF", "LEEF-legacy"]) - grok: source: log.paCefExtensions @@ -439,9 +377,7 @@ pipeline: - fieldName: log.paIgnored pattern: ^(?:[A-Za-z][A-Za-z0-9_]*=(?:\\.|[^=\\])*?[ \t]+)*?PanOSChainStatus= - fieldName: log.PanOSChainStatus - pattern: (?:\\.|[^=\\])*? - - fieldName: log.paSuffix - pattern: (?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) + pattern: (?:\\.|[^=\\])*?(?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) where: oneOf("log.paFormat", ["CEF", "LEEF-legacy"]) - grok: source: log.paCefExtensions @@ -449,9 +385,7 @@ pipeline: - fieldName: log.paIgnored pattern: ^(?:[A-Za-z][A-Za-z0-9_]*=(?:\\.|[^=\\])*?[ \t]+)*?PanOSChunkType= - fieldName: log.PanOSChunkType - pattern: (?:\\.|[^=\\])*? - - fieldName: log.paSuffix - pattern: (?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) + pattern: (?:\\.|[^=\\])*?(?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) where: oneOf("log.paFormat", ["CEF", "LEEF-legacy"]) - grok: source: log.paCefExtensions @@ -459,9 +393,7 @@ pipeline: - fieldName: log.paIgnored pattern: ^(?:[A-Za-z][A-Za-z0-9_]*=(?:\\.|[^=\\])*?[ \t]+)*?PanOSClientToFirewall= - fieldName: log.PanOSClientToFirewall - pattern: (?:\\.|[^=\\])*? - - fieldName: log.paSuffix - pattern: (?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) + pattern: (?:\\.|[^=\\])*?(?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) where: oneOf("log.paFormat", ["CEF", "LEEF-legacy"]) - grok: source: log.paCefExtensions @@ -469,9 +401,7 @@ pipeline: - fieldName: log.paIgnored pattern: ^(?:[A-Za-z][A-Za-z0-9_]*=(?:\\.|[^=\\])*?[ \t]+)*?PanOSCommonName= - fieldName: log.PanOSCommonName - pattern: (?:\\.|[^=\\])*? - - fieldName: log.paSuffix - pattern: (?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) + pattern: (?:\\.|[^=\\])*?(?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) where: oneOf("log.paFormat", ["CEF", "LEEF-legacy"]) - grok: source: log.paCefExtensions @@ -479,9 +409,7 @@ pipeline: - fieldName: log.paIgnored pattern: ^(?:[A-Za-z][A-Za-z0-9_]*=(?:\\.|[^=\\])*?[ \t]+)*?PanOSCommonNameLength= - fieldName: log.PanOSCommonNameLength - pattern: (?:\\.|[^=\\])*? - - fieldName: log.paSuffix - pattern: (?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) + pattern: (?:\\.|[^=\\])*?(?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) where: oneOf("log.paFormat", ["CEF", "LEEF-legacy"]) - grok: source: log.paCefExtensions @@ -489,9 +417,7 @@ pipeline: - fieldName: log.paIgnored pattern: ^(?:[A-Za-z][A-Za-z0-9_]*=(?:\\.|[^=\\])*?[ \t]+)*?PanOSConfigVersion= - fieldName: log.PanOSConfigVersion - pattern: (?:\\.|[^=\\])*? - - fieldName: log.paSuffix - pattern: (?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) + pattern: (?:\\.|[^=\\])*?(?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) where: oneOf("log.paFormat", ["CEF", "LEEF-legacy"]) - grok: source: log.paCefExtensions @@ -499,9 +425,7 @@ pipeline: - fieldName: log.paIgnored pattern: ^(?:[A-Za-z][A-Za-z0-9_]*=(?:\\.|[^=\\])*?[ \t]+)*?PanOSConnectionError= - fieldName: log.PanOSConnectionError - pattern: (?:\\.|[^=\\])*? - - fieldName: log.paSuffix - pattern: (?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) + pattern: (?:\\.|[^=\\])*?(?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) where: oneOf("log.paFormat", ["CEF", "LEEF-legacy"]) - grok: source: log.paCefExtensions @@ -509,9 +433,7 @@ pipeline: - fieldName: log.paIgnored pattern: ^(?:[A-Za-z][A-Za-z0-9_]*=(?:\\.|[^=\\])*?[ \t]+)*?PanOSConnectionErrorID= - fieldName: log.PanOSConnectionErrorID - pattern: (?:\\.|[^=\\])*? - - fieldName: log.paSuffix - pattern: (?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) + pattern: (?:\\.|[^=\\])*?(?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) where: oneOf("log.paFormat", ["CEF", "LEEF-legacy"]) - grok: source: log.paCefExtensions @@ -519,9 +441,7 @@ pipeline: - fieldName: log.paIgnored pattern: ^(?:[A-Za-z][A-Za-z0-9_]*=(?:\\.|[^=\\])*?[ \t]+)*?PanOSConnectionMethod= - fieldName: log.PanOSConnectionMethod - pattern: (?:\\.|[^=\\])*? - - fieldName: log.paSuffix - pattern: (?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) + pattern: (?:\\.|[^=\\])*?(?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) where: oneOf("log.paFormat", ["CEF", "LEEF-legacy"]) - grok: source: log.paCefExtensions @@ -529,9 +449,7 @@ pipeline: - fieldName: log.paIgnored pattern: ^(?:[A-Za-z][A-Za-z0-9_]*=(?:\\.|[^=\\])*?[ \t]+)*?PanOSContainerID= - fieldName: log.PanOSContainerID - pattern: (?:\\.|[^=\\])*? - - fieldName: log.paSuffix - pattern: (?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) + pattern: (?:\\.|[^=\\])*?(?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) where: oneOf("log.paFormat", ["CEF", "LEEF-legacy"]) - grok: source: log.paCefExtensions @@ -539,9 +457,7 @@ pipeline: - fieldName: log.paIgnored pattern: ^(?:[A-Za-z][A-Za-z0-9_]*=(?:\\.|[^=\\])*?[ \t]+)*?PanOSContainerName= - fieldName: log.PanOSContainerName - pattern: (?:\\.|[^=\\])*? - - fieldName: log.paSuffix - pattern: (?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) + pattern: (?:\\.|[^=\\])*?(?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) where: oneOf("log.paFormat", ["CEF", "LEEF-legacy"]) - grok: source: log.paCefExtensions @@ -549,9 +465,7 @@ pipeline: - fieldName: log.paIgnored pattern: ^(?:[A-Za-z][A-Za-z0-9_]*=(?:\\.|[^=\\])*?[ \t]+)*?PanOSContainerNameSpace= - fieldName: log.PanOSContainerNameSpace - pattern: (?:\\.|[^=\\])*? - - fieldName: log.paSuffix - pattern: (?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) + pattern: (?:\\.|[^=\\])*?(?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) where: oneOf("log.paFormat", ["CEF", "LEEF-legacy"]) - grok: source: log.paCefExtensions @@ -559,9 +473,7 @@ pipeline: - fieldName: log.paIgnored pattern: ^(?:[A-Za-z][A-Za-z0-9_]*=(?:\\.|[^=\\])*?[ \t]+)*?PanOSContentVer= - fieldName: log.PanOSContentVer - pattern: (?:\\.|[^=\\])*? - - fieldName: log.paSuffix - pattern: (?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) + pattern: (?:\\.|[^=\\])*?(?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) where: oneOf("log.paFormat", ["CEF", "LEEF-legacy"]) - grok: source: log.paCefExtensions @@ -569,9 +481,7 @@ pipeline: - fieldName: log.paIgnored pattern: ^(?:[A-Za-z][A-Za-z0-9_]*=(?:\\.|[^=\\])*?[ \t]+)*?PanOSCountOfRepeats= - fieldName: log.PanOSCountOfRepeats - pattern: (?:\\.|[^=\\])*? - - fieldName: log.paSuffix - pattern: (?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) + pattern: (?:\\.|[^=\\])*?(?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) where: oneOf("log.paFormat", ["CEF", "LEEF-legacy"]) - grok: source: log.paCefExtensions @@ -579,9 +489,7 @@ pipeline: - fieldName: log.paIgnored pattern: ^(?:[A-Za-z][A-Za-z0-9_]*=(?:\\.|[^=\\])*?[ \t]+)*?PanOSDGl1= - fieldName: log.PanOSDGl1 - pattern: (?:\\.|[^=\\])*? - - fieldName: log.paSuffix - pattern: (?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) + pattern: (?:\\.|[^=\\])*?(?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) where: oneOf("log.paFormat", ["CEF", "LEEF-legacy"]) - grok: source: log.paCefExtensions @@ -589,9 +497,7 @@ pipeline: - fieldName: log.paIgnored pattern: ^(?:[A-Za-z][A-Za-z0-9_]*=(?:\\.|[^=\\])*?[ \t]+)*?PanOSDGl2= - fieldName: log.PanOSDGl2 - pattern: (?:\\.|[^=\\])*? - - fieldName: log.paSuffix - pattern: (?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) + pattern: (?:\\.|[^=\\])*?(?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) where: oneOf("log.paFormat", ["CEF", "LEEF-legacy"]) - grok: source: log.paCefExtensions @@ -599,9 +505,7 @@ pipeline: - fieldName: log.paIgnored pattern: ^(?:[A-Za-z][A-Za-z0-9_]*=(?:\\.|[^=\\])*?[ \t]+)*?PanOSDGl3= - fieldName: log.PanOSDGl3 - pattern: (?:\\.|[^=\\])*? - - fieldName: log.paSuffix - pattern: (?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) + pattern: (?:\\.|[^=\\])*?(?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) where: oneOf("log.paFormat", ["CEF", "LEEF-legacy"]) - grok: source: log.paCefExtensions @@ -609,9 +513,7 @@ pipeline: - fieldName: log.paIgnored pattern: ^(?:[A-Za-z][A-Za-z0-9_]*=(?:\\.|[^=\\])*?[ \t]+)*?PanOSDGl4= - fieldName: log.PanOSDGl4 - pattern: (?:\\.|[^=\\])*? - - fieldName: log.paSuffix - pattern: (?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) + pattern: (?:\\.|[^=\\])*?(?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) where: oneOf("log.paFormat", ["CEF", "LEEF-legacy"]) - grok: source: log.paCefExtensions @@ -619,9 +521,7 @@ pipeline: - fieldName: log.paIgnored pattern: ^(?:[A-Za-z][A-Za-z0-9_]*=(?:\\.|[^=\\])*?[ \t]+)*?PanOSDataSourceName= - fieldName: log.PanOSDataSourceName - pattern: (?:\\.|[^=\\])*? - - fieldName: log.paSuffix - pattern: (?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) + pattern: (?:\\.|[^=\\])*?(?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) where: oneOf("log.paFormat", ["CEF", "LEEF-legacy"]) - grok: source: log.paCefExtensions @@ -629,9 +529,7 @@ pipeline: - fieldName: log.paIgnored pattern: ^(?:[A-Za-z][A-Za-z0-9_]*=(?:\\.|[^=\\])*?[ \t]+)*?PanOSDataSourceSubType= - fieldName: log.PanOSDataSourceSubType - pattern: (?:\\.|[^=\\])*? - - fieldName: log.paSuffix - pattern: (?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) + pattern: (?:\\.|[^=\\])*?(?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) where: oneOf("log.paFormat", ["CEF", "LEEF-legacy"]) - grok: source: log.paCefExtensions @@ -639,9 +537,7 @@ pipeline: - fieldName: log.paIgnored pattern: ^(?:[A-Za-z][A-Za-z0-9_]*=(?:\\.|[^=\\])*?[ \t]+)*?PanOSDataSourceType= - fieldName: log.PanOSDataSourceType - pattern: (?:\\.|[^=\\])*? - - fieldName: log.paSuffix - pattern: (?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) + pattern: (?:\\.|[^=\\])*?(?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) where: oneOf("log.paFormat", ["CEF", "LEEF-legacy"]) - grok: source: log.paCefExtensions @@ -649,9 +545,7 @@ pipeline: - fieldName: log.paIgnored pattern: ^(?:[A-Za-z][A-Za-z0-9_]*=(?:\\.|[^=\\])*?[ \t]+)*?PanOSDesc= - fieldName: log.PanOSDesc - pattern: (?:\\.|[^=\\])*? - - fieldName: log.paSuffix - pattern: (?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) + pattern: (?:\\.|[^=\\])*?(?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) where: oneOf("log.paFormat", ["CEF", "LEEF-legacy"]) - grok: source: log.paCefExtensions @@ -659,9 +553,7 @@ pipeline: - fieldName: log.paIgnored pattern: ^(?:[A-Za-z][A-Za-z0-9_]*=(?:\\.|[^=\\])*?[ \t]+)*?PanOSDescription= - fieldName: log.PanOSDescription - pattern: (?:\\.|[^=\\])*? - - fieldName: log.paSuffix - pattern: (?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) + pattern: (?:\\.|[^=\\])*?(?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) where: oneOf("log.paFormat", ["CEF", "LEEF-legacy"]) - grok: source: log.paCefExtensions @@ -669,9 +561,7 @@ pipeline: - fieldName: log.paIgnored pattern: ^(?:[A-Za-z][A-Za-z0-9_]*=(?:\\.|[^=\\])*?[ \t]+)*?PanOSDestinationDeviceCategory= - fieldName: log.PanOSDestinationDeviceCategory - pattern: (?:\\.|[^=\\])*? - - fieldName: log.paSuffix - pattern: (?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) + pattern: (?:\\.|[^=\\])*?(?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) where: oneOf("log.paFormat", ["CEF", "LEEF-legacy"]) - grok: source: log.paCefExtensions @@ -679,9 +569,7 @@ pipeline: - fieldName: log.paIgnored pattern: ^(?:[A-Za-z][A-Za-z0-9_]*=(?:\\.|[^=\\])*?[ \t]+)*?PanOSDestinationDeviceHost= - fieldName: log.PanOSDestinationDeviceHost - pattern: (?:\\.|[^=\\])*? - - fieldName: log.paSuffix - pattern: (?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) + pattern: (?:\\.|[^=\\])*?(?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) where: oneOf("log.paFormat", ["CEF", "LEEF-legacy"]) - grok: source: log.paCefExtensions @@ -689,9 +577,7 @@ pipeline: - fieldName: log.paIgnored pattern: ^(?:[A-Za-z][A-Za-z0-9_]*=(?:\\.|[^=\\])*?[ \t]+)*?PanOSDestinationDeviceMac= - fieldName: log.PanOSDestinationDeviceMac - pattern: (?:\\.|[^=\\])*? - - fieldName: log.paSuffix - pattern: (?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) + pattern: (?:\\.|[^=\\])*?(?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) where: oneOf("log.paFormat", ["CEF", "LEEF-legacy"]) - grok: source: log.paCefExtensions @@ -699,9 +585,7 @@ pipeline: - fieldName: log.paIgnored pattern: ^(?:[A-Za-z][A-Za-z0-9_]*=(?:\\.|[^=\\])*?[ \t]+)*?PanOSDestinationDeviceModel= - fieldName: log.PanOSDestinationDeviceModel - pattern: (?:\\.|[^=\\])*? - - fieldName: log.paSuffix - pattern: (?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) + pattern: (?:\\.|[^=\\])*?(?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) where: oneOf("log.paFormat", ["CEF", "LEEF-legacy"]) - grok: source: log.paCefExtensions @@ -709,9 +593,7 @@ pipeline: - fieldName: log.paIgnored pattern: ^(?:[A-Za-z][A-Za-z0-9_]*=(?:\\.|[^=\\])*?[ \t]+)*?PanOSDestinationDeviceOSFamily= - fieldName: log.PanOSDestinationDeviceOSFamily - pattern: (?:\\.|[^=\\])*? - - fieldName: log.paSuffix - pattern: (?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) + pattern: (?:\\.|[^=\\])*?(?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) where: oneOf("log.paFormat", ["CEF", "LEEF-legacy"]) - grok: source: log.paCefExtensions @@ -719,9 +601,7 @@ pipeline: - fieldName: log.paIgnored pattern: ^(?:[A-Za-z][A-Za-z0-9_]*=(?:\\.|[^=\\])*?[ \t]+)*?PanOSDestinationDeviceOSVersion= - fieldName: log.PanOSDestinationDeviceOSVersion - pattern: (?:\\.|[^=\\])*? - - fieldName: log.paSuffix - pattern: (?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) + pattern: (?:\\.|[^=\\])*?(?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) where: oneOf("log.paFormat", ["CEF", "LEEF-legacy"]) - grok: source: log.paCefExtensions @@ -729,9 +609,7 @@ pipeline: - fieldName: log.paIgnored pattern: ^(?:[A-Za-z][A-Za-z0-9_]*=(?:\\.|[^=\\])*?[ \t]+)*?PanOSDestinationDeviceProfile= - fieldName: log.PanOSDestinationDeviceProfile - pattern: (?:\\.|[^=\\])*? - - fieldName: log.paSuffix - pattern: (?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) + pattern: (?:\\.|[^=\\])*?(?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) where: oneOf("log.paFormat", ["CEF", "LEEF-legacy"]) - grok: source: log.paCefExtensions @@ -739,9 +617,7 @@ pipeline: - fieldName: log.paIgnored pattern: ^(?:[A-Za-z][A-Za-z0-9_]*=(?:\\.|[^=\\])*?[ \t]+)*?PanOSDestinationDeviceVendor= - fieldName: log.PanOSDestinationDeviceVendor - pattern: (?:\\.|[^=\\])*? - - fieldName: log.paSuffix - pattern: (?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) + pattern: (?:\\.|[^=\\])*?(?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) where: oneOf("log.paFormat", ["CEF", "LEEF-legacy"]) - grok: source: log.paCefExtensions @@ -749,9 +625,7 @@ pipeline: - fieldName: log.paIgnored pattern: ^(?:[A-Za-z][A-Za-z0-9_]*=(?:\\.|[^=\\])*?[ \t]+)*?PanOSDestinationDynamicAddressGroup= - fieldName: log.PanOSDestinationDynamicAddressGroup - pattern: (?:\\.|[^=\\])*? - - fieldName: log.paSuffix - pattern: (?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) + pattern: (?:\\.|[^=\\])*?(?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) where: oneOf("log.paFormat", ["CEF", "LEEF-legacy"]) - grok: source: log.paCefExtensions @@ -759,9 +633,7 @@ pipeline: - fieldName: log.paIgnored pattern: ^(?:[A-Za-z][A-Za-z0-9_]*=(?:\\.|[^=\\])*?[ \t]+)*?PanOSDestinationEDL= - fieldName: log.PanOSDestinationEDL - pattern: (?:\\.|[^=\\])*? - - fieldName: log.paSuffix - pattern: (?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) + pattern: (?:\\.|[^=\\])*?(?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) where: oneOf("log.paFormat", ["CEF", "LEEF-legacy"]) - grok: source: log.paCefExtensions @@ -769,9 +641,7 @@ pipeline: - fieldName: log.paIgnored pattern: ^(?:[A-Za-z][A-Za-z0-9_]*=(?:\\.|[^=\\])*?[ \t]+)*?PanOSDestinationUUID= - fieldName: log.PanOSDestinationUUID - pattern: (?:\\.|[^=\\])*? - - fieldName: log.paSuffix - pattern: (?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) + pattern: (?:\\.|[^=\\])*?(?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) where: oneOf("log.paFormat", ["CEF", "LEEF-legacy"]) - grok: source: log.paCefExtensions @@ -779,9 +649,7 @@ pipeline: - fieldName: log.paIgnored pattern: ^(?:[A-Za-z][A-Za-z0-9_]*=(?:\\.|[^=\\])*?[ \t]+)*?PanOSDeviceSN= - fieldName: log.PanOSDeviceSN - pattern: (?:\\.|[^=\\])*? - - fieldName: log.paSuffix - pattern: (?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) + pattern: (?:\\.|[^=\\])*?(?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) where: oneOf("log.paFormat", ["CEF", "LEEF-legacy"]) - grok: source: log.paCefExtensions @@ -789,9 +657,7 @@ pipeline: - fieldName: log.paIgnored pattern: ^(?:[A-Za-z][A-Za-z0-9_]*=(?:\\.|[^=\\])*?[ \t]+)*?PanOSDiameterAVPCode= - fieldName: log.PanOSDiameterAVPCode - pattern: (?:\\.|[^=\\])*? - - fieldName: log.paSuffix - pattern: (?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) + pattern: (?:\\.|[^=\\])*?(?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) where: oneOf("log.paFormat", ["CEF", "LEEF-legacy"]) - grok: source: log.paCefExtensions @@ -799,9 +665,7 @@ pipeline: - fieldName: log.paIgnored pattern: ^(?:[A-Za-z][A-Za-z0-9_]*=(?:\\.|[^=\\])*?[ \t]+)*?PanOSDiameterApp= - fieldName: log.PanOSDiameterApp - pattern: (?:\\.|[^=\\])*? - - fieldName: log.paSuffix - pattern: (?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) + pattern: (?:\\.|[^=\\])*?(?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) where: oneOf("log.paFormat", ["CEF", "LEEF-legacy"]) - grok: source: log.paCefExtensions @@ -809,9 +673,7 @@ pipeline: - fieldName: log.paIgnored pattern: ^(?:[A-Za-z][A-Za-z0-9_]*=(?:\\.|[^=\\])*?[ \t]+)*?PanOSDiameterCmdCode= - fieldName: log.PanOSDiameterCmdCode - pattern: (?:\\.|[^=\\])*? - - fieldName: log.paSuffix - pattern: (?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) + pattern: (?:\\.|[^=\\])*?(?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) where: oneOf("log.paFormat", ["CEF", "LEEF-legacy"]) - grok: source: log.paCefExtensions @@ -819,9 +681,7 @@ pipeline: - fieldName: log.paIgnored pattern: ^(?:[A-Za-z][A-Za-z0-9_]*=(?:\\.|[^=\\])*?[ \t]+)*?PanOSDstUUID= - fieldName: log.PanOSDstUUID - pattern: (?:\\.|[^=\\])*? - - fieldName: log.paSuffix - pattern: (?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) + pattern: (?:\\.|[^=\\])*?(?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) where: oneOf("log.paFormat", ["CEF", "LEEF-legacy"]) - grok: source: log.paCefExtensions @@ -829,9 +689,7 @@ pipeline: - fieldName: log.paIgnored pattern: ^(?:[A-Za-z][A-Za-z0-9_]*=(?:\\.|[^=\\])*?[ \t]+)*?PanOSEllipticCurve= - fieldName: log.PanOSEllipticCurve - pattern: (?:\\.|[^=\\])*? - - fieldName: log.paSuffix - pattern: (?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) + pattern: (?:\\.|[^=\\])*?(?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) where: oneOf("log.paFormat", ["CEF", "LEEF-legacy"]) - grok: source: log.paCefExtensions @@ -839,9 +697,7 @@ pipeline: - fieldName: log.paIgnored pattern: ^(?:[A-Za-z][A-Za-z0-9_]*=(?:\\.|[^=\\])*?[ \t]+)*?PanOSEndUserIP= - fieldName: log.PanOSEndUserIP - pattern: (?:\\.|[^=\\])*? - - fieldName: log.paSuffix - pattern: (?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) + pattern: (?:\\.|[^=\\])*?(?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) where: oneOf("log.paFormat", ["CEF", "LEEF-legacy"]) - grok: source: log.paCefExtensions @@ -849,9 +705,7 @@ pipeline: - fieldName: log.paIgnored pattern: ^(?:[A-Za-z][A-Za-z0-9_]*=(?:\\.|[^=\\])*?[ \t]+)*?PanOSEndpointDeviceName= - fieldName: log.PanOSEndpointDeviceName - pattern: (?:\\.|[^=\\])*? - - fieldName: log.paSuffix - pattern: (?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) + pattern: (?:\\.|[^=\\])*?(?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) where: oneOf("log.paFormat", ["CEF", "LEEF-legacy"]) - grok: source: log.paCefExtensions @@ -859,9 +713,7 @@ pipeline: - fieldName: log.paIgnored pattern: ^(?:[A-Za-z][A-Za-z0-9_]*=(?:\\.|[^=\\])*?[ \t]+)*?PanOSEndpointMac= - fieldName: log.PanOSEndpointMac - pattern: (?:\\.|[^=\\])*? - - fieldName: log.paSuffix - pattern: (?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) + pattern: (?:\\.|[^=\\])*?(?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) where: oneOf("log.paFormat", ["CEF", "LEEF-legacy"]) - grok: source: log.paCefExtensions @@ -869,9 +721,7 @@ pipeline: - fieldName: log.paIgnored pattern: ^(?:[A-Za-z][A-Za-z0-9_]*=(?:\\.|[^=\\])*?[ \t]+)*?PanOSEndpointOSType= - fieldName: log.PanOSEndpointOSType - pattern: (?:\\.|[^=\\])*? - - fieldName: log.paSuffix - pattern: (?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) + pattern: (?:\\.|[^=\\])*?(?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) where: oneOf("log.paFormat", ["CEF", "LEEF-legacy"]) - grok: source: log.paCefExtensions @@ -879,9 +729,7 @@ pipeline: - fieldName: log.paIgnored pattern: ^(?:[A-Za-z][A-Za-z0-9_]*=(?:\\.|[^=\\])*?[ \t]+)*?PanOSEndpointOSVersion= - fieldName: log.PanOSEndpointOSVersion - pattern: (?:\\.|[^=\\])*? - - fieldName: log.paSuffix - pattern: (?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) + pattern: (?:\\.|[^=\\])*?(?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) where: oneOf("log.paFormat", ["CEF", "LEEF-legacy"]) - grok: source: log.paCefExtensions @@ -889,9 +737,7 @@ pipeline: - fieldName: log.paIgnored pattern: ^(?:[A-Za-z][A-Za-z0-9_]*=(?:\\.|[^=\\])*?[ \t]+)*?PanOSEndpointSerialNumber= - fieldName: log.PanOSEndpointSerialNumber - pattern: (?:\\.|[^=\\])*? - - fieldName: log.paSuffix - pattern: (?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) + pattern: (?:\\.|[^=\\])*?(?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) where: oneOf("log.paFormat", ["CEF", "LEEF-legacy"]) - grok: source: log.paCefExtensions @@ -899,9 +745,7 @@ pipeline: - fieldName: log.paIgnored pattern: ^(?:[A-Za-z][A-Za-z0-9_]*=(?:\\.|[^=\\])*?[ \t]+)*?PanOSErrorIndex= - fieldName: log.PanOSErrorIndex - pattern: (?:\\.|[^=\\])*? - - fieldName: log.paSuffix - pattern: (?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) + pattern: (?:\\.|[^=\\])*?(?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) where: oneOf("log.paFormat", ["CEF", "LEEF-legacy"]) - grok: source: log.paCefExtensions @@ -909,9 +753,7 @@ pipeline: - fieldName: log.paIgnored pattern: ^(?:[A-Za-z][A-Za-z0-9_]*=(?:\\.|[^=\\])*?[ \t]+)*?PanOSErrorMessage= - fieldName: log.PanOSErrorMessage - pattern: (?:\\.|[^=\\])*? - - fieldName: log.paSuffix - pattern: (?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) + pattern: (?:\\.|[^=\\])*?(?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) where: oneOf("log.paFormat", ["CEF", "LEEF-legacy"]) - grok: source: log.paCefExtensions @@ -919,9 +761,7 @@ pipeline: - fieldName: log.paIgnored pattern: ^(?:[A-Za-z][A-Za-z0-9_]*=(?:\\.|[^=\\])*?[ \t]+)*?PanOSEventID= - fieldName: log.PanOSEventID - pattern: (?:\\.|[^=\\])*? - - fieldName: log.paSuffix - pattern: (?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) + pattern: (?:\\.|[^=\\])*?(?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) where: oneOf("log.paFormat", ["CEF", "LEEF-legacy"]) - grok: source: log.paCefExtensions @@ -929,9 +769,7 @@ pipeline: - fieldName: log.paIgnored pattern: ^(?:[A-Za-z][A-Za-z0-9_]*=(?:\\.|[^=\\])*?[ \t]+)*?PanOSEventStatus= - fieldName: log.PanOSEventStatus - pattern: (?:\\.|[^=\\])*? - - fieldName: log.paSuffix - pattern: (?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) + pattern: (?:\\.|[^=\\])*?(?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) where: oneOf("log.paFormat", ["CEF", "LEEF-legacy"]) - grok: source: log.paCefExtensions @@ -939,9 +777,7 @@ pipeline: - fieldName: log.paIgnored pattern: ^(?:[A-Za-z][A-Za-z0-9_]*=(?:\\.|[^=\\])*?[ \t]+)*?PanOSFWDeviceGroup= - fieldName: log.PanOSFWDeviceGroup - pattern: (?:\\.|[^=\\])*? - - fieldName: log.paSuffix - pattern: (?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) + pattern: (?:\\.|[^=\\])*?(?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) where: oneOf("log.paFormat", ["CEF", "LEEF-legacy"]) - grok: source: log.paCefExtensions @@ -949,9 +785,7 @@ pipeline: - fieldName: log.paIgnored pattern: ^(?:[A-Za-z][A-Za-z0-9_]*=(?:\\.|[^=\\])*?[ \t]+)*?PanOSFingerprint= - fieldName: log.PanOSFingerprint - pattern: (?:\\.|[^=\\])*? - - fieldName: log.paSuffix - pattern: (?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) + pattern: (?:\\.|[^=\\])*?(?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) where: oneOf("log.paFormat", ["CEF", "LEEF-legacy"]) - grok: source: log.paCefExtensions @@ -959,9 +793,7 @@ pipeline: - fieldName: log.paIgnored pattern: ^(?:[A-Za-z][A-Za-z0-9_]*=(?:\\.|[^=\\])*?[ \t]+)*?PanOSFirewallToServer= - fieldName: log.PanOSFirewallToServer - pattern: (?:\\.|[^=\\])*? - - fieldName: log.paSuffix - pattern: (?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) + pattern: (?:\\.|[^=\\])*?(?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) where: oneOf("log.paFormat", ["CEF", "LEEF-legacy"]) - grok: source: log.paCefExtensions @@ -969,9 +801,7 @@ pipeline: - fieldName: log.paIgnored pattern: ^(?:[A-Za-z][A-Za-z0-9_]*=(?:\\.|[^=\\])*?[ \t]+)*?PanOSGPGatewayLocation= - fieldName: log.PanOSGPGatewayLocation - pattern: (?:\\.|[^=\\])*? - - fieldName: log.paSuffix - pattern: (?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) + pattern: (?:\\.|[^=\\])*?(?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) where: oneOf("log.paFormat", ["CEF", "LEEF-legacy"]) - grok: source: log.paCefExtensions @@ -979,9 +809,7 @@ pipeline: - fieldName: log.paIgnored pattern: ^(?:[A-Za-z][A-Za-z0-9_]*=(?:\\.|[^=\\])*?[ \t]+)*?PanOSGTPCause= - fieldName: log.PanOSGTPCause - pattern: (?:\\.|[^=\\])*? - - fieldName: log.paSuffix - pattern: (?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) + pattern: (?:\\.|[^=\\])*?(?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) where: oneOf("log.paFormat", ["CEF", "LEEF-legacy"]) - grok: source: log.paCefExtensions @@ -989,9 +817,7 @@ pipeline: - fieldName: log.paIgnored pattern: ^(?:[A-Za-z][A-Za-z0-9_]*=(?:\\.|[^=\\])*?[ \t]+)*?PanOSGTPEventCode= - fieldName: log.PanOSGTPEventCode - pattern: (?:\\.|[^=\\])*? - - fieldName: log.paSuffix - pattern: (?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) + pattern: (?:\\.|[^=\\])*?(?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) where: oneOf("log.paFormat", ["CEF", "LEEF-legacy"]) - grok: source: log.paCefExtensions @@ -999,9 +825,7 @@ pipeline: - fieldName: log.paIgnored pattern: ^(?:[A-Za-z][A-Za-z0-9_]*=(?:\\.|[^=\\])*?[ \t]+)*?PanOSGTPEventType= - fieldName: log.PanOSGTPEventType - pattern: (?:\\.|[^=\\])*? - - fieldName: log.paSuffix - pattern: (?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) + pattern: (?:\\.|[^=\\])*?(?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) where: oneOf("log.paFormat", ["CEF", "LEEF-legacy"]) - grok: source: log.paCefExtensions @@ -1009,9 +833,7 @@ pipeline: - fieldName: log.paIgnored pattern: ^(?:[A-Za-z][A-Za-z0-9_]*=(?:\\.|[^=\\])*?[ \t]+)*?PanOSGTPInterface= - fieldName: log.PanOSGTPInterface - pattern: (?:\\.|[^=\\])*? - - fieldName: log.paSuffix - pattern: (?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) + pattern: (?:\\.|[^=\\])*?(?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) where: oneOf("log.paFormat", ["CEF", "LEEF-legacy"]) - grok: source: log.paCefExtensions @@ -1019,9 +841,7 @@ pipeline: - fieldName: log.paIgnored pattern: ^(?:[A-Za-z][A-Za-z0-9_]*=(?:\\.|[^=\\])*?[ \t]+)*?PanOSGTPMsgType= - fieldName: log.PanOSGTPMsgType - pattern: (?:\\.|[^=\\])*? - - fieldName: log.paSuffix - pattern: (?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) + pattern: (?:\\.|[^=\\])*?(?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) where: oneOf("log.paFormat", ["CEF", "LEEF-legacy"]) - grok: source: log.paCefExtensions @@ -1029,9 +849,7 @@ pipeline: - fieldName: log.paIgnored pattern: ^(?:[A-Za-z][A-Za-z0-9_]*=(?:\\.|[^=\\])*?[ \t]+)*?PanOSGateway= - fieldName: log.PanOSGateway - pattern: (?:\\.|[^=\\])*? - - fieldName: log.paSuffix - pattern: (?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) + pattern: (?:\\.|[^=\\])*?(?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) where: oneOf("log.paFormat", ["CEF", "LEEF-legacy"]) - grok: source: log.paCefExtensions @@ -1039,9 +857,7 @@ pipeline: - fieldName: log.paIgnored pattern: ^(?:[A-Za-z][A-Za-z0-9_]*=(?:\\.|[^=\\])*?[ \t]+)*?PanOSGatewayPriority= - fieldName: log.PanOSGatewayPriority - pattern: (?:\\.|[^=\\])*? - - fieldName: log.paSuffix - pattern: (?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) + pattern: (?:\\.|[^=\\])*?(?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) where: oneOf("log.paFormat", ["CEF", "LEEF-legacy"]) - grok: source: log.paCefExtensions @@ -1049,9 +865,7 @@ pipeline: - fieldName: log.paIgnored pattern: ^(?:[A-Za-z][A-Za-z0-9_]*=(?:\\.|[^=\\])*?[ \t]+)*?PanOSGatewaySelectionType= - fieldName: log.PanOSGatewaySelectionType - pattern: (?:\\.|[^=\\])*? - - fieldName: log.paSuffix - pattern: (?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) + pattern: (?:\\.|[^=\\])*?(?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) where: oneOf("log.paFormat", ["CEF", "LEEF-legacy"]) - grok: source: log.paCefExtensions @@ -1059,9 +873,7 @@ pipeline: - fieldName: log.paIgnored pattern: ^(?:[A-Za-z][A-Za-z0-9_]*=(?:\\.|[^=\\])*?[ \t]+)*?PanOSGlobalProtectClientVersion= - fieldName: log.PanOSGlobalProtectClientVersion - pattern: (?:\\.|[^=\\])*? - - fieldName: log.paSuffix - pattern: (?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) + pattern: (?:\\.|[^=\\])*?(?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) where: oneOf("log.paFormat", ["CEF", "LEEF-legacy"]) - grok: source: log.paCefExtensions @@ -1069,9 +881,7 @@ pipeline: - fieldName: log.paIgnored pattern: ^(?:[A-Za-z][A-Za-z0-9_]*=(?:\\.|[^=\\])*?[ \t]+)*?PanOSHTTP2Con= - fieldName: log.PanOSHTTP2Con - pattern: (?:\\.|[^=\\])*? - - fieldName: log.paSuffix - pattern: (?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) + pattern: (?:\\.|[^=\\])*?(?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) where: oneOf("log.paFormat", ["CEF", "LEEF-legacy"]) - grok: source: log.paCefExtensions @@ -1079,9 +889,7 @@ pipeline: - fieldName: log.paIgnored pattern: ^(?:[A-Za-z][A-Za-z0-9_]*=(?:\\.|[^=\\])*?[ \t]+)*?PanOSHTTPHeader= - fieldName: log.PanOSHTTPHeader - pattern: (?:\\.|[^=\\])*? - - fieldName: log.paSuffix - pattern: (?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) + pattern: (?:\\.|[^=\\])*?(?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) where: oneOf("log.paFormat", ["CEF", "LEEF-legacy"]) - grok: source: log.paCefExtensions @@ -1089,9 +897,7 @@ pipeline: - fieldName: log.paIgnored pattern: ^(?:[A-Za-z][A-Za-z0-9_]*=(?:\\.|[^=\\])*?[ \t]+)*?PanOSHTTPUserAgent= - fieldName: log.PanOSHTTPUserAgent - pattern: (?:\\.|[^=\\])*? - - fieldName: log.paSuffix - pattern: (?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) + pattern: (?:\\.|[^=\\])*?(?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) where: oneOf("log.paFormat", ["CEF", "LEEF-legacy"]) - grok: source: log.paCefExtensions @@ -1099,9 +905,7 @@ pipeline: - fieldName: log.paIgnored pattern: ^(?:[A-Za-z][A-Za-z0-9_]*=(?:\\.|[^=\\])*?[ \t]+)*?PanOSHostID= - fieldName: log.PanOSHostID - pattern: (?:\\.|[^=\\])*? - - fieldName: log.paSuffix - pattern: (?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) + pattern: (?:\\.|[^=\\])*?(?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) where: oneOf("log.paFormat", ["CEF", "LEEF-legacy"]) - grok: source: log.paCefExtensions @@ -1109,9 +913,7 @@ pipeline: - fieldName: log.paIgnored pattern: ^(?:[A-Za-z][A-Za-z0-9_]*=(?:\\.|[^=\\])*?[ \t]+)*?PanOSIssuerCommonName= - fieldName: log.PanOSIssuerCommonName - pattern: (?:\\.|[^=\\])*? - - fieldName: log.paSuffix - pattern: (?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) + pattern: (?:\\.|[^=\\])*?(?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) where: oneOf("log.paFormat", ["CEF", "LEEF-legacy"]) - grok: source: log.paCefExtensions @@ -1119,9 +921,7 @@ pipeline: - fieldName: log.paIgnored pattern: ^(?:[A-Za-z][A-Za-z0-9_]*=(?:\\.|[^=\\])*?[ \t]+)*?PanOSIssuerNameLength= - fieldName: log.PanOSIssuerNameLength - pattern: (?:\\.|[^=\\])*? - - fieldName: log.paSuffix - pattern: (?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) + pattern: (?:\\.|[^=\\])*?(?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) where: oneOf("log.paFormat", ["CEF", "LEEF-legacy"]) - grok: source: log.paCefExtensions @@ -1129,9 +929,7 @@ pipeline: - fieldName: log.paIgnored pattern: ^(?:[A-Za-z][A-Za-z0-9_]*=(?:\\.|[^=\\])*?[ \t]+)*?PanOSLogTimeStamp= - fieldName: log.PanOSLogTimeStamp - pattern: (?:\\.|[^=\\])*? - - fieldName: log.paSuffix - pattern: (?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) + pattern: (?:\\.|[^=\\])*?(?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) where: oneOf("log.paFormat", ["CEF", "LEEF-legacy"]) - grok: source: log.paCefExtensions @@ -1139,9 +937,7 @@ pipeline: - fieldName: log.paIgnored pattern: ^(?:[A-Za-z][A-Za-z0-9_]*=(?:\\.|[^=\\])*?[ \t]+)*?PanOSLogTypeSeqNo= - fieldName: log.PanOSLogTypeSeqNo - pattern: (?:\\.|[^=\\])*? - - fieldName: log.paSuffix - pattern: (?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) + pattern: (?:\\.|[^=\\])*?(?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) where: oneOf("log.paFormat", ["CEF", "LEEF-legacy"]) - grok: source: log.paCefExtensions @@ -1149,9 +945,7 @@ pipeline: - fieldName: log.paIgnored pattern: ^(?:[A-Za-z][A-Za-z0-9_]*=(?:\\.|[^=\\])*?[ \t]+)*?PanOSLoginDuration= - fieldName: log.PanOSLoginDuration - pattern: (?:\\.|[^=\\])*? - - fieldName: log.paSuffix - pattern: (?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) + pattern: (?:\\.|[^=\\])*?(?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) where: oneOf("log.paFormat", ["CEF", "LEEF-legacy"]) - grok: source: log.paCefExtensions @@ -1159,9 +953,7 @@ pipeline: - fieldName: log.paIgnored pattern: ^(?:[A-Za-z][A-Za-z0-9_]*=(?:\\.|[^=\\])*?[ \t]+)*?PanOSMSISDN= - fieldName: log.PanOSMSISDN - pattern: (?:\\.|[^=\\])*? - - fieldName: log.paSuffix - pattern: (?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) + pattern: (?:\\.|[^=\\])*?(?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) where: oneOf("log.paFormat", ["CEF", "LEEF-legacy"]) - grok: source: log.paCefExtensions @@ -1169,9 +961,7 @@ pipeline: - fieldName: log.paIgnored pattern: ^(?:[A-Za-z][A-Za-z0-9_]*=(?:\\.|[^=\\])*?[ \t]+)*?PanOSMonitorTag= - fieldName: log.PanOSMonitorTag - pattern: (?:\\.|[^=\\])*? - - fieldName: log.paSuffix - pattern: (?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) + pattern: (?:\\.|[^=\\])*?(?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) where: oneOf("log.paFormat", ["CEF", "LEEF-legacy"]) - grok: source: log.paCefExtensions @@ -1179,9 +969,7 @@ pipeline: - fieldName: log.paIgnored pattern: ^(?:[A-Za-z][A-Za-z0-9_]*=(?:\\.|[^=\\])*?[ \t]+)*?PanOSOpCode= - fieldName: log.PanOSOpCode - pattern: (?:\\.|[^=\\])*? - - fieldName: log.paSuffix - pattern: (?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) + pattern: (?:\\.|[^=\\])*?(?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) where: oneOf("log.paFormat", ["CEF", "LEEF-legacy"]) - grok: source: log.paCefExtensions @@ -1189,9 +977,7 @@ pipeline: - fieldName: log.paIgnored pattern: ^(?:[A-Za-z][A-Za-z0-9_]*=(?:\\.|[^=\\])*?[ \t]+)*?PanOSPPID= - fieldName: log.PanOSPPID - pattern: (?:\\.|[^=\\])*? - - fieldName: log.paSuffix - pattern: (?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) + pattern: (?:\\.|[^=\\])*?(?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) where: oneOf("log.paFormat", ["CEF", "LEEF-legacy"]) - grok: source: log.paCefExtensions @@ -1199,9 +985,7 @@ pipeline: - fieldName: log.paIgnored pattern: ^(?:[A-Za-z][A-Za-z0-9_]*=(?:\\.|[^=\\])*?[ \t]+)*?PanOSPacketsReceived= - fieldName: log.PanOSPacketsReceived - pattern: (?:\\.|[^=\\])*? - - fieldName: log.paSuffix - pattern: (?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) + pattern: (?:\\.|[^=\\])*?(?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) where: oneOf("log.paFormat", ["CEF", "LEEF-legacy"]) - grok: source: log.paCefExtensions @@ -1209,9 +993,7 @@ pipeline: - fieldName: log.paIgnored pattern: ^(?:[A-Za-z][A-Za-z0-9_]*=(?:\\.|[^=\\])*?[ \t]+)*?PanOSPacketsSent= - fieldName: log.PanOSPacketsSent - pattern: (?:\\.|[^=\\])*? - - fieldName: log.paSuffix - pattern: (?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) + pattern: (?:\\.|[^=\\])*?(?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) where: oneOf("log.paFormat", ["CEF", "LEEF-legacy"]) - grok: source: log.paCefExtensions @@ -1219,9 +1001,7 @@ pipeline: - fieldName: log.paIgnored pattern: ^(?:[A-Za-z][A-Za-z0-9_]*=(?:\\.|[^=\\])*?[ \t]+)*?PanOSParentSessionID= - fieldName: log.PanOSParentSessionID - pattern: (?:\\.|[^=\\])*? - - fieldName: log.paSuffix - pattern: (?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) + pattern: (?:\\.|[^=\\])*?(?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) where: oneOf("log.paFormat", ["CEF", "LEEF-legacy"]) - grok: source: log.paCefExtensions @@ -1229,9 +1009,7 @@ pipeline: - fieldName: log.paIgnored pattern: ^(?:[A-Za-z][A-Za-z0-9_]*=(?:\\.|[^=\\])*?[ \t]+)*?PanOSParentStartTime= - fieldName: log.PanOSParentStartTime - pattern: (?:\\.|[^=\\])*? - - fieldName: log.paSuffix - pattern: (?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) + pattern: (?:\\.|[^=\\])*?(?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) where: oneOf("log.paFormat", ["CEF", "LEEF-legacy"]) - grok: source: log.paCefExtensions @@ -1239,9 +1017,7 @@ pipeline: - fieldName: log.paIgnored pattern: ^(?:[A-Za-z][A-Za-z0-9_]*=(?:\\.|[^=\\])*?[ \t]+)*?PanOSPayloadProtID= - fieldName: log.PanOSPayloadProtID - pattern: (?:\\.|[^=\\])*? - - fieldName: log.paSuffix - pattern: (?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) + pattern: (?:\\.|[^=\\])*?(?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) where: oneOf("log.paFormat", ["CEF", "LEEF-legacy"]) - grok: source: log.paCefExtensions @@ -1249,9 +1025,7 @@ pipeline: - fieldName: log.paIgnored pattern: ^(?:[A-Za-z][A-Za-z0-9_]*=(?:\\.|[^=\\])*?[ \t]+)*?PanOSPcapID= - fieldName: log.PanOSPcapID - pattern: (?:\\.|[^=\\])*? - - fieldName: log.paSuffix - pattern: (?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) + pattern: (?:\\.|[^=\\])*?(?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) where: oneOf("log.paFormat", ["CEF", "LEEF-legacy"]) - grok: source: log.paCefExtensions @@ -1259,9 +1033,7 @@ pipeline: - fieldName: log.paIgnored pattern: ^(?:[A-Za-z][A-Za-z0-9_]*=(?:\\.|[^=\\])*?[ \t]+)*?PanOSPolicyAuditComment= - fieldName: log.PanOSPolicyAuditComment - pattern: (?:\\.|[^=\\])*? - - fieldName: log.paSuffix - pattern: (?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) + pattern: (?:\\.|[^=\\])*?(?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) where: oneOf("log.paFormat", ["CEF", "LEEF-legacy"]) - grok: source: log.paCefExtensions @@ -1269,9 +1041,7 @@ pipeline: - fieldName: log.paIgnored pattern: ^(?:[A-Za-z][A-Za-z0-9_]*=(?:\\.|[^=\\])*?[ \t]+)*?PanOSPolicyName= - fieldName: log.PanOSPolicyName - pattern: (?:\\.|[^=\\])*? - - fieldName: log.paSuffix - pattern: (?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) + pattern: (?:\\.|[^=\\])*?(?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) where: oneOf("log.paFormat", ["CEF", "LEEF-legacy"]) - grok: source: log.paCefExtensions @@ -1279,9 +1049,7 @@ pipeline: - fieldName: log.paIgnored pattern: ^(?:[A-Za-z][A-Za-z0-9_]*=(?:\\.|[^=\\])*?[ \t]+)*?PanOSPortal= - fieldName: log.PanOSPortal - pattern: (?:\\.|[^=\\])*? - - fieldName: log.paSuffix - pattern: (?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) + pattern: (?:\\.|[^=\\])*?(?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) where: oneOf("log.paFormat", ["CEF", "LEEF-legacy"]) - grok: source: log.paCefExtensions @@ -1289,9 +1057,7 @@ pipeline: - fieldName: log.paIgnored pattern: ^(?:[A-Za-z][A-Za-z0-9_]*=(?:\\.|[^=\\])*?[ \t]+)*?PanOSPrivateIPv4= - fieldName: log.PanOSPrivateIPv4 - pattern: (?:\\.|[^=\\])*? - - fieldName: log.paSuffix - pattern: (?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) + pattern: (?:\\.|[^=\\])*?(?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) where: oneOf("log.paFormat", ["CEF", "LEEF-legacy"]) - grok: source: log.paCefExtensions @@ -1299,9 +1065,7 @@ pipeline: - fieldName: log.paIgnored pattern: ^(?:[A-Za-z][A-Za-z0-9_]*=(?:\\.|[^=\\])*?[ \t]+)*?PanOSPrivateIPv6= - fieldName: log.PanOSPrivateIPv6 - pattern: (?:\\.|[^=\\])*? - - fieldName: log.paSuffix - pattern: (?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) + pattern: (?:\\.|[^=\\])*?(?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) where: oneOf("log.paFormat", ["CEF", "LEEF-legacy"]) - grok: source: log.paCefExtensions @@ -1309,9 +1073,7 @@ pipeline: - fieldName: log.paIgnored pattern: ^(?:[A-Za-z][A-Za-z0-9_]*=(?:\\.|[^=\\])*?[ \t]+)*?PanOSProxyType= - fieldName: log.PanOSProxyType - pattern: (?:\\.|[^=\\])*? - - fieldName: log.paSuffix - pattern: (?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) + pattern: (?:\\.|[^=\\])*?(?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) where: oneOf("log.paFormat", ["CEF", "LEEF-legacy"]) - grok: source: log.paCefExtensions @@ -1319,9 +1081,7 @@ pipeline: - fieldName: log.paIgnored pattern: ^(?:[A-Za-z][A-Za-z0-9_]*=(?:\\.|[^=\\])*?[ \t]+)*?PanOSPublicIPv4= - fieldName: log.PanOSPublicIPv4 - pattern: (?:\\.|[^=\\])*? - - fieldName: log.paSuffix - pattern: (?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) + pattern: (?:\\.|[^=\\])*?(?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) where: oneOf("log.paFormat", ["CEF", "LEEF-legacy"]) - grok: source: log.paCefExtensions @@ -1329,9 +1089,7 @@ pipeline: - fieldName: log.paIgnored pattern: ^(?:[A-Za-z][A-Za-z0-9_]*=(?:\\.|[^=\\])*?[ \t]+)*?PanOSPublicIPv6= - fieldName: log.PanOSPublicIPv6 - pattern: (?:\\.|[^=\\])*? - - fieldName: log.paSuffix - pattern: (?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) + pattern: (?:\\.|[^=\\])*?(?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) where: oneOf("log.paFormat", ["CEF", "LEEF-legacy"]) - grok: source: log.paCefExtensions @@ -1339,9 +1097,7 @@ pipeline: - fieldName: log.paIgnored pattern: ^(?:[A-Za-z][A-Za-z0-9_]*=(?:\\.|[^=\\])*?[ \t]+)*?PanOSQuarantineReason= - fieldName: log.PanOSQuarantineReason - pattern: (?:\\.|[^=\\])*? - - fieldName: log.paSuffix - pattern: (?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) + pattern: (?:\\.|[^=\\])*?(?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) where: oneOf("log.paFormat", ["CEF", "LEEF-legacy"]) - grok: source: log.paCefExtensions @@ -1349,9 +1105,7 @@ pipeline: - fieldName: log.paIgnored pattern: ^(?:[A-Za-z][A-Za-z0-9_]*=(?:\\.|[^=\\])*?[ \t]+)*?PanOSRadioTech= - fieldName: log.PanOSRadioTech - pattern: (?:\\.|[^=\\])*? - - fieldName: log.paSuffix - pattern: (?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) + pattern: (?:\\.|[^=\\])*?(?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) where: oneOf("log.paFormat", ["CEF", "LEEF-legacy"]) - grok: source: log.paCefExtensions @@ -1359,9 +1113,7 @@ pipeline: - fieldName: log.paIgnored pattern: ^(?:[A-Za-z][A-Za-z0-9_]*=(?:\\.|[^=\\])*?[ \t]+)*?PanOSReferer= - fieldName: log.PanOSReferer - pattern: (?:\\.|[^=\\])*? - - fieldName: log.paSuffix - pattern: (?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) + pattern: (?:\\.|[^=\\])*?(?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) where: oneOf("log.paFormat", ["CEF", "LEEF-legacy"]) - grok: source: log.paCefExtensions @@ -1369,9 +1121,7 @@ pipeline: - fieldName: log.paIgnored pattern: ^(?:[A-Za-z][A-Za-z0-9_]*=(?:\\.|[^=\\])*?[ \t]+)*?PanOSRmtUserID= - fieldName: log.PanOSRmtUserID - pattern: (?:\\.|[^=\\])*? - - fieldName: log.paSuffix - pattern: (?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) + pattern: (?:\\.|[^=\\])*?(?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) where: oneOf("log.paFormat", ["CEF", "LEEF-legacy"]) - grok: source: log.paCefExtensions @@ -1379,9 +1129,7 @@ pipeline: - fieldName: log.paIgnored pattern: ^(?:[A-Za-z][A-Za-z0-9_]*=(?:\\.|[^=\\])*?[ \t]+)*?PanOSRmtUserIP= - fieldName: log.PanOSRmtUserIP - pattern: (?:\\.|[^=\\])*? - - fieldName: log.paSuffix - pattern: (?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) + pattern: (?:\\.|[^=\\])*?(?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) where: oneOf("log.paFormat", ["CEF", "LEEF-legacy"]) - grok: source: log.paCefExtensions @@ -1389,9 +1137,7 @@ pipeline: - fieldName: log.paIgnored pattern: ^(?:[A-Za-z][A-Za-z0-9_]*=(?:\\.|[^=\\])*?[ \t]+)*?PanOSRootCNLength= - fieldName: log.PanOSRootCNLength - pattern: (?:\\.|[^=\\])*? - - fieldName: log.paSuffix - pattern: (?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) + pattern: (?:\\.|[^=\\])*?(?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) where: oneOf("log.paFormat", ["CEF", "LEEF-legacy"]) - grok: source: log.paCefExtensions @@ -1399,9 +1145,7 @@ pipeline: - fieldName: log.paIgnored pattern: ^(?:[A-Za-z][A-Za-z0-9_]*=(?:\\.|[^=\\])*?[ \t]+)*?PanOSRootCommonName= - fieldName: log.PanOSRootCommonName - pattern: (?:\\.|[^=\\])*? - - fieldName: log.paSuffix - pattern: (?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) + pattern: (?:\\.|[^=\\])*?(?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) where: oneOf("log.paFormat", ["CEF", "LEEF-legacy"]) - grok: source: log.paCefExtensions @@ -1409,9 +1153,7 @@ pipeline: - fieldName: log.paIgnored pattern: ^(?:[A-Za-z][A-Za-z0-9_]*=(?:\\.|[^=\\])*?[ \t]+)*?PanOSRootStatus= - fieldName: log.PanOSRootStatus - pattern: (?:\\.|[^=\\])*? - - fieldName: log.paSuffix - pattern: (?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) + pattern: (?:\\.|[^=\\])*?(?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) where: oneOf("log.paFormat", ["CEF", "LEEF-legacy"]) - grok: source: log.paCefExtensions @@ -1419,9 +1161,7 @@ pipeline: - fieldName: log.paIgnored pattern: ^(?:[A-Za-z][A-Za-z0-9_]*=(?:\\.|[^=\\])*?[ \t]+)*?PanOSRuleUUID= - fieldName: log.PanOSRuleUUID - pattern: (?:\\.|[^=\\])*? - - fieldName: log.paSuffix - pattern: (?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) + pattern: (?:\\.|[^=\\])*?(?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) where: oneOf("log.paFormat", ["CEF", "LEEF-legacy"]) - grok: source: log.paCefExtensions @@ -1429,9 +1169,7 @@ pipeline: - fieldName: log.paIgnored pattern: ^(?:[A-Za-z][A-Za-z0-9_]*=(?:\\.|[^=\\])*?[ \t]+)*?PanOSSCCPCallingGT= - fieldName: log.PanOSSCCPCallingGT - pattern: (?:\\.|[^=\\])*? - - fieldName: log.paSuffix - pattern: (?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) + pattern: (?:\\.|[^=\\])*?(?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) where: oneOf("log.paFormat", ["CEF", "LEEF-legacy"]) - grok: source: log.paCefExtensions @@ -1439,9 +1177,7 @@ pipeline: - fieldName: log.paIgnored pattern: ^(?:[A-Za-z][A-Za-z0-9_]*=(?:\\.|[^=\\])*?[ \t]+)*?PanOSSCCPCallingPartySSN= - fieldName: log.PanOSSCCPCallingPartySSN - pattern: (?:\\.|[^=\\])*? - - fieldName: log.paSuffix - pattern: (?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) + pattern: (?:\\.|[^=\\])*?(?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) where: oneOf("log.paFormat", ["CEF", "LEEF-legacy"]) - grok: source: log.paCefExtensions @@ -1449,9 +1185,7 @@ pipeline: - fieldName: log.paIgnored pattern: ^(?:[A-Za-z][A-Za-z0-9_]*=(?:\\.|[^=\\])*?[ \t]+)*?PanOSSCTPAssocEndReason= - fieldName: log.PanOSSCTPAssocEndReason - pattern: (?:\\.|[^=\\])*? - - fieldName: log.paSuffix - pattern: (?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) + pattern: (?:\\.|[^=\\])*?(?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) where: oneOf("log.paFormat", ["CEF", "LEEF-legacy"]) - grok: source: log.paCefExtensions @@ -1459,9 +1193,7 @@ pipeline: - fieldName: log.paIgnored pattern: ^(?:[A-Za-z][A-Za-z0-9_]*=(?:\\.|[^=\\])*?[ \t]+)*?PanOSSCTPAssocID= - fieldName: log.PanOSSCTPAssocID - pattern: (?:\\.|[^=\\])*? - - fieldName: log.paSuffix - pattern: (?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) + pattern: (?:\\.|[^=\\])*?(?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) where: oneOf("log.paFormat", ["CEF", "LEEF-legacy"]) - grok: source: log.paCefExtensions @@ -1469,9 +1201,7 @@ pipeline: - fieldName: log.paIgnored pattern: ^(?:[A-Za-z][A-Za-z0-9_]*=(?:\\.|[^=\\])*?[ \t]+)*?PanOSSCTPCauseCode= - fieldName: log.PanOSSCTPCauseCode - pattern: (?:\\.|[^=\\])*? - - fieldName: log.paSuffix - pattern: (?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) + pattern: (?:\\.|[^=\\])*?(?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) where: oneOf("log.paFormat", ["CEF", "LEEF-legacy"]) - grok: source: log.paCefExtensions @@ -1479,9 +1209,7 @@ pipeline: - fieldName: log.paIgnored pattern: ^(?:[A-Za-z][A-Za-z0-9_]*=(?:\\.|[^=\\])*?[ \t]+)*?PanOSSCTPChunkRcv= - fieldName: log.PanOSSCTPChunkRcv - pattern: (?:\\.|[^=\\])*? - - fieldName: log.paSuffix - pattern: (?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) + pattern: (?:\\.|[^=\\])*?(?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) where: oneOf("log.paFormat", ["CEF", "LEEF-legacy"]) - grok: source: log.paCefExtensions @@ -1489,9 +1217,7 @@ pipeline: - fieldName: log.paIgnored pattern: ^(?:[A-Za-z][A-Za-z0-9_]*=(?:\\.|[^=\\])*?[ \t]+)*?PanOSSCTPChunkSent= - fieldName: log.PanOSSCTPChunkSent - pattern: (?:\\.|[^=\\])*? - - fieldName: log.paSuffix - pattern: (?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) + pattern: (?:\\.|[^=\\])*?(?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) where: oneOf("log.paFormat", ["CEF", "LEEF-legacy"]) - grok: source: log.paCefExtensions @@ -1499,9 +1225,7 @@ pipeline: - fieldName: log.paIgnored pattern: ^(?:[A-Za-z][A-Za-z0-9_]*=(?:\\.|[^=\\])*?[ \t]+)*?PanOSSCTPChunks= - fieldName: log.PanOSSCTPChunks - pattern: (?:\\.|[^=\\])*? - - fieldName: log.paSuffix - pattern: (?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) + pattern: (?:\\.|[^=\\])*?(?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) where: oneOf("log.paFormat", ["CEF", "LEEF-legacy"]) - grok: source: log.paCefExtensions @@ -1509,9 +1233,7 @@ pipeline: - fieldName: log.paIgnored pattern: ^(?:[A-Za-z][A-Za-z0-9_]*=(?:\\.|[^=\\])*?[ \t]+)*?PanOSSCTPChunksRcv= - fieldName: log.PanOSSCTPChunksRcv - pattern: (?:\\.|[^=\\])*? - - fieldName: log.paSuffix - pattern: (?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) + pattern: (?:\\.|[^=\\])*?(?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) where: oneOf("log.paFormat", ["CEF", "LEEF-legacy"]) - grok: source: log.paCefExtensions @@ -1519,9 +1241,7 @@ pipeline: - fieldName: log.paIgnored pattern: ^(?:[A-Za-z][A-Za-z0-9_]*=(?:\\.|[^=\\])*?[ \t]+)*?PanOSSCTPFilter= - fieldName: log.PanOSSCTPFilter - pattern: (?:\\.|[^=\\])*? - - fieldName: log.paSuffix - pattern: (?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) + pattern: (?:\\.|[^=\\])*?(?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) where: oneOf("log.paFormat", ["CEF", "LEEF-legacy"]) - grok: source: log.paCefExtensions @@ -1529,9 +1249,7 @@ pipeline: - fieldName: log.paIgnored pattern: ^(?:[A-Za-z][A-Za-z0-9_]*=(?:\\.|[^=\\])*?[ \t]+)*?PanOSSCTPStreamID= - fieldName: log.PanOSSCTPStreamID - pattern: (?:\\.|[^=\\])*? - - fieldName: log.paSuffix - pattern: (?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) + pattern: (?:\\.|[^=\\])*?(?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) where: oneOf("log.paFormat", ["CEF", "LEEF-legacy"]) - grok: source: log.paCefExtensions @@ -1539,9 +1257,7 @@ pipeline: - fieldName: log.paIgnored pattern: ^(?:[A-Za-z][A-Za-z0-9_]*=(?:\\.|[^=\\])*?[ \t]+)*?PanOSSCTPVerTag1= - fieldName: log.PanOSSCTPVerTag1 - pattern: (?:\\.|[^=\\])*? - - fieldName: log.paSuffix - pattern: (?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) + pattern: (?:\\.|[^=\\])*?(?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) where: oneOf("log.paFormat", ["CEF", "LEEF-legacy"]) - grok: source: log.paCefExtensions @@ -1549,9 +1265,7 @@ pipeline: - fieldName: log.paIgnored pattern: ^(?:[A-Za-z][A-Za-z0-9_]*=(?:\\.|[^=\\])*?[ \t]+)*?PanOSSCTPVerTag2= - fieldName: log.PanOSSCTPVerTag2 - pattern: (?:\\.|[^=\\])*? - - fieldName: log.paSuffix - pattern: (?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) + pattern: (?:\\.|[^=\\])*?(?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) where: oneOf("log.paFormat", ["CEF", "LEEF-legacy"]) - grok: source: log.paCefExtensions @@ -1559,9 +1273,7 @@ pipeline: - fieldName: log.paIgnored pattern: ^(?:[A-Za-z][A-Za-z0-9_]*=(?:\\.|[^=\\])*?[ \t]+)*?PanOSSNILength= - fieldName: log.PanOSSNILength - pattern: (?:\\.|[^=\\])*? - - fieldName: log.paSuffix - pattern: (?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) + pattern: (?:\\.|[^=\\])*?(?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) where: oneOf("log.paFormat", ["CEF", "LEEF-legacy"]) - grok: source: log.paCefExtensions @@ -1569,9 +1281,7 @@ pipeline: - fieldName: log.paIgnored pattern: ^(?:[A-Za-z][A-Za-z0-9_]*=(?:\\.|[^=\\])*?[ \t]+)*?PanOSSSLResponseTime= - fieldName: log.PanOSSSLResponseTime - pattern: (?:\\.|[^=\\])*? - - fieldName: log.paSuffix - pattern: (?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) + pattern: (?:\\.|[^=\\])*?(?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) where: oneOf("log.paFormat", ["CEF", "LEEF-legacy"]) - grok: source: log.paCefExtensions @@ -1579,9 +1289,7 @@ pipeline: - fieldName: log.paIgnored pattern: ^(?:[A-Za-z][A-Za-z0-9_]*=(?:\\.|[^=\\])*?[ \t]+)*?PanOSSequenceNo= - fieldName: log.PanOSSequenceNo - pattern: (?:\\.|[^=\\])*? - - fieldName: log.paSuffix - pattern: (?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) + pattern: (?:\\.|[^=\\])*?(?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) where: oneOf("log.paFormat", ["CEF", "LEEF-legacy"]) - grok: source: log.paCefExtensions @@ -1589,9 +1297,7 @@ pipeline: - fieldName: log.paIgnored pattern: ^(?:[A-Za-z][A-Za-z0-9_]*=(?:\\.|[^=\\])*?[ \t]+)*?PanOSServerNameIndication= - fieldName: log.PanOSServerNameIndication - pattern: (?:\\.|[^=\\])*? - - fieldName: log.paSuffix - pattern: (?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) + pattern: (?:\\.|[^=\\])*?(?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) where: oneOf("log.paFormat", ["CEF", "LEEF-legacy"]) - grok: source: log.paCefExtensions @@ -1599,9 +1305,7 @@ pipeline: - fieldName: log.paIgnored pattern: ^(?:[A-Za-z][A-Za-z0-9_]*=(?:\\.|[^=\\])*?[ \t]+)*?PanOSServingCntryMCC= - fieldName: log.PanOSServingCntryMCC - pattern: (?:\\.|[^=\\])*? - - fieldName: log.paSuffix - pattern: (?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) + pattern: (?:\\.|[^=\\])*?(?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) where: oneOf("log.paFormat", ["CEF", "LEEF-legacy"]) - grok: source: log.paCefExtensions @@ -1609,9 +1313,7 @@ pipeline: - fieldName: log.paIgnored pattern: ^(?:[A-Za-z][A-Za-z0-9_]*=(?:\\.|[^=\\])*?[ \t]+)*?PanOSServingNetMNC= - fieldName: log.PanOSServingNetMNC - pattern: (?:\\.|[^=\\])*? - - fieldName: log.paSuffix - pattern: (?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) + pattern: (?:\\.|[^=\\])*?(?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) where: oneOf("log.paFormat", ["CEF", "LEEF-legacy"]) - grok: source: log.paCefExtensions @@ -1619,9 +1321,7 @@ pipeline: - fieldName: log.paIgnored pattern: ^(?:[A-Za-z][A-Za-z0-9_]*=(?:\\.|[^=\\])*?[ \t]+)*?PanOSSeverity= - fieldName: log.PanOSSeverity - pattern: (?:\\.|[^=\\])*? - - fieldName: log.paSuffix - pattern: (?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) + pattern: (?:\\.|[^=\\])*?(?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) where: oneOf("log.paFormat", ["CEF", "LEEF-legacy"]) - grok: source: log.paCefExtensions @@ -1629,9 +1329,7 @@ pipeline: - fieldName: log.paIgnored pattern: ^(?:[A-Za-z][A-Za-z0-9_]*=(?:\\.|[^=\\])*?[ \t]+)*?PanOSSourceDeviceCategory= - fieldName: log.PanOSSourceDeviceCategory - pattern: (?:\\.|[^=\\])*? - - fieldName: log.paSuffix - pattern: (?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) + pattern: (?:\\.|[^=\\])*?(?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) where: oneOf("log.paFormat", ["CEF", "LEEF-legacy"]) - grok: source: log.paCefExtensions @@ -1639,9 +1337,7 @@ pipeline: - fieldName: log.paIgnored pattern: ^(?:[A-Za-z][A-Za-z0-9_]*=(?:\\.|[^=\\])*?[ \t]+)*?PanOSSourceDeviceHost= - fieldName: log.PanOSSourceDeviceHost - pattern: (?:\\.|[^=\\])*? - - fieldName: log.paSuffix - pattern: (?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) + pattern: (?:\\.|[^=\\])*?(?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) where: oneOf("log.paFormat", ["CEF", "LEEF-legacy"]) - grok: source: log.paCefExtensions @@ -1649,9 +1345,7 @@ pipeline: - fieldName: log.paIgnored pattern: ^(?:[A-Za-z][A-Za-z0-9_]*=(?:\\.|[^=\\])*?[ \t]+)*?PanOSSourceDeviceMac= - fieldName: log.PanOSSourceDeviceMac - pattern: (?:\\.|[^=\\])*? - - fieldName: log.paSuffix - pattern: (?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) + pattern: (?:\\.|[^=\\])*?(?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) where: oneOf("log.paFormat", ["CEF", "LEEF-legacy"]) - grok: source: log.paCefExtensions @@ -1659,9 +1353,7 @@ pipeline: - fieldName: log.paIgnored pattern: ^(?:[A-Za-z][A-Za-z0-9_]*=(?:\\.|[^=\\])*?[ \t]+)*?PanOSSourceDeviceModel= - fieldName: log.PanOSSourceDeviceModel - pattern: (?:\\.|[^=\\])*? - - fieldName: log.paSuffix - pattern: (?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) + pattern: (?:\\.|[^=\\])*?(?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) where: oneOf("log.paFormat", ["CEF", "LEEF-legacy"]) - grok: source: log.paCefExtensions @@ -1669,9 +1361,7 @@ pipeline: - fieldName: log.paIgnored pattern: ^(?:[A-Za-z][A-Za-z0-9_]*=(?:\\.|[^=\\])*?[ \t]+)*?PanOSSourceDeviceOSFamily= - fieldName: log.PanOSSourceDeviceOSFamily - pattern: (?:\\.|[^=\\])*? - - fieldName: log.paSuffix - pattern: (?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) + pattern: (?:\\.|[^=\\])*?(?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) where: oneOf("log.paFormat", ["CEF", "LEEF-legacy"]) - grok: source: log.paCefExtensions @@ -1679,9 +1369,7 @@ pipeline: - fieldName: log.paIgnored pattern: ^(?:[A-Za-z][A-Za-z0-9_]*=(?:\\.|[^=\\])*?[ \t]+)*?PanOSSourceDeviceOSVersion= - fieldName: log.PanOSSourceDeviceOSVersion - pattern: (?:\\.|[^=\\])*? - - fieldName: log.paSuffix - pattern: (?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) + pattern: (?:\\.|[^=\\])*?(?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) where: oneOf("log.paFormat", ["CEF", "LEEF-legacy"]) - grok: source: log.paCefExtensions @@ -1689,9 +1377,7 @@ pipeline: - fieldName: log.paIgnored pattern: ^(?:[A-Za-z][A-Za-z0-9_]*=(?:\\.|[^=\\])*?[ \t]+)*?PanOSSourceDeviceProfile= - fieldName: log.PanOSSourceDeviceProfile - pattern: (?:\\.|[^=\\])*? - - fieldName: log.paSuffix - pattern: (?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) + pattern: (?:\\.|[^=\\])*?(?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) where: oneOf("log.paFormat", ["CEF", "LEEF-legacy"]) - grok: source: log.paCefExtensions @@ -1699,9 +1385,7 @@ pipeline: - fieldName: log.paIgnored pattern: ^(?:[A-Za-z][A-Za-z0-9_]*=(?:\\.|[^=\\])*?[ \t]+)*?PanOSSourceDeviceVendor= - fieldName: log.PanOSSourceDeviceVendor - pattern: (?:\\.|[^=\\])*? - - fieldName: log.paSuffix - pattern: (?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) + pattern: (?:\\.|[^=\\])*?(?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) where: oneOf("log.paFormat", ["CEF", "LEEF-legacy"]) - grok: source: log.paCefExtensions @@ -1709,9 +1393,7 @@ pipeline: - fieldName: log.paIgnored pattern: ^(?:[A-Za-z][A-Za-z0-9_]*=(?:\\.|[^=\\])*?[ \t]+)*?PanOSSourceDynamicAddressGroup= - fieldName: log.PanOSSourceDynamicAddressGroup - pattern: (?:\\.|[^=\\])*? - - fieldName: log.paSuffix - pattern: (?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) + pattern: (?:\\.|[^=\\])*?(?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) where: oneOf("log.paFormat", ["CEF", "LEEF-legacy"]) - grok: source: log.paCefExtensions @@ -1719,9 +1401,7 @@ pipeline: - fieldName: log.paIgnored pattern: ^(?:[A-Za-z][A-Za-z0-9_]*=(?:\\.|[^=\\])*?[ \t]+)*?PanOSSourceEDL= - fieldName: log.PanOSSourceEDL - pattern: (?:\\.|[^=\\])*? - - fieldName: log.paSuffix - pattern: (?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) + pattern: (?:\\.|[^=\\])*?(?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) where: oneOf("log.paFormat", ["CEF", "LEEF-legacy"]) - grok: source: log.paCefExtensions @@ -1729,9 +1409,7 @@ pipeline: - fieldName: log.paIgnored pattern: ^(?:[A-Za-z][A-Za-z0-9_]*=(?:\\.|[^=\\])*?[ \t]+)*?PanOSSourceHostname= - fieldName: log.PanOSSourceHostname - pattern: (?:\\.|[^=\\])*? - - fieldName: log.paSuffix - pattern: (?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) + pattern: (?:\\.|[^=\\])*?(?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) where: oneOf("log.paFormat", ["CEF", "LEEF-legacy"]) - grok: source: log.paCefExtensions @@ -1739,9 +1417,7 @@ pipeline: - fieldName: log.paIgnored pattern: ^(?:[A-Za-z][A-Za-z0-9_]*=(?:\\.|[^=\\])*?[ \t]+)*?PanOSSourceMac= - fieldName: log.PanOSSourceMac - pattern: (?:\\.|[^=\\])*? - - fieldName: log.paSuffix - pattern: (?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) + pattern: (?:\\.|[^=\\])*?(?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) where: oneOf("log.paFormat", ["CEF", "LEEF-legacy"]) - grok: source: log.paCefExtensions @@ -1749,9 +1425,7 @@ pipeline: - fieldName: log.paIgnored pattern: ^(?:[A-Za-z][A-Za-z0-9_]*=(?:\\.|[^=\\])*?[ \t]+)*?PanOSSourceRegion= - fieldName: log.PanOSSourceRegion - pattern: (?:\\.|[^=\\])*? - - fieldName: log.paSuffix - pattern: (?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) + pattern: (?:\\.|[^=\\])*?(?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) where: oneOf("log.paFormat", ["CEF", "LEEF-legacy"]) - grok: source: log.paCefExtensions @@ -1759,9 +1433,7 @@ pipeline: - fieldName: log.paIgnored pattern: ^(?:[A-Za-z][A-Za-z0-9_]*=(?:\\.|[^=\\])*?[ \t]+)*?PanOSSourceUUID= - fieldName: log.PanOSSourceUUID - pattern: (?:\\.|[^=\\])*? - - fieldName: log.paSuffix - pattern: (?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) + pattern: (?:\\.|[^=\\])*?(?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) where: oneOf("log.paFormat", ["CEF", "LEEF-legacy"]) - grok: source: log.paCefExtensions @@ -1769,9 +1441,7 @@ pipeline: - fieldName: log.paIgnored pattern: ^(?:[A-Za-z][A-Za-z0-9_]*=(?:\\.|[^=\\])*?[ \t]+)*?PanOSSourceUserName= - fieldName: log.PanOSSourceUserName - pattern: (?:\\.|[^=\\])*? - - fieldName: log.paSuffix - pattern: (?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) + pattern: (?:\\.|[^=\\])*?(?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) where: oneOf("log.paFormat", ["CEF", "LEEF-legacy"]) - grok: source: log.paCefExtensions @@ -1779,9 +1449,7 @@ pipeline: - fieldName: log.paIgnored pattern: ^(?:[A-Za-z][A-Za-z0-9_]*=(?:\\.|[^=\\])*?[ \t]+)*?PanOSSrcUUID= - fieldName: log.PanOSSrcUUID - pattern: (?:\\.|[^=\\])*? - - fieldName: log.paSuffix - pattern: (?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) + pattern: (?:\\.|[^=\\])*?(?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) where: oneOf("log.paFormat", ["CEF", "LEEF-legacy"]) - grok: source: log.paCefExtensions @@ -1789,9 +1457,7 @@ pipeline: - fieldName: log.paIgnored pattern: ^(?:[A-Za-z][A-Za-z0-9_]*=(?:\\.|[^=\\])*?[ \t]+)*?PanOSStage= - fieldName: log.PanOSStage - pattern: (?:\\.|[^=\\])*? - - fieldName: log.paSuffix - pattern: (?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) + pattern: (?:\\.|[^=\\])*?(?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) where: oneOf("log.paFormat", ["CEF", "LEEF-legacy"]) - grok: source: log.paCefExtensions @@ -1799,9 +1465,7 @@ pipeline: - fieldName: log.paIgnored pattern: ^(?:[A-Za-z][A-Za-z0-9_]*=(?:\\.|[^=\\])*?[ \t]+)*?PanOSTLSAuth= - fieldName: log.PanOSTLSAuth - pattern: (?:\\.|[^=\\])*? - - fieldName: log.paSuffix - pattern: (?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) + pattern: (?:\\.|[^=\\])*?(?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) where: oneOf("log.paFormat", ["CEF", "LEEF-legacy"]) - grok: source: log.paCefExtensions @@ -1809,9 +1473,7 @@ pipeline: - fieldName: log.paIgnored pattern: ^(?:[A-Za-z][A-Za-z0-9_]*=(?:\\.|[^=\\])*?[ \t]+)*?PanOSTLSEncryptionAlgorithm= - fieldName: log.PanOSTLSEncryptionAlgorithm - pattern: (?:\\.|[^=\\])*? - - fieldName: log.paSuffix - pattern: (?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) + pattern: (?:\\.|[^=\\])*?(?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) where: oneOf("log.paFormat", ["CEF", "LEEF-legacy"]) - grok: source: log.paCefExtensions @@ -1819,9 +1481,7 @@ pipeline: - fieldName: log.paIgnored pattern: ^(?:[A-Za-z][A-Za-z0-9_]*=(?:\\.|[^=\\])*?[ \t]+)*?PanOSTLSKeyExchange= - fieldName: log.PanOSTLSKeyExchange - pattern: (?:\\.|[^=\\])*? - - fieldName: log.paSuffix - pattern: (?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) + pattern: (?:\\.|[^=\\])*?(?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) where: oneOf("log.paFormat", ["CEF", "LEEF-legacy"]) - grok: source: log.paCefExtensions @@ -1829,9 +1489,7 @@ pipeline: - fieldName: log.paIgnored pattern: ^(?:[A-Za-z][A-Za-z0-9_]*=(?:\\.|[^=\\])*?[ \t]+)*?PanOSTLSVersion= - fieldName: log.PanOSTLSVersion - pattern: (?:\\.|[^=\\])*? - - fieldName: log.paSuffix - pattern: (?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) + pattern: (?:\\.|[^=\\])*?(?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) where: oneOf("log.paFormat", ["CEF", "LEEF-legacy"]) - grok: source: log.paCefExtensions @@ -1839,9 +1497,7 @@ pipeline: - fieldName: log.paIgnored pattern: ^(?:[A-Za-z][A-Za-z0-9_]*=(?:\\.|[^=\\])*?[ \t]+)*?PanOSTagName= - fieldName: log.PanOSTagName - pattern: (?:\\.|[^=\\])*? - - fieldName: log.paSuffix - pattern: (?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) + pattern: (?:\\.|[^=\\])*?(?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) where: oneOf("log.paFormat", ["CEF", "LEEF-legacy"]) - grok: source: log.paCefExtensions @@ -1849,9 +1505,7 @@ pipeline: - fieldName: log.paIgnored pattern: ^(?:[A-Za-z][A-Za-z0-9_]*=(?:\\.|[^=\\])*?[ \t]+)*?PanOSThreatCategory= - fieldName: log.PanOSThreatCategory - pattern: (?:\\.|[^=\\])*? - - fieldName: log.paSuffix - pattern: (?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) + pattern: (?:\\.|[^=\\])*?(?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) where: oneOf("log.paFormat", ["CEF", "LEEF-legacy"]) - grok: source: log.paCefExtensions @@ -1859,9 +1513,7 @@ pipeline: - fieldName: log.paIgnored pattern: ^(?:[A-Za-z][A-Za-z0-9_]*=(?:\\.|[^=\\])*?[ \t]+)*?PanOSTimeGeneratedHighResolution= - fieldName: log.PanOSTimeGeneratedHighResolution - pattern: (?:\\.|[^=\\])*? - - fieldName: log.paSuffix - pattern: (?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) + pattern: (?:\\.|[^=\\])*?(?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) where: oneOf("log.paFormat", ["CEF", "LEEF-legacy"]) - grok: source: log.paCefExtensions @@ -1869,9 +1521,7 @@ pipeline: - fieldName: log.paIgnored pattern: ^(?:[A-Za-z][A-Za-z0-9_]*=(?:\\.|[^=\\])*?[ \t]+)*?PanOSTimeNotAfter= - fieldName: log.PanOSTimeNotAfter - pattern: (?:\\.|[^=\\])*? - - fieldName: log.paSuffix - pattern: (?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) + pattern: (?:\\.|[^=\\])*?(?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) where: oneOf("log.paFormat", ["CEF", "LEEF-legacy"]) - grok: source: log.paCefExtensions @@ -1879,9 +1529,7 @@ pipeline: - fieldName: log.paIgnored pattern: ^(?:[A-Za-z][A-Za-z0-9_]*=(?:\\.|[^=\\])*?[ \t]+)*?PanOSTimeNotBefore= - fieldName: log.PanOSTimeNotBefore - pattern: (?:\\.|[^=\\])*? - - fieldName: log.paSuffix - pattern: (?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) + pattern: (?:\\.|[^=\\])*?(?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) where: oneOf("log.paFormat", ["CEF", "LEEF-legacy"]) - grok: source: log.paCefExtensions @@ -1889,9 +1537,7 @@ pipeline: - fieldName: log.paIgnored pattern: ^(?:[A-Za-z][A-Za-z0-9_]*=(?:\\.|[^=\\])*?[ \t]+)*?PanOSTimeReceivedManagementPlane= - fieldName: log.PanOSTimeReceivedManagementPlane - pattern: (?:\\.|[^=\\])*? - - fieldName: log.paSuffix - pattern: (?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) + pattern: (?:\\.|[^=\\])*?(?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) where: oneOf("log.paFormat", ["CEF", "LEEF-legacy"]) - grok: source: log.paCefExtensions @@ -1899,9 +1545,7 @@ pipeline: - fieldName: log.paIgnored pattern: ^(?:[A-Za-z][A-Za-z0-9_]*=(?:\\.|[^=\\])*?[ \t]+)*?PanOSTimeout= - fieldName: log.PanOSTimeout - pattern: (?:\\.|[^=\\])*? - - fieldName: log.paSuffix - pattern: (?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) + pattern: (?:\\.|[^=\\])*?(?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) where: oneOf("log.paFormat", ["CEF", "LEEF-legacy"]) - grok: source: log.paCefExtensions @@ -1909,9 +1553,7 @@ pipeline: - fieldName: log.paIgnored pattern: ^(?:[A-Za-z][A-Za-z0-9_]*=(?:\\.|[^=\\])*?[ \t]+)*?PanOSTrafficOriginRegion= - fieldName: log.PanOSTrafficOriginRegion - pattern: (?:\\.|[^=\\])*? - - fieldName: log.paSuffix - pattern: (?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) + pattern: (?:\\.|[^=\\])*?(?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) where: oneOf("log.paFormat", ["CEF", "LEEF-legacy"]) - grok: source: log.paCefExtensions @@ -1919,9 +1561,7 @@ pipeline: - fieldName: log.paIgnored pattern: ^(?:[A-Za-z][A-Za-z0-9_]*=(?:\\.|[^=\\])*?[ \t]+)*?PanOSTrafficSessionID= - fieldName: log.PanOSTrafficSessionID - pattern: (?:\\.|[^=\\])*? - - fieldName: log.paSuffix - pattern: (?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) + pattern: (?:\\.|[^=\\])*?(?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) where: oneOf("log.paFormat", ["CEF", "LEEF-legacy"]) - grok: source: log.paCefExtensions @@ -1929,9 +1569,7 @@ pipeline: - fieldName: log.paIgnored pattern: ^(?:[A-Za-z][A-Za-z0-9_]*=(?:\\.|[^=\\])*?[ \t]+)*?PanOSTunneInspectionRule= - fieldName: log.PanOSTunneInspectionRule - pattern: (?:\\.|[^=\\])*? - - fieldName: log.paSuffix - pattern: (?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) + pattern: (?:\\.|[^=\\])*?(?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) where: oneOf("log.paFormat", ["CEF", "LEEF-legacy"]) - grok: source: log.paCefExtensions @@ -1939,9 +1577,7 @@ pipeline: - fieldName: log.paIgnored pattern: ^(?:[A-Za-z][A-Za-z0-9_]*=(?:\\.|[^=\\])*?[ \t]+)*?PanOSTunnel= - fieldName: log.PanOSTunnel - pattern: (?:\\.|[^=\\])*? - - fieldName: log.paSuffix - pattern: (?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) + pattern: (?:\\.|[^=\\])*?(?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) where: oneOf("log.paFormat", ["CEF", "LEEF-legacy"]) - grok: source: log.paCefExtensions @@ -1949,9 +1585,7 @@ pipeline: - fieldName: log.paIgnored pattern: ^(?:[A-Za-z][A-Za-z0-9_]*=(?:\\.|[^=\\])*?[ \t]+)*?PanOSTunnelEndptID1= - fieldName: log.PanOSTunnelEndptID1 - pattern: (?:\\.|[^=\\])*? - - fieldName: log.paSuffix - pattern: (?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) + pattern: (?:\\.|[^=\\])*?(?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) where: oneOf("log.paFormat", ["CEF", "LEEF-legacy"]) - grok: source: log.paCefExtensions @@ -1959,9 +1593,7 @@ pipeline: - fieldName: log.paIgnored pattern: ^(?:[A-Za-z][A-Za-z0-9_]*=(?:\\.|[^=\\])*?[ \t]+)*?PanOSTunnelEndptID2= - fieldName: log.PanOSTunnelEndptID2 - pattern: (?:\\.|[^=\\])*? - - fieldName: log.paSuffix - pattern: (?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) + pattern: (?:\\.|[^=\\])*?(?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) where: oneOf("log.paFormat", ["CEF", "LEEF-legacy"]) - grok: source: log.paCefExtensions @@ -1969,9 +1601,7 @@ pipeline: - fieldName: log.paIgnored pattern: ^(?:[A-Za-z][A-Za-z0-9_]*=(?:\\.|[^=\\])*?[ \t]+)*?PanOSTunnelFragment= - fieldName: log.PanOSTunnelFragment - pattern: (?:\\.|[^=\\])*? - - fieldName: log.paSuffix - pattern: (?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) + pattern: (?:\\.|[^=\\])*?(?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) where: oneOf("log.paFormat", ["CEF", "LEEF-legacy"]) - grok: source: log.paCefExtensions @@ -1979,9 +1609,7 @@ pipeline: - fieldName: log.paIgnored pattern: ^(?:[A-Za-z][A-Za-z0-9_]*=(?:\\.|[^=\\])*?[ \t]+)*?PanOSTunnelID= - fieldName: log.PanOSTunnelID - pattern: (?:\\.|[^=\\])*? - - fieldName: log.paSuffix - pattern: (?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) + pattern: (?:\\.|[^=\\])*?(?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) where: oneOf("log.paFormat", ["CEF", "LEEF-legacy"]) - grok: source: log.paCefExtensions @@ -1989,9 +1617,7 @@ pipeline: - fieldName: log.paIgnored pattern: ^(?:[A-Za-z][A-Za-z0-9_]*=(?:\\.|[^=\\])*?[ \t]+)*?PanOSTunnelInspectionRule= - fieldName: log.PanOSTunnelInspectionRule - pattern: (?:\\.|[^=\\])*? - - fieldName: log.paSuffix - pattern: (?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) + pattern: (?:\\.|[^=\\])*?(?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) where: oneOf("log.paFormat", ["CEF", "LEEF-legacy"]) - grok: source: log.paCefExtensions @@ -1999,9 +1625,7 @@ pipeline: - fieldName: log.paIgnored pattern: ^(?:[A-Za-z][A-Za-z0-9_]*=(?:\\.|[^=\\])*?[ \t]+)*?PanOSTunnelType= - fieldName: log.PanOSTunnelType - pattern: (?:\\.|[^=\\])*? - - fieldName: log.paSuffix - pattern: (?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) + pattern: (?:\\.|[^=\\])*?(?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) where: oneOf("log.paFormat", ["CEF", "LEEF-legacy"]) - grok: source: log.paCefExtensions @@ -2009,9 +1633,7 @@ pipeline: - fieldName: log.paIgnored pattern: ^(?:[A-Za-z][A-Za-z0-9_]*=(?:\\.|[^=\\])*?[ \t]+)*?PanOSUGFlags= - fieldName: log.PanOSUGFlags - pattern: (?:\\.|[^=\\])*? - - fieldName: log.paSuffix - pattern: (?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) + pattern: (?:\\.|[^=\\])*?(?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) where: oneOf("log.paFormat", ["CEF", "LEEF-legacy"]) - grok: source: log.paCefExtensions @@ -2019,9 +1641,7 @@ pipeline: - fieldName: log.paIgnored pattern: ^(?:[A-Za-z][A-Za-z0-9_]*=(?:\\.|[^=\\])*?[ \t]+)*?PanOSURLCatList= - fieldName: log.PanOSURLCatList - pattern: (?:\\.|[^=\\])*? - - fieldName: log.paSuffix - pattern: (?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) + pattern: (?:\\.|[^=\\])*?(?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) where: oneOf("log.paFormat", ["CEF", "LEEF-legacy"]) - grok: source: log.paCefExtensions @@ -2029,9 +1649,7 @@ pipeline: - fieldName: log.paIgnored pattern: ^(?:[A-Za-z][A-Za-z0-9_]*=(?:\\.|[^=\\])*?[ \t]+)*?PanOSUserBySource= - fieldName: log.PanOSUserBySource - pattern: (?:\\.|[^=\\])*? - - fieldName: log.paSuffix - pattern: (?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) + pattern: (?:\\.|[^=\\])*?(?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) where: oneOf("log.paFormat", ["CEF", "LEEF-legacy"]) - grok: source: log.paCefExtensions @@ -2039,9 +1657,7 @@ pipeline: - fieldName: log.paIgnored pattern: ^(?:[A-Za-z][A-Za-z0-9_]*=(?:\\.|[^=\\])*?[ \t]+)*?PanOSVirtualSystem= - fieldName: log.PanOSVirtualSystem - pattern: (?:\\.|[^=\\])*? - - fieldName: log.paSuffix - pattern: (?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) + pattern: (?:\\.|[^=\\])*?(?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) where: oneOf("log.paFormat", ["CEF", "LEEF-legacy"]) - grok: source: log.paCefExtensions @@ -2049,9 +1665,7 @@ pipeline: - fieldName: log.paIgnored pattern: ^(?:[A-Za-z][A-Za-z0-9_]*=(?:\\.|[^=\\])*?[ \t]+)*?PanOSVsysName= - fieldName: log.PanOSVsysName - pattern: (?:\\.|[^=\\])*? - - fieldName: log.paSuffix - pattern: (?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) + pattern: (?:\\.|[^=\\])*?(?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) where: oneOf("log.paFormat", ["CEF", "LEEF-legacy"]) - grok: source: log.paCefExtensions @@ -2059,9 +1673,7 @@ pipeline: - fieldName: log.paIgnored pattern: ^(?:[A-Za-z][A-Za-z0-9_]*=(?:\\.|[^=\\])*?[ \t]+)*?PanOSXForwarderfor= - fieldName: log.PanOSXForwarderfor - pattern: (?:\\.|[^=\\])*? - - fieldName: log.paSuffix - pattern: (?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) + pattern: (?:\\.|[^=\\])*?(?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) where: oneOf("log.paFormat", ["CEF", "LEEF-legacy"]) - grok: source: log.paCefExtensions @@ -2069,9 +1681,7 @@ pipeline: - fieldName: log.paIgnored pattern: ^(?:[A-Za-z][A-Za-z0-9_]*=(?:\\.|[^=\\])*?[ \t]+)*?PanOsVsysName= - fieldName: log.PanOsVsysName - pattern: (?:\\.|[^=\\])*? - - fieldName: log.paSuffix - pattern: (?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) + pattern: (?:\\.|[^=\\])*?(?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) where: oneOf("log.paFormat", ["CEF", "LEEF-legacy"]) - grok: source: log.paCefExtensions @@ -2079,9 +1689,7 @@ pipeline: - fieldName: log.paIgnored pattern: ^(?:[A-Za-z][A-Za-z0-9_]*=(?:\\.|[^=\\])*?[ \t]+)*?PanPODName= - fieldName: log.PanPODName - pattern: (?:\\.|[^=\\])*? - - fieldName: log.paSuffix - pattern: (?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) + pattern: (?:\\.|[^=\\])*?(?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) where: oneOf("log.paFormat", ["CEF", "LEEF-legacy"]) - grok: source: log.paCefExtensions @@ -2089,9 +1697,7 @@ pipeline: - fieldName: log.paIgnored pattern: ^(?:[A-Za-z][A-Za-z0-9_]*=(?:\\.|[^=\\])*?[ \t]+)*?PanPODNamespace= - fieldName: log.PanPODNamespace - pattern: (?:\\.|[^=\\])*? - - fieldName: log.paSuffix - pattern: (?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) + pattern: (?:\\.|[^=\\])*?(?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) where: oneOf("log.paFormat", ["CEF", "LEEF-legacy"]) - grok: source: log.paCefExtensions @@ -2099,9 +1705,7 @@ pipeline: - fieldName: log.paIgnored pattern: ^(?:[A-Za-z][A-Za-z0-9_]*=(?:\\.|[^=\\])*?[ \t]+)*?PanPartialHash= - fieldName: log.PanPartialHash - pattern: (?:\\.|[^=\\])*? - - fieldName: log.paSuffix - pattern: (?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) + pattern: (?:\\.|[^=\\])*?(?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) where: oneOf("log.paFormat", ["CEF", "LEEF-legacy"]) - grok: source: log.paCefExtensions @@ -2109,9 +1713,7 @@ pipeline: - fieldName: log.paIgnored pattern: ^(?:[A-Za-z][A-Za-z0-9_]*=(?:\\.|[^=\\])*?[ \t]+)*?PanPolicyID= - fieldName: log.PanPolicyID - pattern: (?:\\.|[^=\\])*? - - fieldName: log.paSuffix - pattern: (?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) + pattern: (?:\\.|[^=\\])*?(?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) where: oneOf("log.paFormat", ["CEF", "LEEF-legacy"]) - grok: source: log.paCefExtensions @@ -2119,9 +1721,7 @@ pipeline: - fieldName: log.paIgnored pattern: ^(?:[A-Za-z][A-Za-z0-9_]*=(?:\\.|[^=\\])*?[ \t]+)*?PanReasonFilteringAction= - fieldName: log.PanReasonFilteringAction - pattern: (?:\\.|[^=\\])*? - - fieldName: log.paSuffix - pattern: (?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) + pattern: (?:\\.|[^=\\])*?(?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) where: oneOf("log.paFormat", ["CEF", "LEEF-legacy"]) - grok: source: log.paCefExtensions @@ -2129,9 +1729,7 @@ pipeline: - fieldName: log.paIgnored pattern: ^(?:[A-Za-z][A-Za-z0-9_]*=(?:\\.|[^=\\])*?[ \t]+)*?PanSDWANCluster= - fieldName: log.PanSDWANCluster - pattern: (?:\\.|[^=\\])*? - - fieldName: log.paSuffix - pattern: (?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) + pattern: (?:\\.|[^=\\])*?(?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) where: oneOf("log.paFormat", ["CEF", "LEEF-legacy"]) - grok: source: log.paCefExtensions @@ -2139,9 +1737,7 @@ pipeline: - fieldName: log.paIgnored pattern: ^(?:[A-Za-z][A-Za-z0-9_]*=(?:\\.|[^=\\])*?[ \t]+)*?PanSDWANClustype= - fieldName: log.PanSDWANClustype - pattern: (?:\\.|[^=\\])*? - - fieldName: log.paSuffix - pattern: (?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) + pattern: (?:\\.|[^=\\])*?(?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) where: oneOf("log.paFormat", ["CEF", "LEEF-legacy"]) - grok: source: log.paCefExtensions @@ -2149,9 +1745,7 @@ pipeline: - fieldName: log.paIgnored pattern: ^(?:[A-Za-z][A-Za-z0-9_]*=(?:\\.|[^=\\])*?[ \t]+)*?PanSDWANDevice= - fieldName: log.PanSDWANDevice - pattern: (?:\\.|[^=\\])*? - - fieldName: log.paSuffix - pattern: (?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) + pattern: (?:\\.|[^=\\])*?(?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) where: oneOf("log.paFormat", ["CEF", "LEEF-legacy"]) - grok: source: log.paCefExtensions @@ -2159,9 +1753,7 @@ pipeline: - fieldName: log.paIgnored pattern: ^(?:[A-Za-z][A-Za-z0-9_]*=(?:\\.|[^=\\])*?[ \t]+)*?PanSDWANSite= - fieldName: log.PanSDWANSite - pattern: (?:\\.|[^=\\])*? - - fieldName: log.paSuffix - pattern: (?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) + pattern: (?:\\.|[^=\\])*?(?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) where: oneOf("log.paFormat", ["CEF", "LEEF-legacy"]) - grok: source: log.paCefExtensions @@ -2169,9 +1761,7 @@ pipeline: - fieldName: log.paIgnored pattern: ^(?:[A-Za-z][A-Za-z0-9_]*=(?:\\.|[^=\\])*?[ \t]+)*?PanSrcDAG= - fieldName: log.PanSrcDAG - pattern: (?:\\.|[^=\\])*? - - fieldName: log.paSuffix - pattern: (?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) + pattern: (?:\\.|[^=\\])*?(?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) where: oneOf("log.paFormat", ["CEF", "LEEF-legacy"]) - grok: source: log.paCefExtensions @@ -2179,9 +1769,7 @@ pipeline: - fieldName: log.paIgnored pattern: ^(?:[A-Za-z][A-Za-z0-9_]*=(?:\\.|[^=\\])*?[ \t]+)*?PanSrcDeviceCat= - fieldName: log.PanSrcDeviceCat - pattern: (?:\\.|[^=\\])*? - - fieldName: log.paSuffix - pattern: (?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) + pattern: (?:\\.|[^=\\])*?(?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) where: oneOf("log.paFormat", ["CEF", "LEEF-legacy"]) - grok: source: log.paCefExtensions @@ -2189,9 +1777,7 @@ pipeline: - fieldName: log.paIgnored pattern: ^(?:[A-Za-z][A-Za-z0-9_]*=(?:\\.|[^=\\])*?[ \t]+)*?PanSrcDeviceModel= - fieldName: log.PanSrcDeviceModel - pattern: (?:\\.|[^=\\])*? - - fieldName: log.paSuffix - pattern: (?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) + pattern: (?:\\.|[^=\\])*?(?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) where: oneOf("log.paFormat", ["CEF", "LEEF-legacy"]) - grok: source: log.paCefExtensions @@ -2199,9 +1785,7 @@ pipeline: - fieldName: log.paIgnored pattern: ^(?:[A-Za-z][A-Za-z0-9_]*=(?:\\.|[^=\\])*?[ \t]+)*?PanSrcDeviceOS= - fieldName: log.PanSrcDeviceOS - pattern: (?:\\.|[^=\\])*? - - fieldName: log.paSuffix - pattern: (?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) + pattern: (?:\\.|[^=\\])*?(?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) where: oneOf("log.paFormat", ["CEF", "LEEF-legacy"]) - grok: source: log.paCefExtensions @@ -2209,9 +1793,7 @@ pipeline: - fieldName: log.paIgnored pattern: ^(?:[A-Za-z][A-Za-z0-9_]*=(?:\\.|[^=\\])*?[ \t]+)*?PanSrcDeviceOSv= - fieldName: log.PanSrcDeviceOSv - pattern: (?:\\.|[^=\\])*? - - fieldName: log.paSuffix - pattern: (?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) + pattern: (?:\\.|[^=\\])*?(?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) where: oneOf("log.paFormat", ["CEF", "LEEF-legacy"]) - grok: source: log.paCefExtensions @@ -2219,9 +1801,7 @@ pipeline: - fieldName: log.paIgnored pattern: ^(?:[A-Za-z][A-Za-z0-9_]*=(?:\\.|[^=\\])*?[ \t]+)*?PanSrcDeviceProf= - fieldName: log.PanSrcDeviceProf - pattern: (?:\\.|[^=\\])*? - - fieldName: log.paSuffix - pattern: (?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) + pattern: (?:\\.|[^=\\])*?(?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) where: oneOf("log.paFormat", ["CEF", "LEEF-legacy"]) - grok: source: log.paCefExtensions @@ -2229,9 +1809,7 @@ pipeline: - fieldName: log.paIgnored pattern: ^(?:[A-Za-z][A-Za-z0-9_]*=(?:\\.|[^=\\])*?[ \t]+)*?PanSrcDeviceVendor= - fieldName: log.PanSrcDeviceVendor - pattern: (?:\\.|[^=\\])*? - - fieldName: log.paSuffix - pattern: (?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) + pattern: (?:\\.|[^=\\])*?(?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) where: oneOf("log.paFormat", ["CEF", "LEEF-legacy"]) - grok: source: log.paCefExtensions @@ -2239,9 +1817,7 @@ pipeline: - fieldName: log.paIgnored pattern: ^(?:[A-Za-z][A-Za-z0-9_]*=(?:\\.|[^=\\])*?[ \t]+)*?PanSrcEDL= - fieldName: log.PanSrcEDL - pattern: (?:\\.|[^=\\])*? - - fieldName: log.paSuffix - pattern: (?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) + pattern: (?:\\.|[^=\\])*?(?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) where: oneOf("log.paFormat", ["CEF", "LEEF-legacy"]) - grok: source: log.paCefExtensions @@ -2249,9 +1825,7 @@ pipeline: - fieldName: log.paIgnored pattern: ^(?:[A-Za-z][A-Za-z0-9_]*=(?:\\.|[^=\\])*?[ \t]+)*?PanSrcHostname= - fieldName: log.PanSrcHostname - pattern: (?:\\.|[^=\\])*? - - fieldName: log.paSuffix - pattern: (?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) + pattern: (?:\\.|[^=\\])*?(?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) where: oneOf("log.paFormat", ["CEF", "LEEF-legacy"]) - grok: source: log.paCefExtensions @@ -2259,9 +1833,7 @@ pipeline: - fieldName: log.paIgnored pattern: ^(?:[A-Za-z][A-Za-z0-9_]*=(?:\\.|[^=\\])*?[ \t]+)*?PanSrcMac= - fieldName: log.PanSrcMac - pattern: (?:\\.|[^=\\])*? - - fieldName: log.paSuffix - pattern: (?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) + pattern: (?:\\.|[^=\\])*?(?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) where: oneOf("log.paFormat", ["CEF", "LEEF-legacy"]) - grok: source: log.paCefExtensions @@ -2269,9 +1841,7 @@ pipeline: - fieldName: log.paIgnored pattern: ^(?:[A-Za-z][A-Za-z0-9_]*=(?:\\.|[^=\\])*?[ \t]+)*?PanTimeHighRes= - fieldName: log.PanTimeHighRes - pattern: (?:\\.|[^=\\])*? - - fieldName: log.paSuffix - pattern: (?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) + pattern: (?:\\.|[^=\\])*?(?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) where: oneOf("log.paFormat", ["CEF", "LEEF-legacy"]) - grok: source: log.paCefExtensions @@ -2279,9 +1849,7 @@ pipeline: - fieldName: log.paIgnored pattern: ^(?:[A-Za-z][A-Za-z0-9_]*=(?:\\.|[^=\\])*?[ \t]+)*?PanXFFIP= - fieldName: log.PanXFFIP - pattern: (?:\\.|[^=\\])*? - - fieldName: log.paSuffix - pattern: (?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) + pattern: (?:\\.|[^=\\])*?(?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) where: oneOf("log.paFormat", ["CEF", "LEEF-legacy"]) - grok: source: log.paCefExtensions @@ -2289,9 +1857,7 @@ pipeline: - fieldName: log.paIgnored pattern: ^(?:[A-Za-z][A-Za-z0-9_]*=(?:\\.|[^=\\])*?[ \t]+)*?SessionIDcn1= - fieldName: log.SessionIDcn1 - pattern: (?:\\.|[^=\\])*? - - fieldName: log.paSuffix - pattern: (?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) + pattern: (?:\\.|[^=\\])*?(?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) where: oneOf("log.paFormat", ["CEF", "LEEF-legacy"]) - grok: source: log.paCefExtensions @@ -2299,9 +1865,7 @@ pipeline: - fieldName: log.paIgnored pattern: ^(?:[A-Za-z][A-Za-z0-9_]*=(?:\\.|[^=\\])*?[ \t]+)*?Typecs5= - fieldName: log.Typecs5 - pattern: (?:\\.|[^=\\])*? - - fieldName: log.paSuffix - pattern: (?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) + pattern: (?:\\.|[^=\\])*?(?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) where: oneOf("log.paFormat", ["CEF", "LEEF-legacy"]) - grok: source: log.paCefExtensions @@ -2309,9 +1873,7 @@ pipeline: - fieldName: log.paIgnored pattern: ^(?:[A-Za-z][A-Za-z0-9_]*=(?:\\.|[^=\\])*?[ \t]+)*?Typecs6= - fieldName: log.Typecs6 - pattern: (?:\\.|[^=\\])*? - - fieldName: log.paSuffix - pattern: (?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) + pattern: (?:\\.|[^=\\])*?(?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) where: oneOf("log.paFormat", ["CEF", "LEEF-legacy"]) - grok: source: log.paCefExtensions @@ -2319,9 +1881,7 @@ pipeline: - fieldName: log.paIgnored pattern: ^(?:[A-Za-z][A-Za-z0-9_]*=(?:\\.|[^=\\])*?[ \t]+)*?VendorflexString2= - fieldName: log.VendorflexString2 - pattern: (?:\\.|[^=\\])*? - - fieldName: log.paSuffix - pattern: (?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) + pattern: (?:\\.|[^=\\])*?(?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) where: oneOf("log.paFormat", ["CEF", "LEEF-legacy"]) - grok: source: log.paCefExtensions @@ -2329,9 +1889,7 @@ pipeline: - fieldName: log.paIgnored pattern: ^(?:[A-Za-z][A-Za-z0-9_]*=(?:\\.|[^=\\])*?[ \t]+)*?act= - fieldName: log.act - pattern: (?:\\.|[^=\\])*? - - fieldName: log.paSuffix - pattern: (?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) + pattern: (?:\\.|[^=\\])*?(?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) where: oneOf("log.paFormat", ["CEF", "LEEF-legacy"]) - grok: source: log.paCefExtensions @@ -2339,9 +1897,7 @@ pipeline: - fieldName: log.paIgnored pattern: ^(?:[A-Za-z][A-Za-z0-9_]*=(?:\\.|[^=\\])*?[ \t]+)*?actionflagsPanOSTimeGeneratedHighResolution= - fieldName: log.actionflagsPanOSTimeGeneratedHighResolution - pattern: (?:\\.|[^=\\])*? - - fieldName: log.paSuffix - pattern: (?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) + pattern: (?:\\.|[^=\\])*?(?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) where: oneOf("log.paFormat", ["CEF", "LEEF-legacy"]) - grok: source: log.paCefExtensions @@ -2349,9 +1905,7 @@ pipeline: - fieldName: log.paIgnored pattern: ^(?:[A-Za-z][A-Za-z0-9_]*=(?:\\.|[^=\\])*?[ \t]+)*?actionflagsanOSTimeGeneratedHighResolution= - fieldName: log.actionflagsanOSTimeGeneratedHighResolution - pattern: (?:\\.|[^=\\])*? - - fieldName: log.paSuffix - pattern: (?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) + pattern: (?:\\.|[^=\\])*?(?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) where: oneOf("log.paFormat", ["CEF", "LEEF-legacy"]) - grok: source: log.paCefExtensions @@ -2359,9 +1913,7 @@ pipeline: - fieldName: log.paIgnored pattern: ^(?:[A-Za-z][A-Za-z0-9_]*=(?:\\.|[^=\\])*?[ \t]+)*?actionrequest= - fieldName: log.actionrequest - pattern: (?:\\.|[^=\\])*? - - fieldName: log.paSuffix - pattern: (?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) + pattern: (?:\\.|[^=\\])*?(?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) where: oneOf("log.paFormat", ["CEF", "LEEF-legacy"]) - grok: source: log.paCefExtensions @@ -2369,9 +1921,7 @@ pipeline: - fieldName: log.paIgnored pattern: ^(?:[A-Za-z][A-Za-z0-9_]*=(?:\\.|[^=\\])*?[ \t]+)*?admindestinationServiceName= - fieldName: log.admindestinationServiceName - pattern: (?:\\.|[^=\\])*? - - fieldName: log.paSuffix - pattern: (?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) + pattern: (?:\\.|[^=\\])*?(?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) where: oneOf("log.paFormat", ["CEF", "LEEF-legacy"]) - grok: source: log.paCefExtensions @@ -2379,9 +1929,7 @@ pipeline: - fieldName: log.paIgnored pattern: ^(?:[A-Za-z][A-Za-z0-9_]*=(?:\\.|[^=\\])*?[ \t]+)*?anOSTimeGeneratedHighResolution= - fieldName: log.anOSTimeGeneratedHighResolution - pattern: (?:\\.|[^=\\])*? - - fieldName: log.paSuffix - pattern: (?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) + pattern: (?:\\.|[^=\\])*?(?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) where: oneOf("log.paFormat", ["CEF", "LEEF-legacy"]) - grok: source: log.paCefExtensions @@ -2389,9 +1937,7 @@ pipeline: - fieldName: log.paIgnored pattern: ^(?:[A-Za-z][A-Za-z0-9_]*=(?:\\.|[^=\\])*?[ \t]+)*?app= - fieldName: log.app - pattern: (?:\\.|[^=\\])*? - - fieldName: log.paSuffix - pattern: (?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) + pattern: (?:\\.|[^=\\])*?(?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) where: oneOf("log.paFormat", ["CEF", "LEEF-legacy"]) - grok: source: log.paCefExtensions @@ -2399,9 +1945,7 @@ pipeline: - fieldName: log.paIgnored pattern: ^(?:[A-Za-z][A-Za-z0-9_]*=(?:\\.|[^=\\])*?[ \t]+)*?c6a2= - fieldName: log.c6a2 - pattern: (?:\\.|[^=\\])*? - - fieldName: log.paSuffix - pattern: (?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) + pattern: (?:\\.|[^=\\])*?(?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) where: oneOf("log.paFormat", ["CEF", "LEEF-legacy"]) - grok: source: log.paCefExtensions @@ -2409,9 +1953,7 @@ pipeline: - fieldName: log.paIgnored pattern: ^(?:[A-Za-z][A-Za-z0-9_]*=(?:\\.|[^=\\])*?[ \t]+)*?c6a2Label= - fieldName: log.c6a2Label - pattern: (?:\\.|[^=\\])*? - - fieldName: log.paSuffix - pattern: (?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) + pattern: (?:\\.|[^=\\])*?(?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) where: oneOf("log.paFormat", ["CEF", "LEEF-legacy"]) - grok: source: log.paCefExtensions @@ -2419,9 +1961,7 @@ pipeline: - fieldName: log.paIgnored pattern: ^(?:[A-Za-z][A-Za-z0-9_]*=(?:\\.|[^=\\])*?[ \t]+)*?cat= - fieldName: log.cat - pattern: (?:\\.|[^=\\])*? - - fieldName: log.paSuffix - pattern: (?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) + pattern: (?:\\.|[^=\\])*?(?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) where: oneOf("log.paFormat", ["CEF", "LEEF-legacy"]) - grok: source: log.paCefExtensions @@ -2429,9 +1969,7 @@ pipeline: - fieldName: log.paIgnored pattern: ^(?:[A-Za-z][A-Za-z0-9_]*=(?:\\.|[^=\\])*?[ \t]+)*?cert_sizePanOSCommonNameLength= - fieldName: log.certSizePanOSCommonNameLength - pattern: (?:\\.|[^=\\])*? - - fieldName: log.paSuffix - pattern: (?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) + pattern: (?:\\.|[^=\\])*?(?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) where: oneOf("log.paFormat", ["CEF", "LEEF-legacy"]) - grok: source: log.paCefExtensions @@ -2439,9 +1977,7 @@ pipeline: - fieldName: log.paIgnored pattern: ^(?:[A-Za-z][A-Za-z0-9_]*=(?:\\.|[^=\\])*?[ \t]+)*?cfp1= - fieldName: log.cfp1 - pattern: (?:\\.|[^=\\])*? - - fieldName: log.paSuffix - pattern: (?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) + pattern: (?:\\.|[^=\\])*?(?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) where: oneOf("log.paFormat", ["CEF", "LEEF-legacy"]) - grok: source: log.paCefExtensions @@ -2449,9 +1985,7 @@ pipeline: - fieldName: log.paIgnored pattern: ^(?:[A-Za-z][A-Za-z0-9_]*=(?:\\.|[^=\\])*?[ \t]+)*?cfp1Label= - fieldName: log.cfp1Label - pattern: (?:\\.|[^=\\])*? - - fieldName: log.paSuffix - pattern: (?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) + pattern: (?:\\.|[^=\\])*?(?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) where: oneOf("log.paFormat", ["CEF", "LEEF-legacy"]) - grok: source: log.paCefExtensions @@ -2459,9 +1993,7 @@ pipeline: - fieldName: log.paIgnored pattern: ^(?:[A-Za-z][A-Za-z0-9_]*=(?:\\.|[^=\\])*?[ \t]+)*?cfp2= - fieldName: log.cfp2 - pattern: (?:\\.|[^=\\])*? - - fieldName: log.paSuffix - pattern: (?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) + pattern: (?:\\.|[^=\\])*?(?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) where: oneOf("log.paFormat", ["CEF", "LEEF-legacy"]) - grok: source: log.paCefExtensions @@ -2469,9 +2001,7 @@ pipeline: - fieldName: log.paIgnored pattern: ^(?:[A-Za-z][A-Za-z0-9_]*=(?:\\.|[^=\\])*?[ \t]+)*?cfp2Label= - fieldName: log.cfp2Label - pattern: (?:\\.|[^=\\])*? - - fieldName: log.paSuffix - pattern: (?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) + pattern: (?:\\.|[^=\\])*?(?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) where: oneOf("log.paFormat", ["CEF", "LEEF-legacy"]) - grok: source: log.paCefExtensions @@ -2479,9 +2009,7 @@ pipeline: - fieldName: log.paIgnored pattern: ^(?:[A-Za-z][A-Za-z0-9_]*=(?:\\.|[^=\\])*?[ \t]+)*?cfp3= - fieldName: log.cfp3 - pattern: (?:\\.|[^=\\])*? - - fieldName: log.paSuffix - pattern: (?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) + pattern: (?:\\.|[^=\\])*?(?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) where: oneOf("log.paFormat", ["CEF", "LEEF-legacy"]) - grok: source: log.paCefExtensions @@ -2489,9 +2017,7 @@ pipeline: - fieldName: log.paIgnored pattern: ^(?:[A-Za-z][A-Za-z0-9_]*=(?:\\.|[^=\\])*?[ \t]+)*?cfp3Label= - fieldName: log.cfp3Label - pattern: (?:\\.|[^=\\])*? - - fieldName: log.paSuffix - pattern: (?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) + pattern: (?:\\.|[^=\\])*?(?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) where: oneOf("log.paFormat", ["CEF", "LEEF-legacy"]) - grok: source: log.paCefExtensions @@ -2499,9 +2025,7 @@ pipeline: - fieldName: log.paIgnored pattern: ^(?:[A-Za-z][A-Za-z0-9_]*=(?:\\.|[^=\\])*?[ \t]+)*?cfp4= - fieldName: log.cfp4 - pattern: (?:\\.|[^=\\])*? - - fieldName: log.paSuffix - pattern: (?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) + pattern: (?:\\.|[^=\\])*?(?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) where: oneOf("log.paFormat", ["CEF", "LEEF-legacy"]) - grok: source: log.paCefExtensions @@ -2509,9 +2033,7 @@ pipeline: - fieldName: log.paIgnored pattern: ^(?:[A-Za-z][A-Za-z0-9_]*=(?:\\.|[^=\\])*?[ \t]+)*?cfp4Label= - fieldName: log.cfp4Label - pattern: (?:\\.|[^=\\])*? - - fieldName: log.paSuffix - pattern: (?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) + pattern: (?:\\.|[^=\\])*?(?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) where: oneOf("log.paFormat", ["CEF", "LEEF-legacy"]) - grok: source: log.paCefExtensions @@ -2519,9 +2041,7 @@ pipeline: - fieldName: log.paIgnored pattern: ^(?:[A-Za-z][A-Za-z0-9_]*=(?:\\.|[^=\\])*?[ \t]+)*?client_osPanOSEndpointOSVersion= - fieldName: log.clientOsPanOSEndpointOSVersion - pattern: (?:\\.|[^=\\])*? - - fieldName: log.paSuffix - pattern: (?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) + pattern: (?:\\.|[^=\\])*?(?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) where: oneOf("log.paFormat", ["CEF", "LEEF-legacy"]) - grok: source: log.paCefExtensions @@ -2529,9 +2049,7 @@ pipeline: - fieldName: log.paIgnored pattern: ^(?:[A-Za-z][A-Za-z0-9_]*=(?:\\.|[^=\\])*?[ \t]+)*?cn1= - fieldName: log.cn1 - pattern: (?:\\.|[^=\\])*? - - fieldName: log.paSuffix - pattern: (?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) + pattern: (?:\\.|[^=\\])*?(?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) where: oneOf("log.paFormat", ["CEF", "LEEF-legacy"]) - grok: source: log.paCefExtensions @@ -2539,9 +2057,7 @@ pipeline: - fieldName: log.paIgnored pattern: ^(?:[A-Za-z][A-Za-z0-9_]*=(?:\\.|[^=\\])*?[ \t]+)*?cn1Label= - fieldName: log.cn1Label - pattern: (?:\\.|[^=\\])*? - - fieldName: log.paSuffix - pattern: (?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) + pattern: (?:\\.|[^=\\])*?(?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) where: oneOf("log.paFormat", ["CEF", "LEEF-legacy"]) - grok: source: log.paCefExtensions @@ -2549,9 +2065,7 @@ pipeline: - fieldName: log.paIgnored pattern: ^(?:[A-Za-z][A-Za-z0-9_]*=(?:\\.|[^=\\])*?[ \t]+)*?cn2= - fieldName: log.cn2 - pattern: (?:\\.|[^=\\])*? - - fieldName: log.paSuffix - pattern: (?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) + pattern: (?:\\.|[^=\\])*?(?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) where: oneOf("log.paFormat", ["CEF", "LEEF-legacy"]) - grok: source: log.paCefExtensions @@ -2559,9 +2073,7 @@ pipeline: - fieldName: log.paIgnored pattern: ^(?:[A-Za-z][A-Za-z0-9_]*=(?:\\.|[^=\\])*?[ \t]+)*?cn2Label= - fieldName: log.cn2Label - pattern: (?:\\.|[^=\\])*? - - fieldName: log.paSuffix - pattern: (?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) + pattern: (?:\\.|[^=\\])*?(?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) where: oneOf("log.paFormat", ["CEF", "LEEF-legacy"]) - grok: source: log.paCefExtensions @@ -2569,9 +2081,7 @@ pipeline: - fieldName: log.paIgnored pattern: ^(?:[A-Za-z][A-Za-z0-9_]*=(?:\\.|[^=\\])*?[ \t]+)*?cn3= - fieldName: log.cn3 - pattern: (?:\\.|[^=\\])*? - - fieldName: log.paSuffix - pattern: (?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) + pattern: (?:\\.|[^=\\])*?(?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) where: oneOf("log.paFormat", ["CEF", "LEEF-legacy"]) - grok: source: log.paCefExtensions @@ -2579,9 +2089,7 @@ pipeline: - fieldName: log.paIgnored pattern: ^(?:[A-Za-z][A-Za-z0-9_]*=(?:\\.|[^=\\])*?[ \t]+)*?cn3Label= - fieldName: log.cn3Label - pattern: (?:\\.|[^=\\])*? - - fieldName: log.paSuffix - pattern: (?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) + pattern: (?:\\.|[^=\\])*?(?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) where: oneOf("log.paFormat", ["CEF", "LEEF-legacy"]) - grok: source: log.paCefExtensions @@ -2589,9 +2097,7 @@ pipeline: - fieldName: log.paIgnored pattern: ^(?:[A-Za-z][A-Za-z0-9_]*=(?:\\.|[^=\\])*?[ \t]+)*?cn4= - fieldName: log.cn4 - pattern: (?:\\.|[^=\\])*? - - fieldName: log.paSuffix - pattern: (?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) + pattern: (?:\\.|[^=\\])*?(?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) where: oneOf("log.paFormat", ["CEF", "LEEF-legacy"]) - grok: source: log.paCefExtensions @@ -2599,9 +2105,7 @@ pipeline: - fieldName: log.paIgnored pattern: ^(?:[A-Za-z][A-Za-z0-9_]*=(?:\\.|[^=\\])*?[ \t]+)*?cn4Label= - fieldName: log.cn4Label - pattern: (?:\\.|[^=\\])*? - - fieldName: log.paSuffix - pattern: (?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) + pattern: (?:\\.|[^=\\])*?(?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) where: oneOf("log.paFormat", ["CEF", "LEEF-legacy"]) - grok: source: log.paCefExtensions @@ -2609,9 +2113,7 @@ pipeline: - fieldName: log.paIgnored pattern: ^(?:[A-Za-z][A-Za-z0-9_]*=(?:\\.|[^=\\])*?[ \t]+)*?cn5= - fieldName: log.cn5 - pattern: (?:\\.|[^=\\])*? - - fieldName: log.paSuffix - pattern: (?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) + pattern: (?:\\.|[^=\\])*?(?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) where: oneOf("log.paFormat", ["CEF", "LEEF-legacy"]) - grok: source: log.paCefExtensions @@ -2619,9 +2121,7 @@ pipeline: - fieldName: log.paIgnored pattern: ^(?:[A-Za-z][A-Za-z0-9_]*=(?:\\.|[^=\\])*?[ \t]+)*?cn5Label= - fieldName: log.cn5Label - pattern: (?:\\.|[^=\\])*? - - fieldName: log.paSuffix - pattern: (?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) + pattern: (?:\\.|[^=\\])*?(?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) where: oneOf("log.paFormat", ["CEF", "LEEF-legacy"]) - grok: source: log.paCefExtensions @@ -2629,9 +2129,7 @@ pipeline: - fieldName: log.paIgnored pattern: ^(?:[A-Za-z][A-Za-z0-9_]*=(?:\\.|[^=\\])*?[ \t]+)*?cn6= - fieldName: log.cn6 - pattern: (?:\\.|[^=\\])*? - - fieldName: log.paSuffix - pattern: (?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) + pattern: (?:\\.|[^=\\])*?(?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) where: oneOf("log.paFormat", ["CEF", "LEEF-legacy"]) - grok: source: log.paCefExtensions @@ -2639,9 +2137,7 @@ pipeline: - fieldName: log.paIgnored pattern: ^(?:[A-Za-z][A-Za-z0-9_]*=(?:\\.|[^=\\])*?[ \t]+)*?cn6Label= - fieldName: log.cn6Label - pattern: (?:\\.|[^=\\])*? - - fieldName: log.paSuffix - pattern: (?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) + pattern: (?:\\.|[^=\\])*?(?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) where: oneOf("log.paFormat", ["CEF", "LEEF-legacy"]) - grok: source: log.paCefExtensions @@ -2649,9 +2145,7 @@ pipeline: - fieldName: log.paIgnored pattern: ^(?:[A-Za-z][A-Za-z0-9_]*=(?:\\.|[^=\\])*?[ \t]+)*?cnPanOSIssuerCommonName= - fieldName: log.cnPanOSIssuerCommonName - pattern: (?:\\.|[^=\\])*? - - fieldName: log.paSuffix - pattern: (?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) + pattern: (?:\\.|[^=\\])*?(?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) where: oneOf("log.paFormat", ["CEF", "LEEF-legacy"]) - grok: source: log.paCefExtensions @@ -2659,9 +2153,7 @@ pipeline: - fieldName: log.paIgnored pattern: ^(?:[A-Za-z][A-Za-z0-9_]*=(?:\\.|[^=\\])*?[ \t]+)*?cnt= - fieldName: log.cnt - pattern: (?:\\.|[^=\\])*? - - fieldName: log.paSuffix - pattern: (?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) + pattern: (?:\\.|[^=\\])*?(?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) where: oneOf("log.paFormat", ["CEF", "LEEF-legacy"]) - grok: source: log.paCefExtensions @@ -2669,9 +2161,7 @@ pipeline: - fieldName: log.paIgnored pattern: ^(?:[A-Za-z][A-Za-z0-9_]*=(?:\\.|[^=\\])*?[ \t]+)*?connect_methodPanOSConnectionErrorID= - fieldName: log.connectMethodPanOSConnectionErrorID - pattern: (?:\\.|[^=\\])*? - - fieldName: log.paSuffix - pattern: (?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) + pattern: (?:\\.|[^=\\])*?(?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) where: oneOf("log.paFormat", ["CEF", "LEEF-legacy"]) - grok: source: log.paCefExtensions @@ -2679,9 +2169,7 @@ pipeline: - fieldName: log.paIgnored pattern: ^(?:[A-Za-z][A-Za-z0-9_]*=(?:\\.|[^=\\])*?[ \t]+)*?cs1= - fieldName: log.cs1 - pattern: (?:\\.|[^=\\])*? - - fieldName: log.paSuffix - pattern: (?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) + pattern: (?:\\.|[^=\\])*?(?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) where: oneOf("log.paFormat", ["CEF", "LEEF-legacy"]) - grok: source: log.paCefExtensions @@ -2689,9 +2177,7 @@ pipeline: - fieldName: log.paIgnored pattern: ^(?:[A-Za-z][A-Za-z0-9_]*=(?:\\.|[^=\\])*?[ \t]+)*?cs1Label= - fieldName: log.cs1Label - pattern: (?:\\.|[^=\\])*? - - fieldName: log.paSuffix - pattern: (?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) + pattern: (?:\\.|[^=\\])*?(?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) where: oneOf("log.paFormat", ["CEF", "LEEF-legacy"]) - grok: source: log.paCefExtensions @@ -2699,9 +2185,7 @@ pipeline: - fieldName: log.paIgnored pattern: ^(?:[A-Za-z][A-Za-z0-9_]*=(?:\\.|[^=\\])*?[ \t]+)*?cs2= - fieldName: log.cs2 - pattern: (?:\\.|[^=\\])*? - - fieldName: log.paSuffix - pattern: (?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) + pattern: (?:\\.|[^=\\])*?(?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) where: oneOf("log.paFormat", ["CEF", "LEEF-legacy"]) - grok: source: log.paCefExtensions @@ -2709,9 +2193,7 @@ pipeline: - fieldName: log.paIgnored pattern: ^(?:[A-Za-z][A-Za-z0-9_]*=(?:\\.|[^=\\])*?[ \t]+)*?cs2Label= - fieldName: log.cs2Label - pattern: (?:\\.|[^=\\])*? - - fieldName: log.paSuffix - pattern: (?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) + pattern: (?:\\.|[^=\\])*?(?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) where: oneOf("log.paFormat", ["CEF", "LEEF-legacy"]) - grok: source: log.paCefExtensions @@ -2719,9 +2201,7 @@ pipeline: - fieldName: log.paIgnored pattern: ^(?:[A-Za-z][A-Za-z0-9_]*=(?:\\.|[^=\\])*?[ \t]+)*?cs3= - fieldName: log.cs3 - pattern: (?:\\.|[^=\\])*? - - fieldName: log.paSuffix - pattern: (?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) + pattern: (?:\\.|[^=\\])*?(?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) where: oneOf("log.paFormat", ["CEF", "LEEF-legacy"]) - grok: source: log.paCefExtensions @@ -2729,9 +2209,7 @@ pipeline: - fieldName: log.paIgnored pattern: ^(?:[A-Za-z][A-Za-z0-9_]*=(?:\\.|[^=\\])*?[ \t]+)*?cs3Label= - fieldName: log.cs3Label - pattern: (?:\\.|[^=\\])*? - - fieldName: log.paSuffix - pattern: (?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) + pattern: (?:\\.|[^=\\])*?(?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) where: oneOf("log.paFormat", ["CEF", "LEEF-legacy"]) - grok: source: log.paCefExtensions @@ -2739,9 +2217,7 @@ pipeline: - fieldName: log.paIgnored pattern: ^(?:[A-Za-z][A-Za-z0-9_]*=(?:\\.|[^=\\])*?[ \t]+)*?cs4= - fieldName: log.cs4 - pattern: (?:\\.|[^=\\])*? - - fieldName: log.paSuffix - pattern: (?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) + pattern: (?:\\.|[^=\\])*?(?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) where: oneOf("log.paFormat", ["CEF", "LEEF-legacy"]) - grok: source: log.paCefExtensions @@ -2749,9 +2225,7 @@ pipeline: - fieldName: log.paIgnored pattern: ^(?:[A-Za-z][A-Za-z0-9_]*=(?:\\.|[^=\\])*?[ \t]+)*?cs4Label= - fieldName: log.cs4Label - pattern: (?:\\.|[^=\\])*? - - fieldName: log.paSuffix - pattern: (?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) + pattern: (?:\\.|[^=\\])*?(?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) where: oneOf("log.paFormat", ["CEF", "LEEF-legacy"]) - grok: source: log.paCefExtensions @@ -2759,9 +2233,7 @@ pipeline: - fieldName: log.paIgnored pattern: ^(?:[A-Za-z][A-Za-z0-9_]*=(?:\\.|[^=\\])*?[ \t]+)*?cs5= - fieldName: log.cs5 - pattern: (?:\\.|[^=\\])*? - - fieldName: log.paSuffix - pattern: (?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) + pattern: (?:\\.|[^=\\])*?(?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) where: oneOf("log.paFormat", ["CEF", "LEEF-legacy"]) - grok: source: log.paCefExtensions @@ -2769,9 +2241,7 @@ pipeline: - fieldName: log.paIgnored pattern: ^(?:[A-Za-z][A-Za-z0-9_]*=(?:\\.|[^=\\])*?[ \t]+)*?cs5Label= - fieldName: log.cs5Label - pattern: (?:\\.|[^=\\])*? - - fieldName: log.paSuffix - pattern: (?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) + pattern: (?:\\.|[^=\\])*?(?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) where: oneOf("log.paFormat", ["CEF", "LEEF-legacy"]) - grok: source: log.paCefExtensions @@ -2779,9 +2249,7 @@ pipeline: - fieldName: log.paIgnored pattern: ^(?:[A-Za-z][A-Za-z0-9_]*=(?:\\.|[^=\\])*?[ \t]+)*?cs6= - fieldName: log.cs6 - pattern: (?:\\.|[^=\\])*? - - fieldName: log.paSuffix - pattern: (?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) + pattern: (?:\\.|[^=\\])*?(?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) where: oneOf("log.paFormat", ["CEF", "LEEF-legacy"]) - grok: source: log.paCefExtensions @@ -2789,9 +2257,7 @@ pipeline: - fieldName: log.paIgnored pattern: ^(?:[A-Za-z][A-Za-z0-9_]*=(?:\\.|[^=\\])*?[ \t]+)*?cs6Label= - fieldName: log.cs6Label - pattern: (?:\\.|[^=\\])*? - - fieldName: log.paSuffix - pattern: (?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) + pattern: (?:\\.|[^=\\])*?(?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) where: oneOf("log.paFormat", ["CEF", "LEEF-legacy"]) - grok: source: log.paCefExtensions @@ -2799,9 +2265,7 @@ pipeline: - fieldName: log.paIgnored pattern: ^(?:[A-Za-z][A-Za-z0-9_]*=(?:\\.|[^=\\])*?[ \t]+)*?datasourcenamePanOSDataSourceType= - fieldName: log.datasourcenamePanOSDataSourceType - pattern: (?:\\.|[^=\\])*? - - fieldName: log.paSuffix - pattern: (?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) + pattern: (?:\\.|[^=\\])*?(?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) where: oneOf("log.paFormat", ["CEF", "LEEF-legacy"]) - grok: source: log.paCefExtensions @@ -2809,9 +2273,7 @@ pipeline: - fieldName: log.paIgnored pattern: ^(?:[A-Za-z][A-Za-z0-9_]*=(?:\\.|[^=\\])*?[ \t]+)*?destinationServiceName= - fieldName: log.destinationServiceName - pattern: (?:\\.|[^=\\])*? - - fieldName: log.paSuffix - pattern: (?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) + pattern: (?:\\.|[^=\\])*?(?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) where: oneOf("log.paFormat", ["CEF", "LEEF-legacy"]) - grok: source: log.paCefExtensions @@ -2819,9 +2281,7 @@ pipeline: - fieldName: log.paIgnored pattern: ^(?:[A-Za-z][A-Za-z0-9_]*=(?:\\.|[^=\\])*?[ \t]+)*?destinationTranslatedAddress= - fieldName: log.destinationTranslatedAddress - pattern: (?:\\.|[^=\\])*? - - fieldName: log.paSuffix - pattern: (?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) + pattern: (?:\\.|[^=\\])*?(?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) where: oneOf("log.paFormat", ["CEF", "LEEF-legacy"]) - grok: source: log.paCefExtensions @@ -2829,9 +2289,7 @@ pipeline: - fieldName: log.paIgnored pattern: ^(?:[A-Za-z][A-Za-z0-9_]*=(?:\\.|[^=\\])*?[ \t]+)*?destinationTranslatedPort= - fieldName: log.destinationTranslatedPort - pattern: (?:\\.|[^=\\])*? - - fieldName: log.paSuffix - pattern: (?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) + pattern: (?:\\.|[^=\\])*?(?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) where: oneOf("log.paFormat", ["CEF", "LEEF-legacy"]) - grok: source: log.paCefExtensions @@ -2839,9 +2297,7 @@ pipeline: - fieldName: log.paIgnored pattern: ^(?:[A-Za-z][A-Za-z0-9_]*=(?:\\.|[^=\\])*?[ \t]+)*?detailPanOSFWDeviceGroup= - fieldName: log.detailPanOSFWDeviceGroup - pattern: (?:\\.|[^=\\])*? - - fieldName: log.paSuffix - pattern: (?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) + pattern: (?:\\.|[^=\\])*?(?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) where: oneOf("log.paFormat", ["CEF", "LEEF-legacy"]) - grok: source: log.paCefExtensions @@ -2849,9 +2305,7 @@ pipeline: - fieldName: log.paIgnored pattern: ^(?:[A-Za-z][A-Za-z0-9_]*=(?:\\.|[^=\\])*?[ \t]+)*?deviceExternalId= - fieldName: log.deviceExternalId - pattern: (?:\\.|[^=\\])*? - - fieldName: log.paSuffix - pattern: (?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) + pattern: (?:\\.|[^=\\])*?(?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) where: oneOf("log.paFormat", ["CEF", "LEEF-legacy"]) - grok: source: log.paCefExtensions @@ -2859,9 +2313,7 @@ pipeline: - fieldName: log.paIgnored pattern: ^(?:[A-Za-z][A-Za-z0-9_]*=(?:\\.|[^=\\])*?[ \t]+)*?deviceInboundInterface= - fieldName: log.deviceInboundInterface - pattern: (?:\\.|[^=\\])*? - - fieldName: log.paSuffix - pattern: (?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) + pattern: (?:\\.|[^=\\])*?(?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) where: oneOf("log.paFormat", ["CEF", "LEEF-legacy"]) - grok: source: log.paCefExtensions @@ -2869,9 +2321,7 @@ pipeline: - fieldName: log.paIgnored pattern: ^(?:[A-Za-z][A-Za-z0-9_]*=(?:\\.|[^=\\])*?[ \t]+)*?deviceOutboundInterface= - fieldName: log.deviceOutboundInterface - pattern: (?:\\.|[^=\\])*? - - fieldName: log.paSuffix - pattern: (?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) + pattern: (?:\\.|[^=\\])*?(?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) where: oneOf("log.paFormat", ["CEF", "LEEF-legacy"]) - grok: source: log.paCefExtensions @@ -2879,9 +2329,7 @@ pipeline: - fieldName: log.paIgnored pattern: ^(?:[A-Za-z][A-Za-z0-9_]*=(?:\\.|[^=\\])*?[ \t]+)*?device_namePanOSActionFlags= - fieldName: log.deviceNamePanOSActionFlags - pattern: (?:\\.|[^=\\])*? - - fieldName: log.paSuffix - pattern: (?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) + pattern: (?:\\.|[^=\\])*?(?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) where: oneOf("log.paFormat", ["CEF", "LEEF-legacy"]) - grok: source: log.paCefExtensions @@ -2889,9 +2337,7 @@ pipeline: - fieldName: log.paIgnored pattern: ^(?:[A-Za-z][A-Za-z0-9_]*=(?:\\.|[^=\\])*?[ \t]+)*?dg_hier_level_1PanOSDGl2= - fieldName: log.dgHierLevel1PanOSDGl2 - pattern: (?:\\.|[^=\\])*? - - fieldName: log.paSuffix - pattern: (?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) + pattern: (?:\\.|[^=\\])*?(?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) where: oneOf("log.paFormat", ["CEF", "LEEF-legacy"]) - grok: source: log.paCefExtensions @@ -2899,9 +2345,7 @@ pipeline: - fieldName: log.paIgnored pattern: ^(?:[A-Za-z][A-Za-z0-9_]*=(?:\\.|[^=\\])*?[ \t]+)*?dg_hier_level_2PanOSDGl3= - fieldName: log.dgHierLevel2PanOSDGl3 - pattern: (?:\\.|[^=\\])*? - - fieldName: log.paSuffix - pattern: (?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) + pattern: (?:\\.|[^=\\])*?(?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) where: oneOf("log.paFormat", ["CEF", "LEEF-legacy"]) - grok: source: log.paCefExtensions @@ -2909,9 +2353,7 @@ pipeline: - fieldName: log.paIgnored pattern: ^(?:[A-Za-z][A-Za-z0-9_]*=(?:\\.|[^=\\])*?[ \t]+)*?dg_hier_level_3PanOSDGl4= - fieldName: log.dgHierLevel3PanOSDGl4 - pattern: (?:\\.|[^=\\])*? - - fieldName: log.paSuffix - pattern: (?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) + pattern: (?:\\.|[^=\\])*?(?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) where: oneOf("log.paFormat", ["CEF", "LEEF-legacy"]) - grok: source: log.paCefExtensions @@ -2919,9 +2361,7 @@ pipeline: - fieldName: log.paIgnored pattern: ^(?:[A-Za-z][A-Za-z0-9_]*=(?:\\.|[^=\\])*?[ \t]+)*?dg_hier_level_4PanOSVsysName= - fieldName: log.dgHierLevel4PanOSVsysName - pattern: (?:\\.|[^=\\])*? - - fieldName: log.paSuffix - pattern: (?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) + pattern: (?:\\.|[^=\\])*?(?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) where: oneOf("log.paFormat", ["CEF", "LEEF-legacy"]) - grok: source: log.paCefExtensions @@ -2929,9 +2369,7 @@ pipeline: - fieldName: log.paIgnored pattern: ^(?:[A-Za-z][A-Za-z0-9_]*=(?:\\.|[^=\\])*?[ \t]+)*?directionPanOSActionFlags= - fieldName: log.directionPanOSActionFlags - pattern: (?:\\.|[^=\\])*? - - fieldName: log.paSuffix - pattern: (?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) + pattern: (?:\\.|[^=\\])*?(?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) where: oneOf("log.paFormat", ["CEF", "LEEF-legacy"]) - grok: source: log.paCefExtensions @@ -2939,9 +2377,7 @@ pipeline: - fieldName: log.paIgnored pattern: ^(?:[A-Za-z][A-Za-z0-9_]*=(?:\\.|[^=\\])*?[ \t]+)*?dpt= - fieldName: log.dpt - pattern: (?:\\.|[^=\\])*? - - fieldName: log.paSuffix - pattern: (?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) + pattern: (?:\\.|[^=\\])*?(?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) where: oneOf("log.paFormat", ["CEF", "LEEF-legacy"]) - grok: source: log.paCefExtensions @@ -2949,9 +2385,7 @@ pipeline: - fieldName: log.paIgnored pattern: ^(?:[A-Za-z][A-Za-z0-9_]*=(?:\\.|[^=\\])*?[ \t]+)*?dst= - fieldName: log.dst - pattern: (?:\\.|[^=\\])*? - - fieldName: log.paSuffix - pattern: (?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) + pattern: (?:\\.|[^=\\])*?(?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) where: oneOf("log.paFormat", ["CEF", "LEEF-legacy"]) - grok: source: log.paCefExtensions @@ -2959,9 +2393,7 @@ pipeline: - fieldName: log.paIgnored pattern: ^(?:[A-Za-z][A-Za-z0-9_]*=(?:\\.|[^=\\])*?[ \t]+)*?dst_categoryPanOSDestinationDeviceProfile= - fieldName: log.dstCategoryPanOSDestinationDeviceProfile - pattern: (?:\\.|[^=\\])*? - - fieldName: log.paSuffix - pattern: (?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) + pattern: (?:\\.|[^=\\])*?(?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) where: oneOf("log.paFormat", ["CEF", "LEEF-legacy"]) - grok: source: log.paCefExtensions @@ -2969,9 +2401,7 @@ pipeline: - fieldName: log.paIgnored pattern: ^(?:[A-Za-z][A-Za-z0-9_]*=(?:\\.|[^=\\])*?[ \t]+)*?dst_dagPanOSTimeGeneratedHighResolution= - fieldName: log.dstDagPanOSTimeGeneratedHighResolution - pattern: (?:\\.|[^=\\])*? - - fieldName: log.paSuffix - pattern: (?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) + pattern: (?:\\.|[^=\\])*?(?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) where: oneOf("log.paFormat", ["CEF", "LEEF-legacy"]) - grok: source: log.paCefExtensions @@ -2979,9 +2409,7 @@ pipeline: - fieldName: log.paIgnored pattern: ^(?:[A-Za-z][A-Za-z0-9_]*=(?:\\.|[^=\\])*?[ \t]+)*?dst_edlPanOSSourceDynamicAddressGroup= - fieldName: log.dstEdlPanOSSourceDynamicAddressGroup - pattern: (?:\\.|[^=\\])*? - - fieldName: log.paSuffix - pattern: (?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) + pattern: (?:\\.|[^=\\])*?(?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) where: oneOf("log.paFormat", ["CEF", "LEEF-legacy"]) - grok: source: log.paCefExtensions @@ -2989,9 +2417,7 @@ pipeline: - fieldName: log.paIgnored pattern: ^(?:[A-Za-z][A-Za-z0-9_]*=(?:\\.|[^=\\])*?[ \t]+)*?dst_hostPanOSDestinationDeviceMac= - fieldName: log.dstHostPanOSDestinationDeviceMac - pattern: (?:\\.|[^=\\])*? - - fieldName: log.paSuffix - pattern: (?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) + pattern: (?:\\.|[^=\\])*?(?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) where: oneOf("log.paFormat", ["CEF", "LEEF-legacy"]) - grok: source: log.paCefExtensions @@ -2999,9 +2425,7 @@ pipeline: - fieldName: log.paIgnored pattern: ^(?:[A-Za-z][A-Za-z0-9_]*=(?:\\.|[^=\\])*?[ \t]+)*?dst_macPanContainerName= - fieldName: log.dstMacPanContainerName - pattern: (?:\\.|[^=\\])*? - - fieldName: log.paSuffix - pattern: (?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) + pattern: (?:\\.|[^=\\])*?(?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) where: oneOf("log.paFormat", ["CEF", "LEEF-legacy"]) - grok: source: log.paCefExtensions @@ -3009,9 +2433,7 @@ pipeline: - fieldName: log.paIgnored pattern: ^(?:[A-Za-z][A-Za-z0-9_]*=(?:\\.|[^=\\])*?[ \t]+)*?dst_modelPanOSDestinationDeviceVendor= - fieldName: log.dstModelPanOSDestinationDeviceVendor - pattern: (?:\\.|[^=\\])*? - - fieldName: log.paSuffix - pattern: (?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) + pattern: (?:\\.|[^=\\])*?(?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) where: oneOf("log.paFormat", ["CEF", "LEEF-legacy"]) - grok: source: log.paCefExtensions @@ -3019,9 +2441,7 @@ pipeline: - fieldName: log.paIgnored pattern: ^(?:[A-Za-z][A-Za-z0-9_]*=(?:\\.|[^=\\])*?[ \t]+)*?dst_osfamilyPanDstDeviceOSv= - fieldName: log.dstOsfamilyPanDstDeviceOSv - pattern: (?:\\.|[^=\\])*? - - fieldName: log.paSuffix - pattern: (?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) + pattern: (?:\\.|[^=\\])*?(?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) where: oneOf("log.paFormat", ["CEF", "LEEF-legacy"]) - grok: source: log.paCefExtensions @@ -3029,9 +2449,7 @@ pipeline: - fieldName: log.paIgnored pattern: ^(?:[A-Za-z][A-Za-z0-9_]*=(?:\\.|[^=\\])*?[ \t]+)*?dst_osfamilyPanOSDestinationDeviceOSVersion= - fieldName: log.dstOsfamilyPanOSDestinationDeviceOSVersion - pattern: (?:\\.|[^=\\])*? - - fieldName: log.paSuffix - pattern: (?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) + pattern: (?:\\.|[^=\\])*?(?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) where: oneOf("log.paFormat", ["CEF", "LEEF-legacy"]) - grok: source: log.paCefExtensions @@ -3039,9 +2457,7 @@ pipeline: - fieldName: log.paIgnored pattern: ^(?:[A-Za-z][A-Za-z0-9_]*=(?:\\.|[^=\\])*?[ \t]+)*?dst_profilePanDstDeviceModel= - fieldName: log.dstProfilePanDstDeviceModel - pattern: (?:\\.|[^=\\])*? - - fieldName: log.paSuffix - pattern: (?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) + pattern: (?:\\.|[^=\\])*?(?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) where: oneOf("log.paFormat", ["CEF", "LEEF-legacy"]) - grok: source: log.paCefExtensions @@ -3049,9 +2465,7 @@ pipeline: - fieldName: log.paIgnored pattern: ^(?:[A-Za-z][A-Za-z0-9_]*=(?:\\.|[^=\\])*?[ \t]+)*?dst_uuidPanOSTunnelID= - fieldName: log.dstUuidPanOSTunnelID - pattern: (?:\\.|[^=\\])*? - - fieldName: log.paSuffix - pattern: (?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) + pattern: (?:\\.|[^=\\])*?(?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) where: oneOf("log.paFormat", ["CEF", "LEEF-legacy"]) - grok: source: log.paCefExtensions @@ -3059,9 +2473,7 @@ pipeline: - fieldName: log.paIgnored pattern: ^(?:[A-Za-z][A-Za-z0-9_]*=(?:\\.|[^=\\])*?[ \t]+)*?duid= - fieldName: log.duid - pattern: (?:\\.|[^=\\])*? - - fieldName: log.paSuffix - pattern: (?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) + pattern: (?:\\.|[^=\\])*?(?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) where: oneOf("log.paFormat", ["CEF", "LEEF-legacy"]) - grok: source: log.paCefExtensions @@ -3069,9 +2481,7 @@ pipeline: - fieldName: log.paIgnored pattern: ^(?:[A-Za-z][A-Za-z0-9_]*=(?:\\.|[^=\\])*?[ \t]+)*?duser= - fieldName: log.duser - pattern: (?:\\.|[^=\\])*? - - fieldName: log.paSuffix - pattern: (?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) + pattern: (?:\\.|[^=\\])*?(?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) where: oneOf("log.paFormat", ["CEF", "LEEF-legacy"]) - grok: source: log.paCefExtensions @@ -3079,9 +2489,7 @@ pipeline: - fieldName: log.paIgnored pattern: ^(?:[A-Za-z][A-Za-z0-9_]*=(?:\\.|[^=\\])*?[ \t]+)*?dvchost= - fieldName: log.dvchost - pattern: (?:\\.|[^=\\])*? - - fieldName: log.paSuffix - pattern: (?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) + pattern: (?:\\.|[^=\\])*?(?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) where: oneOf("log.paFormat", ["CEF", "LEEF-legacy"]) - grok: source: log.paCefExtensions @@ -3089,9 +2497,7 @@ pipeline: - fieldName: log.paIgnored pattern: ^(?:[A-Za-z][A-Za-z0-9_]*=(?:\\.|[^=\\])*?[ \t]+)*?end= - fieldName: log.end - pattern: (?:\\.|[^=\\])*? - - fieldName: log.paSuffix - pattern: (?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) + pattern: (?:\\.|[^=\\])*?(?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) where: oneOf("log.paFormat", ["CEF", "LEEF-legacy"]) - grok: source: log.paCefExtensions @@ -3099,9 +2505,7 @@ pipeline: - fieldName: log.paIgnored pattern: ^(?:[A-Za-z][A-Za-z0-9_]*=(?:\\.|[^=\\])*?[ \t]+)*?err_indexPanOSRootStatus= - fieldName: log.errIndexPanOSRootStatus - pattern: (?:\\.|[^=\\])*? - - fieldName: log.paSuffix - pattern: (?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) + pattern: (?:\\.|[^=\\])*?(?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) where: oneOf("log.paFormat", ["CEF", "LEEF-legacy"]) - grok: source: log.paCefExtensions @@ -3109,9 +2513,7 @@ pipeline: - fieldName: log.paIgnored pattern: ^(?:[A-Za-z][A-Za-z0-9_]*=(?:\\.|[^=\\])*?[ \t]+)*?externalId= - fieldName: log.externalId - pattern: (?:\\.|[^=\\])*? - - fieldName: log.paSuffix - pattern: (?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) + pattern: (?:\\.|[^=\\])*?(?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) where: oneOf("log.paFormat", ["CEF", "LEEF-legacy"]) - grok: source: log.paCefExtensions @@ -3119,9 +2521,7 @@ pipeline: - fieldName: log.paIgnored pattern: ^(?:[A-Za-z][A-Za-z0-9_]*=(?:\\.|[^=\\])*?[ \t]+)*?fileHash= - fieldName: log.fileHash - pattern: (?:\\.|[^=\\])*? - - fieldName: log.paSuffix - pattern: (?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) + pattern: (?:\\.|[^=\\])*?(?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) where: oneOf("log.paFormat", ["CEF", "LEEF-legacy"]) - grok: source: log.paCefExtensions @@ -3129,9 +2529,7 @@ pipeline: - fieldName: log.paIgnored pattern: ^(?:[A-Za-z][A-Za-z0-9_]*=(?:\\.|[^=\\])*?[ \t]+)*?fileId= - fieldName: log.fileId - pattern: (?:\\.|[^=\\])*? - - fieldName: log.paSuffix - pattern: (?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) + pattern: (?:\\.|[^=\\])*?(?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) where: oneOf("log.paFormat", ["CEF", "LEEF-legacy"]) - grok: source: log.paCefExtensions @@ -3139,9 +2537,7 @@ pipeline: - fieldName: log.paIgnored pattern: ^(?:[A-Za-z][A-Za-z0-9_]*=(?:\\.|[^=\\])*?[ \t]+)*?filePath= - fieldName: log.filePath - pattern: (?:\\.|[^=\\])*? - - fieldName: log.paSuffix - pattern: (?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) + pattern: (?:\\.|[^=\\])*?(?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) where: oneOf("log.paFormat", ["CEF", "LEEF-legacy"]) - grok: source: log.paCefExtensions @@ -3149,9 +2545,7 @@ pipeline: - fieldName: log.paIgnored pattern: ^(?:[A-Za-z][A-Za-z0-9_]*=(?:\\.|[^=\\])*?[ \t]+)*?fileType= - fieldName: log.fileType - pattern: (?:\\.|[^=\\])*? - - fieldName: log.paSuffix - pattern: (?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) + pattern: (?:\\.|[^=\\])*?(?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) where: oneOf("log.paFormat", ["CEF", "LEEF-legacy"]) - grok: source: log.paCefExtensions @@ -3159,9 +2553,7 @@ pipeline: - fieldName: log.paIgnored pattern: ^(?:[A-Za-z][A-Za-z0-9_]*=(?:\\.|[^=\\])*?[ \t]+)*?flags= - fieldName: log.flags - pattern: (?:\\.|[^=\\])*? - - fieldName: log.paSuffix - pattern: (?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) + pattern: (?:\\.|[^=\\])*?(?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) where: oneOf("log.paFormat", ["CEF", "LEEF-legacy"]) - grok: source: log.paCefExtensions @@ -3169,9 +2561,7 @@ pipeline: - fieldName: log.paIgnored pattern: ^(?:[A-Za-z][A-Za-z0-9_]*=(?:\\.|[^=\\])*?[ \t]+)*?flexNumber1= - fieldName: log.flexNumber1 - pattern: (?:\\.|[^=\\])*? - - fieldName: log.paSuffix - pattern: (?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) + pattern: (?:\\.|[^=\\])*?(?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) where: oneOf("log.paFormat", ["CEF", "LEEF-legacy"]) - grok: source: log.paCefExtensions @@ -3179,9 +2569,7 @@ pipeline: - fieldName: log.paIgnored pattern: ^(?:[A-Za-z][A-Za-z0-9_]*=(?:\\.|[^=\\])*?[ \t]+)*?flexNumber1Label= - fieldName: log.flexNumber1Label - pattern: (?:\\.|[^=\\])*? - - fieldName: log.paSuffix - pattern: (?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) + pattern: (?:\\.|[^=\\])*?(?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) where: oneOf("log.paFormat", ["CEF", "LEEF-legacy"]) - grok: source: log.paCefExtensions @@ -3189,9 +2577,7 @@ pipeline: - fieldName: log.paIgnored pattern: ^(?:[A-Za-z][A-Za-z0-9_]*=(?:\\.|[^=\\])*?[ \t]+)*?flexNumber2= - fieldName: log.flexNumber2 - pattern: (?:\\.|[^=\\])*? - - fieldName: log.paSuffix - pattern: (?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) + pattern: (?:\\.|[^=\\])*?(?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) where: oneOf("log.paFormat", ["CEF", "LEEF-legacy"]) - grok: source: log.paCefExtensions @@ -3199,9 +2585,7 @@ pipeline: - fieldName: log.paIgnored pattern: ^(?:[A-Za-z][A-Za-z0-9_]*=(?:\\.|[^=\\])*?[ \t]+)*?flexNumber2Label= - fieldName: log.flexNumber2Label - pattern: (?:\\.|[^=\\])*? - - fieldName: log.paSuffix - pattern: (?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) + pattern: (?:\\.|[^=\\])*?(?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) where: oneOf("log.paFormat", ["CEF", "LEEF-legacy"]) - grok: source: log.paCefExtensions @@ -3209,9 +2593,7 @@ pipeline: - fieldName: log.paIgnored pattern: ^(?:[A-Za-z][A-Za-z0-9_]*=(?:\\.|[^=\\])*?[ \t]+)*?flexString1= - fieldName: log.flexString1 - pattern: (?:\\.|[^=\\])*? - - fieldName: log.paSuffix - pattern: (?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) + pattern: (?:\\.|[^=\\])*?(?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) where: oneOf("log.paFormat", ["CEF", "LEEF-legacy"]) - grok: source: log.paCefExtensions @@ -3219,9 +2601,7 @@ pipeline: - fieldName: log.paIgnored pattern: ^(?:[A-Za-z][A-Za-z0-9_]*=(?:\\.|[^=\\])*?[ \t]+)*?flexString1Label= - fieldName: log.flexString1Label - pattern: (?:\\.|[^=\\])*? - - fieldName: log.paSuffix - pattern: (?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) + pattern: (?:\\.|[^=\\])*?(?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) where: oneOf("log.paFormat", ["CEF", "LEEF-legacy"]) - grok: source: log.paCefExtensions @@ -3229,9 +2609,7 @@ pipeline: - fieldName: log.paIgnored pattern: ^(?:[A-Za-z][A-Za-z0-9_]*=(?:\\.|[^=\\])*?[ \t]+)*?flexString2= - fieldName: log.flexString2 - pattern: (?:\\.|[^=\\])*? - - fieldName: log.paSuffix - pattern: (?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) + pattern: (?:\\.|[^=\\])*?(?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) where: oneOf("log.paFormat", ["CEF", "LEEF-legacy"]) - grok: source: log.paCefExtensions @@ -3239,9 +2617,7 @@ pipeline: - fieldName: log.paIgnored pattern: ^(?:[A-Za-z][A-Za-z0-9_]*=(?:\\.|[^=\\])*?[ \t]+)*?flexString2Label= - fieldName: log.flexString2Label - pattern: (?:\\.|[^=\\])*? - - fieldName: log.paSuffix - pattern: (?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) + pattern: (?:\\.|[^=\\])*?(?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) where: oneOf("log.paFormat", ["CEF", "LEEF-legacy"]) - grok: source: log.paCefExtensions @@ -3249,9 +2625,7 @@ pipeline: - fieldName: log.paIgnored pattern: ^(?:[A-Za-z][A-Za-z0-9_]*=(?:\\.|[^=\\])*?[ \t]+)*?fname= - fieldName: log.fname - pattern: (?:\\.|[^=\\])*? - - fieldName: log.paSuffix - pattern: (?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) + pattern: (?:\\.|[^=\\])*?(?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) where: oneOf("log.paFormat", ["CEF", "LEEF-legacy"]) - grok: source: log.paCefExtensions @@ -3259,9 +2633,7 @@ pipeline: - fieldName: log.paIgnored pattern: ^(?:[A-Za-z][A-Za-z0-9_]*=(?:\\.|[^=\\])*?[ \t]+)*?hostidPanOSDeviceSN= - fieldName: log.hostidPanOSDeviceSN - pattern: (?:\\.|[^=\\])*? - - fieldName: log.paSuffix - pattern: (?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) + pattern: (?:\\.|[^=\\])*?(?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) where: oneOf("log.paFormat", ["CEF", "LEEF-legacy"]) - grok: source: log.paCefExtensions @@ -3269,9 +2641,7 @@ pipeline: - fieldName: log.paIgnored pattern: ^(?:[A-Za-z][A-Za-z0-9_]*=(?:\\.|[^=\\])*?[ \t]+)*?hostidPanOSEndpointSerialNumber= - fieldName: log.hostidPanOSEndpointSerialNumber - pattern: (?:\\.|[^=\\])*? - - fieldName: log.paSuffix - pattern: (?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) + pattern: (?:\\.|[^=\\])*?(?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) where: oneOf("log.paFormat", ["CEF", "LEEF-legacy"]) - grok: source: log.paCefExtensions @@ -3279,9 +2649,7 @@ pipeline: - fieldName: log.paIgnored pattern: ^(?:[A-Za-z][A-Za-z0-9_]*=(?:\\.|[^=\\])*?[ \t]+)*?http2_connectionPanDynamicUsrgrp= - fieldName: log.http2ConnectionPanDynamicUsrgrp - pattern: (?:\\.|[^=\\])*? - - fieldName: log.paSuffix - pattern: (?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) + pattern: (?:\\.|[^=\\])*?(?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) where: oneOf("log.paFormat", ["CEF", "LEEF-legacy"]) - grok: source: log.paCefExtensions @@ -3289,9 +2657,7 @@ pipeline: - fieldName: log.paIgnored pattern: ^(?:[A-Za-z][A-Za-z0-9_]*=(?:\\.|[^=\\])*?[ \t]+)*?http_headersPanOSRuleUUID= - fieldName: log.httpHeadersPanOSRuleUUID - pattern: (?:\\.|[^=\\])*? - - fieldName: log.paSuffix - pattern: (?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) + pattern: (?:\\.|[^=\\])*?(?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) where: oneOf("log.paFormat", ["CEF", "LEEF-legacy"]) - grok: source: log.paCefExtensions @@ -3299,9 +2665,7 @@ pipeline: - fieldName: log.paIgnored pattern: ^(?:[A-Za-z][A-Za-z0-9_]*=(?:\\.|[^=\\])*?[ \t]+)*?http_headersPanOSURLCatList= - fieldName: log.httpHeadersPanOSURLCatList - pattern: (?:\\.|[^=\\])*? - - fieldName: log.paSuffix - pattern: (?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) + pattern: (?:\\.|[^=\\])*?(?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) where: oneOf("log.paFormat", ["CEF", "LEEF-legacy"]) - grok: source: log.paCefExtensions @@ -3309,9 +2673,7 @@ pipeline: - fieldName: log.paIgnored pattern: ^(?:[A-Za-z][A-Za-z0-9_]*=(?:\\.|[^=\\])*?[ \t]+)*?in= - fieldName: log.in - pattern: (?:\\.|[^=\\])*? - - fieldName: log.paSuffix - pattern: (?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) + pattern: (?:\\.|[^=\\])*?(?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) where: oneOf("log.paFormat", ["CEF", "LEEF-legacy"]) - grok: source: log.paCefExtensions @@ -3319,9 +2681,7 @@ pipeline: - fieldName: log.paIgnored pattern: ^(?:[A-Za-z][A-Za-z0-9_]*=(?:\\.|[^=\\])*?[ \t]+)*?justificationPanASServiceType= - fieldName: log.justificationPanASServiceType - pattern: (?:\\.|[^=\\])*? - - fieldName: log.paSuffix - pattern: (?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) + pattern: (?:\\.|[^=\\])*?(?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) where: oneOf("log.paFormat", ["CEF", "LEEF-legacy"]) - grok: source: log.paCefExtensions @@ -3329,9 +2689,7 @@ pipeline: - fieldName: log.paIgnored pattern: ^(?:[A-Za-z][A-Za-z0-9_]*=(?:\\.|[^=\\])*?[ \t]+)*?macPanOSTimeGeneratedHighResolution= - fieldName: log.macPanOSTimeGeneratedHighResolution - pattern: (?:\\.|[^=\\])*? - - fieldName: log.paSuffix - pattern: (?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) + pattern: (?:\\.|[^=\\])*?(?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) where: oneOf("log.paFormat", ["CEF", "LEEF-legacy"]) - grok: source: log.paCefExtensions @@ -3339,9 +2697,7 @@ pipeline: - fieldName: log.paIgnored pattern: ^(?:[A-Za-z][A-Za-z0-9_]*=(?:\\.|[^=\\])*?[ \t]+)*?monitortagPanOSParentSessionID= - fieldName: log.monitortagPanOSParentSessionID - pattern: (?:\\.|[^=\\])*? - - fieldName: log.paSuffix - pattern: (?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) + pattern: (?:\\.|[^=\\])*?(?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) where: oneOf("log.paFormat", ["CEF", "LEEF-legacy"]) - grok: source: log.paCefExtensions @@ -3349,9 +2705,7 @@ pipeline: - fieldName: log.paIgnored pattern: ^(?:[A-Za-z][A-Za-z0-9_]*=(?:\\.|[^=\\])*?[ \t]+)*?msg= - fieldName: log.msg - pattern: (?:\\.|[^=\\])*? - - fieldName: log.paSuffix - pattern: (?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) + pattern: (?:\\.|[^=\\])*?(?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) where: oneOf("log.paFormat", ["CEF", "LEEF-legacy"]) - grok: source: log.paCefExtensions @@ -3359,9 +2713,7 @@ pipeline: - fieldName: log.paIgnored pattern: ^(?:[A-Za-z][A-Za-z0-9_]*=(?:\\.|[^=\\])*?[ \t]+)*?natsportdestinationTranslatedPort= - fieldName: log.natsportdestinationTranslatedPort - pattern: (?:\\.|[^=\\])*? - - fieldName: log.paSuffix - pattern: (?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) + pattern: (?:\\.|[^=\\])*?(?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) where: oneOf("log.paFormat", ["CEF", "LEEF-legacy"]) - grok: source: log.paCefExtensions @@ -3369,9 +2721,7 @@ pipeline: - fieldName: log.paIgnored pattern: ^(?:[A-Za-z][A-Za-z0-9_]*=(?:\\.|[^=\\])*?[ \t]+)*?natsrcdestinationTranslatedAddress= - fieldName: log.natsrcdestinationTranslatedAddress - pattern: (?:\\.|[^=\\])*? - - fieldName: log.paSuffix - pattern: (?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) + pattern: (?:\\.|[^=\\])*?(?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) where: oneOf("log.paFormat", ["CEF", "LEEF-legacy"]) - grok: source: log.paCefExtensions @@ -3379,9 +2729,7 @@ pipeline: - fieldName: log.paIgnored pattern: ^(?:[A-Za-z][A-Za-z0-9_]*=(?:\\.|[^=\\])*?[ \t]+)*?notbeforePanOSTimeNotAfter= - fieldName: log.notbeforePanOSTimeNotAfter - pattern: (?:\\.|[^=\\])*? - - fieldName: log.paSuffix - pattern: (?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) + pattern: (?:\\.|[^=\\])*?(?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) where: oneOf("log.paFormat", ["CEF", "LEEF-legacy"]) - grok: source: log.paCefExtensions @@ -3389,9 +2737,7 @@ pipeline: - fieldName: log.paIgnored pattern: ^(?:[A-Za-z][A-Za-z0-9_]*=(?:\\.|[^=\\])*?[ \t]+)*?oldFileId= - fieldName: log.oldFileId - pattern: (?:\\.|[^=\\])*? - - fieldName: log.paSuffix - pattern: (?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) + pattern: (?:\\.|[^=\\])*?(?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) where: oneOf("log.paFormat", ["CEF", "LEEF-legacy"]) - grok: source: log.paCefExtensions @@ -3399,9 +2745,7 @@ pipeline: - fieldName: log.paIgnored pattern: ^(?:[A-Za-z][A-Za-z0-9_]*=(?:\\.|[^=\\])*?[ \t]+)*?out= - fieldName: log.out - pattern: (?:\\.|[^=\\])*? - - fieldName: log.paSuffix - pattern: (?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) + pattern: (?:\\.|[^=\\])*?(?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) where: oneOf("log.paFormat", ["CEF", "LEEF-legacy"]) - grok: source: log.paCefExtensions @@ -3409,9 +2753,7 @@ pipeline: - fieldName: log.paIgnored pattern: ^(?:[A-Za-z][A-Za-z0-9_]*=(?:\\.|[^=\\])*?[ \t]+)*?panASServiceDiff= - fieldName: log.panASServiceDiff - pattern: (?:\\.|[^=\\])*? - - fieldName: log.paSuffix - pattern: (?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) + pattern: (?:\\.|[^=\\])*?(?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) where: oneOf("log.paFormat", ["CEF", "LEEF-legacy"]) - grok: source: log.paCefExtensions @@ -3419,9 +2761,7 @@ pipeline: - fieldName: log.paIgnored pattern: ^(?:[A-Za-z][A-Za-z0-9_]*=(?:\\.|[^=\\])*?[ \t]+)*?panASServiceType= - fieldName: log.panASServiceType - pattern: (?:\\.|[^=\\])*? - - fieldName: log.paSuffix - pattern: (?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) + pattern: (?:\\.|[^=\\])*?(?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) where: oneOf("log.paFormat", ["CEF", "LEEF-legacy"]) - grok: source: log.paCefExtensions @@ -3429,9 +2769,7 @@ pipeline: - fieldName: log.paIgnored pattern: ^(?:[A-Za-z][A-Za-z0-9_]*=(?:\\.|[^=\\])*?[ \t]+)*?panContainerName= - fieldName: log.panContainerName - pattern: (?:\\.|[^=\\])*? - - fieldName: log.paSuffix - pattern: (?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) + pattern: (?:\\.|[^=\\])*?(?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) where: oneOf("log.paFormat", ["CEF", "LEEF-legacy"]) - grok: source: log.paCefExtensions @@ -3439,9 +2777,7 @@ pipeline: - fieldName: log.paIgnored pattern: ^(?:[A-Za-z][A-Za-z0-9_]*=(?:\\.|[^=\\])*?[ \t]+)*?panDomainEDL= - fieldName: log.panDomainEDL - pattern: (?:\\.|[^=\\])*? - - fieldName: log.paSuffix - pattern: (?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) + pattern: (?:\\.|[^=\\])*?(?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) where: oneOf("log.paFormat", ["CEF", "LEEF-legacy"]) - grok: source: log.paCefExtensions @@ -3449,9 +2785,7 @@ pipeline: - fieldName: log.paIgnored pattern: ^(?:[A-Za-z][A-Za-z0-9_]*=(?:\\.|[^=\\])*?[ \t]+)*?panDstDAG= - fieldName: log.panDstDAG - pattern: (?:\\.|[^=\\])*? - - fieldName: log.paSuffix - pattern: (?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) + pattern: (?:\\.|[^=\\])*?(?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) where: oneOf("log.paFormat", ["CEF", "LEEF-legacy"]) - grok: source: log.paCefExtensions @@ -3459,9 +2793,7 @@ pipeline: - fieldName: log.paIgnored pattern: ^(?:[A-Za-z][A-Za-z0-9_]*=(?:\\.|[^=\\])*?[ \t]+)*?panDstDeviceCat= - fieldName: log.panDstDeviceCat - pattern: (?:\\.|[^=\\])*? - - fieldName: log.paSuffix - pattern: (?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) + pattern: (?:\\.|[^=\\])*?(?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) where: oneOf("log.paFormat", ["CEF", "LEEF-legacy"]) - grok: source: log.paCefExtensions @@ -3469,9 +2801,7 @@ pipeline: - fieldName: log.paIgnored pattern: ^(?:[A-Za-z][A-Za-z0-9_]*=(?:\\.|[^=\\])*?[ \t]+)*?panDstDeviceModel= - fieldName: log.panDstDeviceModel - pattern: (?:\\.|[^=\\])*? - - fieldName: log.paSuffix - pattern: (?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) + pattern: (?:\\.|[^=\\])*?(?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) where: oneOf("log.paFormat", ["CEF", "LEEF-legacy"]) - grok: source: log.paCefExtensions @@ -3479,9 +2809,7 @@ pipeline: - fieldName: log.paIgnored pattern: ^(?:[A-Za-z][A-Za-z0-9_]*=(?:\\.|[^=\\])*?[ \t]+)*?panDstDeviceOS= - fieldName: log.panDstDeviceOS - pattern: (?:\\.|[^=\\])*? - - fieldName: log.paSuffix - pattern: (?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) + pattern: (?:\\.|[^=\\])*?(?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) where: oneOf("log.paFormat", ["CEF", "LEEF-legacy"]) - grok: source: log.paCefExtensions @@ -3489,9 +2817,7 @@ pipeline: - fieldName: log.paIgnored pattern: ^(?:[A-Za-z][A-Za-z0-9_]*=(?:\\.|[^=\\])*?[ \t]+)*?panDstDeviceOSv= - fieldName: log.panDstDeviceOSv - pattern: (?:\\.|[^=\\])*? - - fieldName: log.paSuffix - pattern: (?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) + pattern: (?:\\.|[^=\\])*?(?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) where: oneOf("log.paFormat", ["CEF", "LEEF-legacy"]) - grok: source: log.paCefExtensions @@ -3499,9 +2825,7 @@ pipeline: - fieldName: log.paIgnored pattern: ^(?:[A-Za-z][A-Za-z0-9_]*=(?:\\.|[^=\\])*?[ \t]+)*?panDstDeviceProf= - fieldName: log.panDstDeviceProf - pattern: (?:\\.|[^=\\])*? - - fieldName: log.paSuffix - pattern: (?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) + pattern: (?:\\.|[^=\\])*?(?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) where: oneOf("log.paFormat", ["CEF", "LEEF-legacy"]) - grok: source: log.paCefExtensions @@ -3509,9 +2833,7 @@ pipeline: - fieldName: log.paIgnored pattern: ^(?:[A-Za-z][A-Za-z0-9_]*=(?:\\.|[^=\\])*?[ \t]+)*?panDstDeviceVendor= - fieldName: log.panDstDeviceVendor - pattern: (?:\\.|[^=\\])*? - - fieldName: log.paSuffix - pattern: (?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) + pattern: (?:\\.|[^=\\])*?(?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) where: oneOf("log.paFormat", ["CEF", "LEEF-legacy"]) - grok: source: log.paCefExtensions @@ -3519,9 +2841,7 @@ pipeline: - fieldName: log.paIgnored pattern: ^(?:[A-Za-z][A-Za-z0-9_]*=(?:\\.|[^=\\])*?[ \t]+)*?panDstEDL= - fieldName: log.panDstEDL - pattern: (?:\\.|[^=\\])*? - - fieldName: log.paSuffix - pattern: (?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) + pattern: (?:\\.|[^=\\])*?(?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) where: oneOf("log.paFormat", ["CEF", "LEEF-legacy"]) - grok: source: log.paCefExtensions @@ -3529,9 +2849,7 @@ pipeline: - fieldName: log.paIgnored pattern: ^(?:[A-Za-z][A-Za-z0-9_]*=(?:\\.|[^=\\])*?[ \t]+)*?panDstHostname= - fieldName: log.panDstHostname - pattern: (?:\\.|[^=\\])*? - - fieldName: log.paSuffix - pattern: (?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) + pattern: (?:\\.|[^=\\])*?(?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) where: oneOf("log.paFormat", ["CEF", "LEEF-legacy"]) - grok: source: log.paCefExtensions @@ -3539,9 +2857,7 @@ pipeline: - fieldName: log.paIgnored pattern: ^(?:[A-Za-z][A-Za-z0-9_]*=(?:\\.|[^=\\])*?[ \t]+)*?panDstMac= - fieldName: log.panDstMac - pattern: (?:\\.|[^=\\])*? - - fieldName: log.paSuffix - pattern: (?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) + pattern: (?:\\.|[^=\\])*?(?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) where: oneOf("log.paFormat", ["CEF", "LEEF-legacy"]) - grok: source: log.paCefExtensions @@ -3549,9 +2865,7 @@ pipeline: - fieldName: log.paIgnored pattern: ^(?:[A-Za-z][A-Za-z0-9_]*=(?:\\.|[^=\\])*?[ \t]+)*?panDynamicUsrgrp= - fieldName: log.panDynamicUsrgrp - pattern: (?:\\.|[^=\\])*? - - fieldName: log.paSuffix - pattern: (?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) + pattern: (?:\\.|[^=\\])*?(?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) where: oneOf("log.paFormat", ["CEF", "LEEF-legacy"]) - grok: source: log.paCefExtensions @@ -3559,9 +2873,7 @@ pipeline: - fieldName: log.paIgnored pattern: ^(?:[A-Za-z][A-Za-z0-9_]*=(?:\\.|[^=\\])*?[ \t]+)*?panEPSerial= - fieldName: log.panEPSerial - pattern: (?:\\.|[^=\\])*? - - fieldName: log.paSuffix - pattern: (?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) + pattern: (?:\\.|[^=\\])*?(?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) where: oneOf("log.paFormat", ["CEF", "LEEF-legacy"]) - grok: source: log.paCefExtensions @@ -3569,9 +2881,7 @@ pipeline: - fieldName: log.paIgnored pattern: ^(?:[A-Za-z][A-Za-z0-9_]*=(?:\\.|[^=\\])*?[ \t]+)*?panGPHostID= - fieldName: log.panGPHostID - pattern: (?:\\.|[^=\\])*? - - fieldName: log.paSuffix - pattern: (?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) + pattern: (?:\\.|[^=\\])*?(?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) where: oneOf("log.paFormat", ["CEF", "LEEF-legacy"]) - grok: source: log.paCefExtensions @@ -3579,9 +2889,7 @@ pipeline: - fieldName: log.paIgnored pattern: ^(?:[A-Za-z][A-Za-z0-9_]*=(?:\\.|[^=\\])*?[ \t]+)*?panHASessionOwner= - fieldName: log.panHASessionOwner - pattern: (?:\\.|[^=\\])*? - - fieldName: log.paSuffix - pattern: (?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) + pattern: (?:\\.|[^=\\])*?(?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) where: oneOf("log.paFormat", ["CEF", "LEEF-legacy"]) - grok: source: log.paCefExtensions @@ -3589,9 +2897,7 @@ pipeline: - fieldName: log.paIgnored pattern: ^(?:[A-Za-z][A-Za-z0-9_]*=(?:\\.|[^=\\])*?[ \t]+)*?panJustification= - fieldName: log.panJustification - pattern: (?:\\.|[^=\\])*? - - fieldName: log.paSuffix - pattern: (?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) + pattern: (?:\\.|[^=\\])*?(?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) where: oneOf("log.paFormat", ["CEF", "LEEF-legacy"]) - grok: source: log.paCefExtensions @@ -3599,9 +2905,7 @@ pipeline: - fieldName: log.paIgnored pattern: ^(?:[A-Za-z][A-Za-z0-9_]*=(?:\\.|[^=\\])*?[ \t]+)*?panLinkChange= - fieldName: log.panLinkChange - pattern: (?:\\.|[^=\\])*? - - fieldName: log.paSuffix - pattern: (?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) + pattern: (?:\\.|[^=\\])*?(?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) where: oneOf("log.paFormat", ["CEF", "LEEF-legacy"]) - grok: source: log.paCefExtensions @@ -3609,9 +2913,7 @@ pipeline: - fieldName: log.paIgnored pattern: ^(?:[A-Za-z][A-Za-z0-9_]*=(?:\\.|[^=\\])*?[ \t]+)*?panLinkDetail= - fieldName: log.panLinkDetail - pattern: (?:\\.|[^=\\])*? - - fieldName: log.paSuffix - pattern: (?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) + pattern: (?:\\.|[^=\\])*?(?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) where: oneOf("log.paFormat", ["CEF", "LEEF-legacy"]) - grok: source: log.paCefExtensions @@ -3619,9 +2921,7 @@ pipeline: - fieldName: log.paIgnored pattern: ^(?:[A-Za-z][A-Za-z0-9_]*=(?:\\.|[^=\\])*?[ \t]+)*?panOSAPName= - fieldName: log.panOSAPName - pattern: (?:\\.|[^=\\])*? - - fieldName: log.paSuffix - pattern: (?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) + pattern: (?:\\.|[^=\\])*?(?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) where: oneOf("log.paFormat", ["CEF", "LEEF-legacy"]) - grok: source: log.paCefExtensions @@ -3629,9 +2929,7 @@ pipeline: - fieldName: log.paIgnored pattern: ^(?:[A-Za-z][A-Za-z0-9_]*=(?:\\.|[^=\\])*?[ \t]+)*?panOSActionFlags= - fieldName: log.panOSActionFlags - pattern: (?:\\.|[^=\\])*? - - fieldName: log.paSuffix - pattern: (?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) + pattern: (?:\\.|[^=\\])*?(?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) where: oneOf("log.paFormat", ["CEF", "LEEF-legacy"]) - grok: source: log.paCefExtensions @@ -3639,9 +2937,7 @@ pipeline: - fieldName: log.paIgnored pattern: ^(?:[A-Za-z][A-Za-z0-9_]*=(?:\\.|[^=\\])*?[ \t]+)*?panOSAreaCode= - fieldName: log.panOSAreaCode - pattern: (?:\\.|[^=\\])*? - - fieldName: log.paSuffix - pattern: (?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) + pattern: (?:\\.|[^=\\])*?(?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) where: oneOf("log.paFormat", ["CEF", "LEEF-legacy"]) - grok: source: log.paCefExtensions @@ -3649,9 +2945,7 @@ pipeline: - fieldName: log.paIgnored pattern: ^(?:[A-Za-z][A-Za-z0-9_]*=(?:\\.|[^=\\])*?[ \t]+)*?panOSAssocID= - fieldName: log.panOSAssocID - pattern: (?:\\.|[^=\\])*? - - fieldName: log.paSuffix - pattern: (?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) + pattern: (?:\\.|[^=\\])*?(?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) where: oneOf("log.paFormat", ["CEF", "LEEF-legacy"]) - grok: source: log.paCefExtensions @@ -3659,9 +2953,7 @@ pipeline: - fieldName: log.paIgnored pattern: ^(?:[A-Za-z][A-Za-z0-9_]*=(?:\\.|[^=\\])*?[ \t]+)*?panOSAttemptedGateways= - fieldName: log.panOSAttemptedGateways - pattern: (?:\\.|[^=\\])*? - - fieldName: log.paSuffix - pattern: (?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) + pattern: (?:\\.|[^=\\])*?(?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) where: oneOf("log.paFormat", ["CEF", "LEEF-legacy"]) - grok: source: log.paCefExtensions @@ -3669,9 +2961,7 @@ pipeline: - fieldName: log.paIgnored pattern: ^(?:[A-Za-z][A-Za-z0-9_]*=(?:\\.|[^=\\])*?[ \t]+)*?panOSAuthMethod= - fieldName: log.panOSAuthMethod - pattern: (?:\\.|[^=\\])*? - - fieldName: log.paSuffix - pattern: (?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) + pattern: (?:\\.|[^=\\])*?(?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) where: oneOf("log.paFormat", ["CEF", "LEEF-legacy"]) - grok: source: log.paCefExtensions @@ -3679,9 +2969,7 @@ pipeline: - fieldName: log.paIgnored pattern: ^(?:[A-Za-z][A-Za-z0-9_]*=(?:\\.|[^=\\])*?[ \t]+)*?panOSCellID= - fieldName: log.panOSCellID - pattern: (?:\\.|[^=\\])*? - - fieldName: log.paSuffix - pattern: (?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) + pattern: (?:\\.|[^=\\])*?(?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) where: oneOf("log.paFormat", ["CEF", "LEEF-legacy"]) - grok: source: log.paCefExtensions @@ -3689,9 +2977,7 @@ pipeline: - fieldName: log.paIgnored pattern: ^(?:[A-Za-z][A-Za-z0-9_]*=(?:\\.|[^=\\])*?[ \t]+)*?panOSCertificateFlags= - fieldName: log.panOSCertificateFlags - pattern: (?:\\.|[^=\\])*? - - fieldName: log.paSuffix - pattern: (?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) + pattern: (?:\\.|[^=\\])*?(?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) where: oneOf("log.paFormat", ["CEF", "LEEF-legacy"]) - grok: source: log.paCefExtensions @@ -3699,9 +2985,7 @@ pipeline: - fieldName: log.paIgnored pattern: ^(?:[A-Za-z][A-Za-z0-9_]*=(?:\\.|[^=\\])*?[ \t]+)*?panOSCertificateSerial= - fieldName: log.panOSCertificateSerial - pattern: (?:\\.|[^=\\])*? - - fieldName: log.paSuffix - pattern: (?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) + pattern: (?:\\.|[^=\\])*?(?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) where: oneOf("log.paFormat", ["CEF", "LEEF-legacy"]) - grok: source: log.paCefExtensions @@ -3709,9 +2993,7 @@ pipeline: - fieldName: log.paIgnored pattern: ^(?:[A-Za-z][A-Za-z0-9_]*=(?:\\.|[^=\\])*?[ \t]+)*?panOSCertificateSize= - fieldName: log.panOSCertificateSize - pattern: (?:\\.|[^=\\])*? - - fieldName: log.paSuffix - pattern: (?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) + pattern: (?:\\.|[^=\\])*?(?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) where: oneOf("log.paFormat", ["CEF", "LEEF-legacy"]) - grok: source: log.paCefExtensions @@ -3719,9 +3001,7 @@ pipeline: - fieldName: log.paIgnored pattern: ^(?:[A-Za-z][A-Za-z0-9_]*=(?:\\.|[^=\\])*?[ \t]+)*?panOSCertificateVersion= - fieldName: log.panOSCertificateVersion - pattern: (?:\\.|[^=\\])*? - - fieldName: log.paSuffix - pattern: (?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) + pattern: (?:\\.|[^=\\])*?(?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) where: oneOf("log.paFormat", ["CEF", "LEEF-legacy"]) - grok: source: log.paCefExtensions @@ -3729,9 +3009,7 @@ pipeline: - fieldName: log.paIgnored pattern: ^(?:[A-Za-z][A-Za-z0-9_]*=(?:\\.|[^=\\])*?[ \t]+)*?panOSChainStatus= - fieldName: log.panOSChainStatus - pattern: (?:\\.|[^=\\])*? - - fieldName: log.paSuffix - pattern: (?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) + pattern: (?:\\.|[^=\\])*?(?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) where: oneOf("log.paFormat", ["CEF", "LEEF-legacy"]) - grok: source: log.paCefExtensions @@ -3739,9 +3017,7 @@ pipeline: - fieldName: log.paIgnored pattern: ^(?:[A-Za-z][A-Za-z0-9_]*=(?:\\.|[^=\\])*?[ \t]+)*?panOSChunkType= - fieldName: log.panOSChunkType - pattern: (?:\\.|[^=\\])*? - - fieldName: log.paSuffix - pattern: (?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) + pattern: (?:\\.|[^=\\])*?(?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) where: oneOf("log.paFormat", ["CEF", "LEEF-legacy"]) - grok: source: log.paCefExtensions @@ -3749,9 +3025,7 @@ pipeline: - fieldName: log.paIgnored pattern: ^(?:[A-Za-z][A-Za-z0-9_]*=(?:\\.|[^=\\])*?[ \t]+)*?panOSClientToFirewall= - fieldName: log.panOSClientToFirewall - pattern: (?:\\.|[^=\\])*? - - fieldName: log.paSuffix - pattern: (?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) + pattern: (?:\\.|[^=\\])*?(?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) where: oneOf("log.paFormat", ["CEF", "LEEF-legacy"]) - grok: source: log.paCefExtensions @@ -3759,9 +3033,7 @@ pipeline: - fieldName: log.paIgnored pattern: ^(?:[A-Za-z][A-Za-z0-9_]*=(?:\\.|[^=\\])*?[ \t]+)*?panOSCommonName= - fieldName: log.panOSCommonName - pattern: (?:\\.|[^=\\])*? - - fieldName: log.paSuffix - pattern: (?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) + pattern: (?:\\.|[^=\\])*?(?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) where: oneOf("log.paFormat", ["CEF", "LEEF-legacy"]) - grok: source: log.paCefExtensions @@ -3769,9 +3041,7 @@ pipeline: - fieldName: log.paIgnored pattern: ^(?:[A-Za-z][A-Za-z0-9_]*=(?:\\.|[^=\\])*?[ \t]+)*?panOSCommonNameLength= - fieldName: log.panOSCommonNameLength - pattern: (?:\\.|[^=\\])*? - - fieldName: log.paSuffix - pattern: (?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) + pattern: (?:\\.|[^=\\])*?(?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) where: oneOf("log.paFormat", ["CEF", "LEEF-legacy"]) - grok: source: log.paCefExtensions @@ -3779,9 +3049,7 @@ pipeline: - fieldName: log.paIgnored pattern: ^(?:[A-Za-z][A-Za-z0-9_]*=(?:\\.|[^=\\])*?[ \t]+)*?panOSConfigVersion= - fieldName: log.panOSConfigVersion - pattern: (?:\\.|[^=\\])*? - - fieldName: log.paSuffix - pattern: (?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) + pattern: (?:\\.|[^=\\])*?(?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) where: oneOf("log.paFormat", ["CEF", "LEEF-legacy"]) - grok: source: log.paCefExtensions @@ -3789,9 +3057,7 @@ pipeline: - fieldName: log.paIgnored pattern: ^(?:[A-Za-z][A-Za-z0-9_]*=(?:\\.|[^=\\])*?[ \t]+)*?panOSConnectionError= - fieldName: log.panOSConnectionError - pattern: (?:\\.|[^=\\])*? - - fieldName: log.paSuffix - pattern: (?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) + pattern: (?:\\.|[^=\\])*?(?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) where: oneOf("log.paFormat", ["CEF", "LEEF-legacy"]) - grok: source: log.paCefExtensions @@ -3799,9 +3065,7 @@ pipeline: - fieldName: log.paIgnored pattern: ^(?:[A-Za-z][A-Za-z0-9_]*=(?:\\.|[^=\\])*?[ \t]+)*?panOSConnectionErrorID= - fieldName: log.panOSConnectionErrorID - pattern: (?:\\.|[^=\\])*? - - fieldName: log.paSuffix - pattern: (?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) + pattern: (?:\\.|[^=\\])*?(?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) where: oneOf("log.paFormat", ["CEF", "LEEF-legacy"]) - grok: source: log.paCefExtensions @@ -3809,9 +3073,7 @@ pipeline: - fieldName: log.paIgnored pattern: ^(?:[A-Za-z][A-Za-z0-9_]*=(?:\\.|[^=\\])*?[ \t]+)*?panOSConnectionMethod= - fieldName: log.panOSConnectionMethod - pattern: (?:\\.|[^=\\])*? - - fieldName: log.paSuffix - pattern: (?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) + pattern: (?:\\.|[^=\\])*?(?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) where: oneOf("log.paFormat", ["CEF", "LEEF-legacy"]) - grok: source: log.paCefExtensions @@ -3819,9 +3081,7 @@ pipeline: - fieldName: log.paIgnored pattern: ^(?:[A-Za-z][A-Za-z0-9_]*=(?:\\.|[^=\\])*?[ \t]+)*?panOSContainerID= - fieldName: log.panOSContainerID - pattern: (?:\\.|[^=\\])*? - - fieldName: log.paSuffix - pattern: (?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) + pattern: (?:\\.|[^=\\])*?(?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) where: oneOf("log.paFormat", ["CEF", "LEEF-legacy"]) - grok: source: log.paCefExtensions @@ -3829,9 +3089,7 @@ pipeline: - fieldName: log.paIgnored pattern: ^(?:[A-Za-z][A-Za-z0-9_]*=(?:\\.|[^=\\])*?[ \t]+)*?panOSContainerName= - fieldName: log.panOSContainerName - pattern: (?:\\.|[^=\\])*? - - fieldName: log.paSuffix - pattern: (?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) + pattern: (?:\\.|[^=\\])*?(?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) where: oneOf("log.paFormat", ["CEF", "LEEF-legacy"]) - grok: source: log.paCefExtensions @@ -3839,9 +3097,7 @@ pipeline: - fieldName: log.paIgnored pattern: ^(?:[A-Za-z][A-Za-z0-9_]*=(?:\\.|[^=\\])*?[ \t]+)*?panOSContainerNameSpace= - fieldName: log.panOSContainerNameSpace - pattern: (?:\\.|[^=\\])*? - - fieldName: log.paSuffix - pattern: (?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) + pattern: (?:\\.|[^=\\])*?(?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) where: oneOf("log.paFormat", ["CEF", "LEEF-legacy"]) - grok: source: log.paCefExtensions @@ -3849,9 +3105,7 @@ pipeline: - fieldName: log.paIgnored pattern: ^(?:[A-Za-z][A-Za-z0-9_]*=(?:\\.|[^=\\])*?[ \t]+)*?panOSContentVer= - fieldName: log.panOSContentVer - pattern: (?:\\.|[^=\\])*? - - fieldName: log.paSuffix - pattern: (?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) + pattern: (?:\\.|[^=\\])*?(?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) where: oneOf("log.paFormat", ["CEF", "LEEF-legacy"]) - grok: source: log.paCefExtensions @@ -3859,9 +3113,7 @@ pipeline: - fieldName: log.paIgnored pattern: ^(?:[A-Za-z][A-Za-z0-9_]*=(?:\\.|[^=\\])*?[ \t]+)*?panOSCountOfRepeats= - fieldName: log.panOSCountOfRepeats - pattern: (?:\\.|[^=\\])*? - - fieldName: log.paSuffix - pattern: (?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) + pattern: (?:\\.|[^=\\])*?(?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) where: oneOf("log.paFormat", ["CEF", "LEEF-legacy"]) - grok: source: log.paCefExtensions @@ -3869,9 +3121,7 @@ pipeline: - fieldName: log.paIgnored pattern: ^(?:[A-Za-z][A-Za-z0-9_]*=(?:\\.|[^=\\])*?[ \t]+)*?panOSDGl1= - fieldName: log.panOSDGl1 - pattern: (?:\\.|[^=\\])*? - - fieldName: log.paSuffix - pattern: (?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) + pattern: (?:\\.|[^=\\])*?(?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) where: oneOf("log.paFormat", ["CEF", "LEEF-legacy"]) - grok: source: log.paCefExtensions @@ -3879,9 +3129,7 @@ pipeline: - fieldName: log.paIgnored pattern: ^(?:[A-Za-z][A-Za-z0-9_]*=(?:\\.|[^=\\])*?[ \t]+)*?panOSDGl2= - fieldName: log.panOSDGl2 - pattern: (?:\\.|[^=\\])*? - - fieldName: log.paSuffix - pattern: (?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) + pattern: (?:\\.|[^=\\])*?(?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) where: oneOf("log.paFormat", ["CEF", "LEEF-legacy"]) - grok: source: log.paCefExtensions @@ -3889,9 +3137,7 @@ pipeline: - fieldName: log.paIgnored pattern: ^(?:[A-Za-z][A-Za-z0-9_]*=(?:\\.|[^=\\])*?[ \t]+)*?panOSDGl3= - fieldName: log.panOSDGl3 - pattern: (?:\\.|[^=\\])*? - - fieldName: log.paSuffix - pattern: (?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) + pattern: (?:\\.|[^=\\])*?(?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) where: oneOf("log.paFormat", ["CEF", "LEEF-legacy"]) - grok: source: log.paCefExtensions @@ -3899,9 +3145,7 @@ pipeline: - fieldName: log.paIgnored pattern: ^(?:[A-Za-z][A-Za-z0-9_]*=(?:\\.|[^=\\])*?[ \t]+)*?panOSDGl4= - fieldName: log.panOSDGl4 - pattern: (?:\\.|[^=\\])*? - - fieldName: log.paSuffix - pattern: (?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) + pattern: (?:\\.|[^=\\])*?(?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) where: oneOf("log.paFormat", ["CEF", "LEEF-legacy"]) - grok: source: log.paCefExtensions @@ -3909,9 +3153,7 @@ pipeline: - fieldName: log.paIgnored pattern: ^(?:[A-Za-z][A-Za-z0-9_]*=(?:\\.|[^=\\])*?[ \t]+)*?panOSDataSourceName= - fieldName: log.panOSDataSourceName - pattern: (?:\\.|[^=\\])*? - - fieldName: log.paSuffix - pattern: (?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) + pattern: (?:\\.|[^=\\])*?(?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) where: oneOf("log.paFormat", ["CEF", "LEEF-legacy"]) - grok: source: log.paCefExtensions @@ -3919,9 +3161,7 @@ pipeline: - fieldName: log.paIgnored pattern: ^(?:[A-Za-z][A-Za-z0-9_]*=(?:\\.|[^=\\])*?[ \t]+)*?panOSDataSourceSubType= - fieldName: log.panOSDataSourceSubType - pattern: (?:\\.|[^=\\])*? - - fieldName: log.paSuffix - pattern: (?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) + pattern: (?:\\.|[^=\\])*?(?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) where: oneOf("log.paFormat", ["CEF", "LEEF-legacy"]) - grok: source: log.paCefExtensions @@ -3929,9 +3169,7 @@ pipeline: - fieldName: log.paIgnored pattern: ^(?:[A-Za-z][A-Za-z0-9_]*=(?:\\.|[^=\\])*?[ \t]+)*?panOSDataSourceType= - fieldName: log.panOSDataSourceType - pattern: (?:\\.|[^=\\])*? - - fieldName: log.paSuffix - pattern: (?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) + pattern: (?:\\.|[^=\\])*?(?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) where: oneOf("log.paFormat", ["CEF", "LEEF-legacy"]) - grok: source: log.paCefExtensions @@ -3939,9 +3177,7 @@ pipeline: - fieldName: log.paIgnored pattern: ^(?:[A-Za-z][A-Za-z0-9_]*=(?:\\.|[^=\\])*?[ \t]+)*?panOSDesc= - fieldName: log.panOSDesc - pattern: (?:\\.|[^=\\])*? - - fieldName: log.paSuffix - pattern: (?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) + pattern: (?:\\.|[^=\\])*?(?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) where: oneOf("log.paFormat", ["CEF", "LEEF-legacy"]) - grok: source: log.paCefExtensions @@ -3949,9 +3185,7 @@ pipeline: - fieldName: log.paIgnored pattern: ^(?:[A-Za-z][A-Za-z0-9_]*=(?:\\.|[^=\\])*?[ \t]+)*?panOSDescription= - fieldName: log.panOSDescription - pattern: (?:\\.|[^=\\])*? - - fieldName: log.paSuffix - pattern: (?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) + pattern: (?:\\.|[^=\\])*?(?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) where: oneOf("log.paFormat", ["CEF", "LEEF-legacy"]) - grok: source: log.paCefExtensions @@ -3959,9 +3193,7 @@ pipeline: - fieldName: log.paIgnored pattern: ^(?:[A-Za-z][A-Za-z0-9_]*=(?:\\.|[^=\\])*?[ \t]+)*?panOSDestinationDeviceCategory= - fieldName: log.panOSDestinationDeviceCategory - pattern: (?:\\.|[^=\\])*? - - fieldName: log.paSuffix - pattern: (?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) + pattern: (?:\\.|[^=\\])*?(?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) where: oneOf("log.paFormat", ["CEF", "LEEF-legacy"]) - grok: source: log.paCefExtensions @@ -3969,9 +3201,7 @@ pipeline: - fieldName: log.paIgnored pattern: ^(?:[A-Za-z][A-Za-z0-9_]*=(?:\\.|[^=\\])*?[ \t]+)*?panOSDestinationDeviceHost= - fieldName: log.panOSDestinationDeviceHost - pattern: (?:\\.|[^=\\])*? - - fieldName: log.paSuffix - pattern: (?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) + pattern: (?:\\.|[^=\\])*?(?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) where: oneOf("log.paFormat", ["CEF", "LEEF-legacy"]) - grok: source: log.paCefExtensions @@ -3979,9 +3209,7 @@ pipeline: - fieldName: log.paIgnored pattern: ^(?:[A-Za-z][A-Za-z0-9_]*=(?:\\.|[^=\\])*?[ \t]+)*?panOSDestinationDeviceMac= - fieldName: log.panOSDestinationDeviceMac - pattern: (?:\\.|[^=\\])*? - - fieldName: log.paSuffix - pattern: (?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) + pattern: (?:\\.|[^=\\])*?(?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) where: oneOf("log.paFormat", ["CEF", "LEEF-legacy"]) - grok: source: log.paCefExtensions @@ -3989,9 +3217,7 @@ pipeline: - fieldName: log.paIgnored pattern: ^(?:[A-Za-z][A-Za-z0-9_]*=(?:\\.|[^=\\])*?[ \t]+)*?panOSDestinationDeviceModel= - fieldName: log.panOSDestinationDeviceModel - pattern: (?:\\.|[^=\\])*? - - fieldName: log.paSuffix - pattern: (?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) + pattern: (?:\\.|[^=\\])*?(?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) where: oneOf("log.paFormat", ["CEF", "LEEF-legacy"]) - grok: source: log.paCefExtensions @@ -3999,9 +3225,7 @@ pipeline: - fieldName: log.paIgnored pattern: ^(?:[A-Za-z][A-Za-z0-9_]*=(?:\\.|[^=\\])*?[ \t]+)*?panOSDestinationDeviceOSFamily= - fieldName: log.panOSDestinationDeviceOSFamily - pattern: (?:\\.|[^=\\])*? - - fieldName: log.paSuffix - pattern: (?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) + pattern: (?:\\.|[^=\\])*?(?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) where: oneOf("log.paFormat", ["CEF", "LEEF-legacy"]) - grok: source: log.paCefExtensions @@ -4009,9 +3233,7 @@ pipeline: - fieldName: log.paIgnored pattern: ^(?:[A-Za-z][A-Za-z0-9_]*=(?:\\.|[^=\\])*?[ \t]+)*?panOSDestinationDeviceOSVersion= - fieldName: log.panOSDestinationDeviceOSVersion - pattern: (?:\\.|[^=\\])*? - - fieldName: log.paSuffix - pattern: (?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) + pattern: (?:\\.|[^=\\])*?(?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) where: oneOf("log.paFormat", ["CEF", "LEEF-legacy"]) - grok: source: log.paCefExtensions @@ -4019,9 +3241,7 @@ pipeline: - fieldName: log.paIgnored pattern: ^(?:[A-Za-z][A-Za-z0-9_]*=(?:\\.|[^=\\])*?[ \t]+)*?panOSDestinationDeviceProfile= - fieldName: log.panOSDestinationDeviceProfile - pattern: (?:\\.|[^=\\])*? - - fieldName: log.paSuffix - pattern: (?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) + pattern: (?:\\.|[^=\\])*?(?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) where: oneOf("log.paFormat", ["CEF", "LEEF-legacy"]) - grok: source: log.paCefExtensions @@ -4029,9 +3249,7 @@ pipeline: - fieldName: log.paIgnored pattern: ^(?:[A-Za-z][A-Za-z0-9_]*=(?:\\.|[^=\\])*?[ \t]+)*?panOSDestinationDeviceVendor= - fieldName: log.panOSDestinationDeviceVendor - pattern: (?:\\.|[^=\\])*? - - fieldName: log.paSuffix - pattern: (?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) + pattern: (?:\\.|[^=\\])*?(?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) where: oneOf("log.paFormat", ["CEF", "LEEF-legacy"]) - grok: source: log.paCefExtensions @@ -4039,9 +3257,7 @@ pipeline: - fieldName: log.paIgnored pattern: ^(?:[A-Za-z][A-Za-z0-9_]*=(?:\\.|[^=\\])*?[ \t]+)*?panOSDestinationDynamicAddressGroup= - fieldName: log.panOSDestinationDynamicAddressGroup - pattern: (?:\\.|[^=\\])*? - - fieldName: log.paSuffix - pattern: (?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) + pattern: (?:\\.|[^=\\])*?(?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) where: oneOf("log.paFormat", ["CEF", "LEEF-legacy"]) - grok: source: log.paCefExtensions @@ -4049,9 +3265,7 @@ pipeline: - fieldName: log.paIgnored pattern: ^(?:[A-Za-z][A-Za-z0-9_]*=(?:\\.|[^=\\])*?[ \t]+)*?panOSDestinationEDL= - fieldName: log.panOSDestinationEDL - pattern: (?:\\.|[^=\\])*? - - fieldName: log.paSuffix - pattern: (?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) + pattern: (?:\\.|[^=\\])*?(?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) where: oneOf("log.paFormat", ["CEF", "LEEF-legacy"]) - grok: source: log.paCefExtensions @@ -4059,9 +3273,7 @@ pipeline: - fieldName: log.paIgnored pattern: ^(?:[A-Za-z][A-Za-z0-9_]*=(?:\\.|[^=\\])*?[ \t]+)*?panOSDestinationUUID= - fieldName: log.panOSDestinationUUID - pattern: (?:\\.|[^=\\])*? - - fieldName: log.paSuffix - pattern: (?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) + pattern: (?:\\.|[^=\\])*?(?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) where: oneOf("log.paFormat", ["CEF", "LEEF-legacy"]) - grok: source: log.paCefExtensions @@ -4069,9 +3281,7 @@ pipeline: - fieldName: log.paIgnored pattern: ^(?:[A-Za-z][A-Za-z0-9_]*=(?:\\.|[^=\\])*?[ \t]+)*?panOSDeviceSN= - fieldName: log.panOSDeviceSN - pattern: (?:\\.|[^=\\])*? - - fieldName: log.paSuffix - pattern: (?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) + pattern: (?:\\.|[^=\\])*?(?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) where: oneOf("log.paFormat", ["CEF", "LEEF-legacy"]) - grok: source: log.paCefExtensions @@ -4079,9 +3289,7 @@ pipeline: - fieldName: log.paIgnored pattern: ^(?:[A-Za-z][A-Za-z0-9_]*=(?:\\.|[^=\\])*?[ \t]+)*?panOSDiameterAVPCode= - fieldName: log.panOSDiameterAVPCode - pattern: (?:\\.|[^=\\])*? - - fieldName: log.paSuffix - pattern: (?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) + pattern: (?:\\.|[^=\\])*?(?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) where: oneOf("log.paFormat", ["CEF", "LEEF-legacy"]) - grok: source: log.paCefExtensions @@ -4089,9 +3297,7 @@ pipeline: - fieldName: log.paIgnored pattern: ^(?:[A-Za-z][A-Za-z0-9_]*=(?:\\.|[^=\\])*?[ \t]+)*?panOSDiameterApp= - fieldName: log.panOSDiameterApp - pattern: (?:\\.|[^=\\])*? - - fieldName: log.paSuffix - pattern: (?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) + pattern: (?:\\.|[^=\\])*?(?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) where: oneOf("log.paFormat", ["CEF", "LEEF-legacy"]) - grok: source: log.paCefExtensions @@ -4099,9 +3305,7 @@ pipeline: - fieldName: log.paIgnored pattern: ^(?:[A-Za-z][A-Za-z0-9_]*=(?:\\.|[^=\\])*?[ \t]+)*?panOSDiameterCmdCode= - fieldName: log.panOSDiameterCmdCode - pattern: (?:\\.|[^=\\])*? - - fieldName: log.paSuffix - pattern: (?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) + pattern: (?:\\.|[^=\\])*?(?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) where: oneOf("log.paFormat", ["CEF", "LEEF-legacy"]) - grok: source: log.paCefExtensions @@ -4109,9 +3313,7 @@ pipeline: - fieldName: log.paIgnored pattern: ^(?:[A-Za-z][A-Za-z0-9_]*=(?:\\.|[^=\\])*?[ \t]+)*?panOSDstUUID= - fieldName: log.panOSDstUUID - pattern: (?:\\.|[^=\\])*? - - fieldName: log.paSuffix - pattern: (?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) + pattern: (?:\\.|[^=\\])*?(?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) where: oneOf("log.paFormat", ["CEF", "LEEF-legacy"]) - grok: source: log.paCefExtensions @@ -4119,9 +3321,7 @@ pipeline: - fieldName: log.paIgnored pattern: ^(?:[A-Za-z][A-Za-z0-9_]*=(?:\\.|[^=\\])*?[ \t]+)*?panOSEllipticCurve= - fieldName: log.panOSEllipticCurve - pattern: (?:\\.|[^=\\])*? - - fieldName: log.paSuffix - pattern: (?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) + pattern: (?:\\.|[^=\\])*?(?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) where: oneOf("log.paFormat", ["CEF", "LEEF-legacy"]) - grok: source: log.paCefExtensions @@ -4129,9 +3329,7 @@ pipeline: - fieldName: log.paIgnored pattern: ^(?:[A-Za-z][A-Za-z0-9_]*=(?:\\.|[^=\\])*?[ \t]+)*?panOSEndUserIP= - fieldName: log.panOSEndUserIP - pattern: (?:\\.|[^=\\])*? - - fieldName: log.paSuffix - pattern: (?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) + pattern: (?:\\.|[^=\\])*?(?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) where: oneOf("log.paFormat", ["CEF", "LEEF-legacy"]) - grok: source: log.paCefExtensions @@ -4139,9 +3337,7 @@ pipeline: - fieldName: log.paIgnored pattern: ^(?:[A-Za-z][A-Za-z0-9_]*=(?:\\.|[^=\\])*?[ \t]+)*?panOSEndpointDeviceName= - fieldName: log.panOSEndpointDeviceName - pattern: (?:\\.|[^=\\])*? - - fieldName: log.paSuffix - pattern: (?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) + pattern: (?:\\.|[^=\\])*?(?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) where: oneOf("log.paFormat", ["CEF", "LEEF-legacy"]) - grok: source: log.paCefExtensions @@ -4149,9 +3345,7 @@ pipeline: - fieldName: log.paIgnored pattern: ^(?:[A-Za-z][A-Za-z0-9_]*=(?:\\.|[^=\\])*?[ \t]+)*?panOSEndpointMac= - fieldName: log.panOSEndpointMac - pattern: (?:\\.|[^=\\])*? - - fieldName: log.paSuffix - pattern: (?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) + pattern: (?:\\.|[^=\\])*?(?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) where: oneOf("log.paFormat", ["CEF", "LEEF-legacy"]) - grok: source: log.paCefExtensions @@ -4159,9 +3353,7 @@ pipeline: - fieldName: log.paIgnored pattern: ^(?:[A-Za-z][A-Za-z0-9_]*=(?:\\.|[^=\\])*?[ \t]+)*?panOSEndpointOSType= - fieldName: log.panOSEndpointOSType - pattern: (?:\\.|[^=\\])*? - - fieldName: log.paSuffix - pattern: (?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) + pattern: (?:\\.|[^=\\])*?(?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) where: oneOf("log.paFormat", ["CEF", "LEEF-legacy"]) - grok: source: log.paCefExtensions @@ -4169,9 +3361,7 @@ pipeline: - fieldName: log.paIgnored pattern: ^(?:[A-Za-z][A-Za-z0-9_]*=(?:\\.|[^=\\])*?[ \t]+)*?panOSEndpointOSVersion= - fieldName: log.panOSEndpointOSVersion - pattern: (?:\\.|[^=\\])*? - - fieldName: log.paSuffix - pattern: (?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) + pattern: (?:\\.|[^=\\])*?(?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) where: oneOf("log.paFormat", ["CEF", "LEEF-legacy"]) - grok: source: log.paCefExtensions @@ -4179,9 +3369,7 @@ pipeline: - fieldName: log.paIgnored pattern: ^(?:[A-Za-z][A-Za-z0-9_]*=(?:\\.|[^=\\])*?[ \t]+)*?panOSEndpointSerialNumber= - fieldName: log.panOSEndpointSerialNumber - pattern: (?:\\.|[^=\\])*? - - fieldName: log.paSuffix - pattern: (?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) + pattern: (?:\\.|[^=\\])*?(?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) where: oneOf("log.paFormat", ["CEF", "LEEF-legacy"]) - grok: source: log.paCefExtensions @@ -4189,9 +3377,7 @@ pipeline: - fieldName: log.paIgnored pattern: ^(?:[A-Za-z][A-Za-z0-9_]*=(?:\\.|[^=\\])*?[ \t]+)*?panOSErrorIndex= - fieldName: log.panOSErrorIndex - pattern: (?:\\.|[^=\\])*? - - fieldName: log.paSuffix - pattern: (?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) + pattern: (?:\\.|[^=\\])*?(?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) where: oneOf("log.paFormat", ["CEF", "LEEF-legacy"]) - grok: source: log.paCefExtensions @@ -4199,9 +3385,7 @@ pipeline: - fieldName: log.paIgnored pattern: ^(?:[A-Za-z][A-Za-z0-9_]*=(?:\\.|[^=\\])*?[ \t]+)*?panOSErrorMessage= - fieldName: log.panOSErrorMessage - pattern: (?:\\.|[^=\\])*? - - fieldName: log.paSuffix - pattern: (?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) + pattern: (?:\\.|[^=\\])*?(?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) where: oneOf("log.paFormat", ["CEF", "LEEF-legacy"]) - grok: source: log.paCefExtensions @@ -4209,9 +3393,7 @@ pipeline: - fieldName: log.paIgnored pattern: ^(?:[A-Za-z][A-Za-z0-9_]*=(?:\\.|[^=\\])*?[ \t]+)*?panOSEventID= - fieldName: log.panOSEventID - pattern: (?:\\.|[^=\\])*? - - fieldName: log.paSuffix - pattern: (?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) + pattern: (?:\\.|[^=\\])*?(?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) where: oneOf("log.paFormat", ["CEF", "LEEF-legacy"]) - grok: source: log.paCefExtensions @@ -4219,9 +3401,7 @@ pipeline: - fieldName: log.paIgnored pattern: ^(?:[A-Za-z][A-Za-z0-9_]*=(?:\\.|[^=\\])*?[ \t]+)*?panOSEventStatus= - fieldName: log.panOSEventStatus - pattern: (?:\\.|[^=\\])*? - - fieldName: log.paSuffix - pattern: (?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) + pattern: (?:\\.|[^=\\])*?(?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) where: oneOf("log.paFormat", ["CEF", "LEEF-legacy"]) - grok: source: log.paCefExtensions @@ -4229,9 +3409,7 @@ pipeline: - fieldName: log.paIgnored pattern: ^(?:[A-Za-z][A-Za-z0-9_]*=(?:\\.|[^=\\])*?[ \t]+)*?panOSFWDeviceGroup= - fieldName: log.panOSFWDeviceGroup - pattern: (?:\\.|[^=\\])*? - - fieldName: log.paSuffix - pattern: (?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) + pattern: (?:\\.|[^=\\])*?(?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) where: oneOf("log.paFormat", ["CEF", "LEEF-legacy"]) - grok: source: log.paCefExtensions @@ -4239,9 +3417,7 @@ pipeline: - fieldName: log.paIgnored pattern: ^(?:[A-Za-z][A-Za-z0-9_]*=(?:\\.|[^=\\])*?[ \t]+)*?panOSFingerprint= - fieldName: log.panOSFingerprint - pattern: (?:\\.|[^=\\])*? - - fieldName: log.paSuffix - pattern: (?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) + pattern: (?:\\.|[^=\\])*?(?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) where: oneOf("log.paFormat", ["CEF", "LEEF-legacy"]) - grok: source: log.paCefExtensions @@ -4249,9 +3425,7 @@ pipeline: - fieldName: log.paIgnored pattern: ^(?:[A-Za-z][A-Za-z0-9_]*=(?:\\.|[^=\\])*?[ \t]+)*?panOSFirewallToServer= - fieldName: log.panOSFirewallToServer - pattern: (?:\\.|[^=\\])*? - - fieldName: log.paSuffix - pattern: (?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) + pattern: (?:\\.|[^=\\])*?(?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) where: oneOf("log.paFormat", ["CEF", "LEEF-legacy"]) - grok: source: log.paCefExtensions @@ -4259,9 +3433,7 @@ pipeline: - fieldName: log.paIgnored pattern: ^(?:[A-Za-z][A-Za-z0-9_]*=(?:\\.|[^=\\])*?[ \t]+)*?panOSGPGatewayLocation= - fieldName: log.panOSGPGatewayLocation - pattern: (?:\\.|[^=\\])*? - - fieldName: log.paSuffix - pattern: (?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) + pattern: (?:\\.|[^=\\])*?(?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) where: oneOf("log.paFormat", ["CEF", "LEEF-legacy"]) - grok: source: log.paCefExtensions @@ -4269,9 +3441,7 @@ pipeline: - fieldName: log.paIgnored pattern: ^(?:[A-Za-z][A-Za-z0-9_]*=(?:\\.|[^=\\])*?[ \t]+)*?panOSGTPCause= - fieldName: log.panOSGTPCause - pattern: (?:\\.|[^=\\])*? - - fieldName: log.paSuffix - pattern: (?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) + pattern: (?:\\.|[^=\\])*?(?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) where: oneOf("log.paFormat", ["CEF", "LEEF-legacy"]) - grok: source: log.paCefExtensions @@ -4279,9 +3449,7 @@ pipeline: - fieldName: log.paIgnored pattern: ^(?:[A-Za-z][A-Za-z0-9_]*=(?:\\.|[^=\\])*?[ \t]+)*?panOSGTPEventCode= - fieldName: log.panOSGTPEventCode - pattern: (?:\\.|[^=\\])*? - - fieldName: log.paSuffix - pattern: (?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) + pattern: (?:\\.|[^=\\])*?(?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) where: oneOf("log.paFormat", ["CEF", "LEEF-legacy"]) - grok: source: log.paCefExtensions @@ -4289,9 +3457,7 @@ pipeline: - fieldName: log.paIgnored pattern: ^(?:[A-Za-z][A-Za-z0-9_]*=(?:\\.|[^=\\])*?[ \t]+)*?panOSGTPEventType= - fieldName: log.panOSGTPEventType - pattern: (?:\\.|[^=\\])*? - - fieldName: log.paSuffix - pattern: (?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) + pattern: (?:\\.|[^=\\])*?(?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) where: oneOf("log.paFormat", ["CEF", "LEEF-legacy"]) - grok: source: log.paCefExtensions @@ -4299,9 +3465,7 @@ pipeline: - fieldName: log.paIgnored pattern: ^(?:[A-Za-z][A-Za-z0-9_]*=(?:\\.|[^=\\])*?[ \t]+)*?panOSGTPInterface= - fieldName: log.panOSGTPInterface - pattern: (?:\\.|[^=\\])*? - - fieldName: log.paSuffix - pattern: (?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) + pattern: (?:\\.|[^=\\])*?(?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) where: oneOf("log.paFormat", ["CEF", "LEEF-legacy"]) - grok: source: log.paCefExtensions @@ -4309,9 +3473,7 @@ pipeline: - fieldName: log.paIgnored pattern: ^(?:[A-Za-z][A-Za-z0-9_]*=(?:\\.|[^=\\])*?[ \t]+)*?panOSGTPMsgType= - fieldName: log.panOSGTPMsgType - pattern: (?:\\.|[^=\\])*? - - fieldName: log.paSuffix - pattern: (?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) + pattern: (?:\\.|[^=\\])*?(?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) where: oneOf("log.paFormat", ["CEF", "LEEF-legacy"]) - grok: source: log.paCefExtensions @@ -4319,9 +3481,7 @@ pipeline: - fieldName: log.paIgnored pattern: ^(?:[A-Za-z][A-Za-z0-9_]*=(?:\\.|[^=\\])*?[ \t]+)*?panOSGateway= - fieldName: log.panOSGateway - pattern: (?:\\.|[^=\\])*? - - fieldName: log.paSuffix - pattern: (?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) + pattern: (?:\\.|[^=\\])*?(?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) where: oneOf("log.paFormat", ["CEF", "LEEF-legacy"]) - grok: source: log.paCefExtensions @@ -4329,9 +3489,7 @@ pipeline: - fieldName: log.paIgnored pattern: ^(?:[A-Za-z][A-Za-z0-9_]*=(?:\\.|[^=\\])*?[ \t]+)*?panOSGatewayPriority= - fieldName: log.panOSGatewayPriority - pattern: (?:\\.|[^=\\])*? - - fieldName: log.paSuffix - pattern: (?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) + pattern: (?:\\.|[^=\\])*?(?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) where: oneOf("log.paFormat", ["CEF", "LEEF-legacy"]) - grok: source: log.paCefExtensions @@ -4339,9 +3497,7 @@ pipeline: - fieldName: log.paIgnored pattern: ^(?:[A-Za-z][A-Za-z0-9_]*=(?:\\.|[^=\\])*?[ \t]+)*?panOSGatewaySelectionType= - fieldName: log.panOSGatewaySelectionType - pattern: (?:\\.|[^=\\])*? - - fieldName: log.paSuffix - pattern: (?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) + pattern: (?:\\.|[^=\\])*?(?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) where: oneOf("log.paFormat", ["CEF", "LEEF-legacy"]) - grok: source: log.paCefExtensions @@ -4349,9 +3505,7 @@ pipeline: - fieldName: log.paIgnored pattern: ^(?:[A-Za-z][A-Za-z0-9_]*=(?:\\.|[^=\\])*?[ \t]+)*?panOSGlobalProtectClientVersion= - fieldName: log.panOSGlobalProtectClientVersion - pattern: (?:\\.|[^=\\])*? - - fieldName: log.paSuffix - pattern: (?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) + pattern: (?:\\.|[^=\\])*?(?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) where: oneOf("log.paFormat", ["CEF", "LEEF-legacy"]) - grok: source: log.paCefExtensions @@ -4359,9 +3513,7 @@ pipeline: - fieldName: log.paIgnored pattern: ^(?:[A-Za-z][A-Za-z0-9_]*=(?:\\.|[^=\\])*?[ \t]+)*?panOSHTTP2Con= - fieldName: log.panOSHTTP2Con - pattern: (?:\\.|[^=\\])*? - - fieldName: log.paSuffix - pattern: (?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) + pattern: (?:\\.|[^=\\])*?(?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) where: oneOf("log.paFormat", ["CEF", "LEEF-legacy"]) - grok: source: log.paCefExtensions @@ -4369,9 +3521,7 @@ pipeline: - fieldName: log.paIgnored pattern: ^(?:[A-Za-z][A-Za-z0-9_]*=(?:\\.|[^=\\])*?[ \t]+)*?panOSHTTPHeader= - fieldName: log.panOSHTTPHeader - pattern: (?:\\.|[^=\\])*? - - fieldName: log.paSuffix - pattern: (?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) + pattern: (?:\\.|[^=\\])*?(?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) where: oneOf("log.paFormat", ["CEF", "LEEF-legacy"]) - grok: source: log.paCefExtensions @@ -4379,9 +3529,7 @@ pipeline: - fieldName: log.paIgnored pattern: ^(?:[A-Za-z][A-Za-z0-9_]*=(?:\\.|[^=\\])*?[ \t]+)*?panOSHTTPUserAgent= - fieldName: log.panOSHTTPUserAgent - pattern: (?:\\.|[^=\\])*? - - fieldName: log.paSuffix - pattern: (?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) + pattern: (?:\\.|[^=\\])*?(?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) where: oneOf("log.paFormat", ["CEF", "LEEF-legacy"]) - grok: source: log.paCefExtensions @@ -4389,9 +3537,7 @@ pipeline: - fieldName: log.paIgnored pattern: ^(?:[A-Za-z][A-Za-z0-9_]*=(?:\\.|[^=\\])*?[ \t]+)*?panOSHostID= - fieldName: log.panOSHostID - pattern: (?:\\.|[^=\\])*? - - fieldName: log.paSuffix - pattern: (?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) + pattern: (?:\\.|[^=\\])*?(?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) where: oneOf("log.paFormat", ["CEF", "LEEF-legacy"]) - grok: source: log.paCefExtensions @@ -4399,9 +3545,7 @@ pipeline: - fieldName: log.paIgnored pattern: ^(?:[A-Za-z][A-Za-z0-9_]*=(?:\\.|[^=\\])*?[ \t]+)*?panOSIssuerCommonName= - fieldName: log.panOSIssuerCommonName - pattern: (?:\\.|[^=\\])*? - - fieldName: log.paSuffix - pattern: (?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) + pattern: (?:\\.|[^=\\])*?(?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) where: oneOf("log.paFormat", ["CEF", "LEEF-legacy"]) - grok: source: log.paCefExtensions @@ -4409,9 +3553,7 @@ pipeline: - fieldName: log.paIgnored pattern: ^(?:[A-Za-z][A-Za-z0-9_]*=(?:\\.|[^=\\])*?[ \t]+)*?panOSIssuerNameLength= - fieldName: log.panOSIssuerNameLength - pattern: (?:\\.|[^=\\])*? - - fieldName: log.paSuffix - pattern: (?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) + pattern: (?:\\.|[^=\\])*?(?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) where: oneOf("log.paFormat", ["CEF", "LEEF-legacy"]) - grok: source: log.paCefExtensions @@ -4419,9 +3561,7 @@ pipeline: - fieldName: log.paIgnored pattern: ^(?:[A-Za-z][A-Za-z0-9_]*=(?:\\.|[^=\\])*?[ \t]+)*?panOSLogTimeStamp= - fieldName: log.panOSLogTimeStamp - pattern: (?:\\.|[^=\\])*? - - fieldName: log.paSuffix - pattern: (?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) + pattern: (?:\\.|[^=\\])*?(?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) where: oneOf("log.paFormat", ["CEF", "LEEF-legacy"]) - grok: source: log.paCefExtensions @@ -4429,9 +3569,7 @@ pipeline: - fieldName: log.paIgnored pattern: ^(?:[A-Za-z][A-Za-z0-9_]*=(?:\\.|[^=\\])*?[ \t]+)*?panOSLogTypeSeqNo= - fieldName: log.panOSLogTypeSeqNo - pattern: (?:\\.|[^=\\])*? - - fieldName: log.paSuffix - pattern: (?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) + pattern: (?:\\.|[^=\\])*?(?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) where: oneOf("log.paFormat", ["CEF", "LEEF-legacy"]) - grok: source: log.paCefExtensions @@ -4439,9 +3577,7 @@ pipeline: - fieldName: log.paIgnored pattern: ^(?:[A-Za-z][A-Za-z0-9_]*=(?:\\.|[^=\\])*?[ \t]+)*?panOSLoginDuration= - fieldName: log.panOSLoginDuration - pattern: (?:\\.|[^=\\])*? - - fieldName: log.paSuffix - pattern: (?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) + pattern: (?:\\.|[^=\\])*?(?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) where: oneOf("log.paFormat", ["CEF", "LEEF-legacy"]) - grok: source: log.paCefExtensions @@ -4449,9 +3585,7 @@ pipeline: - fieldName: log.paIgnored pattern: ^(?:[A-Za-z][A-Za-z0-9_]*=(?:\\.|[^=\\])*?[ \t]+)*?panOSMSISDN= - fieldName: log.panOSMSISDN - pattern: (?:\\.|[^=\\])*? - - fieldName: log.paSuffix - pattern: (?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) + pattern: (?:\\.|[^=\\])*?(?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) where: oneOf("log.paFormat", ["CEF", "LEEF-legacy"]) - grok: source: log.paCefExtensions @@ -4459,9 +3593,7 @@ pipeline: - fieldName: log.paIgnored pattern: ^(?:[A-Za-z][A-Za-z0-9_]*=(?:\\.|[^=\\])*?[ \t]+)*?panOSMonitorTag= - fieldName: log.panOSMonitorTag - pattern: (?:\\.|[^=\\])*? - - fieldName: log.paSuffix - pattern: (?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) + pattern: (?:\\.|[^=\\])*?(?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) where: oneOf("log.paFormat", ["CEF", "LEEF-legacy"]) - grok: source: log.paCefExtensions @@ -4469,9 +3601,7 @@ pipeline: - fieldName: log.paIgnored pattern: ^(?:[A-Za-z][A-Za-z0-9_]*=(?:\\.|[^=\\])*?[ \t]+)*?panOSOpCode= - fieldName: log.panOSOpCode - pattern: (?:\\.|[^=\\])*? - - fieldName: log.paSuffix - pattern: (?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) + pattern: (?:\\.|[^=\\])*?(?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) where: oneOf("log.paFormat", ["CEF", "LEEF-legacy"]) - grok: source: log.paCefExtensions @@ -4479,9 +3609,7 @@ pipeline: - fieldName: log.paIgnored pattern: ^(?:[A-Za-z][A-Za-z0-9_]*=(?:\\.|[^=\\])*?[ \t]+)*?panOSPPID= - fieldName: log.panOSPPID - pattern: (?:\\.|[^=\\])*? - - fieldName: log.paSuffix - pattern: (?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) + pattern: (?:\\.|[^=\\])*?(?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) where: oneOf("log.paFormat", ["CEF", "LEEF-legacy"]) - grok: source: log.paCefExtensions @@ -4489,9 +3617,7 @@ pipeline: - fieldName: log.paIgnored pattern: ^(?:[A-Za-z][A-Za-z0-9_]*=(?:\\.|[^=\\])*?[ \t]+)*?panOSPacketsReceived= - fieldName: log.panOSPacketsReceived - pattern: (?:\\.|[^=\\])*? - - fieldName: log.paSuffix - pattern: (?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) + pattern: (?:\\.|[^=\\])*?(?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) where: oneOf("log.paFormat", ["CEF", "LEEF-legacy"]) - grok: source: log.paCefExtensions @@ -4499,9 +3625,7 @@ pipeline: - fieldName: log.paIgnored pattern: ^(?:[A-Za-z][A-Za-z0-9_]*=(?:\\.|[^=\\])*?[ \t]+)*?panOSPacketsSent= - fieldName: log.panOSPacketsSent - pattern: (?:\\.|[^=\\])*? - - fieldName: log.paSuffix - pattern: (?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) + pattern: (?:\\.|[^=\\])*?(?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) where: oneOf("log.paFormat", ["CEF", "LEEF-legacy"]) - grok: source: log.paCefExtensions @@ -4509,9 +3633,7 @@ pipeline: - fieldName: log.paIgnored pattern: ^(?:[A-Za-z][A-Za-z0-9_]*=(?:\\.|[^=\\])*?[ \t]+)*?panOSParentSessionID= - fieldName: log.panOSParentSessionID - pattern: (?:\\.|[^=\\])*? - - fieldName: log.paSuffix - pattern: (?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) + pattern: (?:\\.|[^=\\])*?(?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) where: oneOf("log.paFormat", ["CEF", "LEEF-legacy"]) - grok: source: log.paCefExtensions @@ -4519,9 +3641,7 @@ pipeline: - fieldName: log.paIgnored pattern: ^(?:[A-Za-z][A-Za-z0-9_]*=(?:\\.|[^=\\])*?[ \t]+)*?panOSParentStartTime= - fieldName: log.panOSParentStartTime - pattern: (?:\\.|[^=\\])*? - - fieldName: log.paSuffix - pattern: (?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) + pattern: (?:\\.|[^=\\])*?(?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) where: oneOf("log.paFormat", ["CEF", "LEEF-legacy"]) - grok: source: log.paCefExtensions @@ -4529,9 +3649,7 @@ pipeline: - fieldName: log.paIgnored pattern: ^(?:[A-Za-z][A-Za-z0-9_]*=(?:\\.|[^=\\])*?[ \t]+)*?panOSPayloadProtID= - fieldName: log.panOSPayloadProtID - pattern: (?:\\.|[^=\\])*? - - fieldName: log.paSuffix - pattern: (?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) + pattern: (?:\\.|[^=\\])*?(?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) where: oneOf("log.paFormat", ["CEF", "LEEF-legacy"]) - grok: source: log.paCefExtensions @@ -4539,9 +3657,7 @@ pipeline: - fieldName: log.paIgnored pattern: ^(?:[A-Za-z][A-Za-z0-9_]*=(?:\\.|[^=\\])*?[ \t]+)*?panOSPcapID= - fieldName: log.panOSPcapID - pattern: (?:\\.|[^=\\])*? - - fieldName: log.paSuffix - pattern: (?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) + pattern: (?:\\.|[^=\\])*?(?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) where: oneOf("log.paFormat", ["CEF", "LEEF-legacy"]) - grok: source: log.paCefExtensions @@ -4549,9 +3665,7 @@ pipeline: - fieldName: log.paIgnored pattern: ^(?:[A-Za-z][A-Za-z0-9_]*=(?:\\.|[^=\\])*?[ \t]+)*?panOSPolicyAuditComment= - fieldName: log.panOSPolicyAuditComment - pattern: (?:\\.|[^=\\])*? - - fieldName: log.paSuffix - pattern: (?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) + pattern: (?:\\.|[^=\\])*?(?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) where: oneOf("log.paFormat", ["CEF", "LEEF-legacy"]) - grok: source: log.paCefExtensions @@ -4559,9 +3673,7 @@ pipeline: - fieldName: log.paIgnored pattern: ^(?:[A-Za-z][A-Za-z0-9_]*=(?:\\.|[^=\\])*?[ \t]+)*?panOSPolicyName= - fieldName: log.panOSPolicyName - pattern: (?:\\.|[^=\\])*? - - fieldName: log.paSuffix - pattern: (?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) + pattern: (?:\\.|[^=\\])*?(?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) where: oneOf("log.paFormat", ["CEF", "LEEF-legacy"]) - grok: source: log.paCefExtensions @@ -4569,9 +3681,7 @@ pipeline: - fieldName: log.paIgnored pattern: ^(?:[A-Za-z][A-Za-z0-9_]*=(?:\\.|[^=\\])*?[ \t]+)*?panOSPortal= - fieldName: log.panOSPortal - pattern: (?:\\.|[^=\\])*? - - fieldName: log.paSuffix - pattern: (?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) + pattern: (?:\\.|[^=\\])*?(?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) where: oneOf("log.paFormat", ["CEF", "LEEF-legacy"]) - grok: source: log.paCefExtensions @@ -4579,9 +3689,7 @@ pipeline: - fieldName: log.paIgnored pattern: ^(?:[A-Za-z][A-Za-z0-9_]*=(?:\\.|[^=\\])*?[ \t]+)*?panOSPrivateIPv4= - fieldName: log.panOSPrivateIPv4 - pattern: (?:\\.|[^=\\])*? - - fieldName: log.paSuffix - pattern: (?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) + pattern: (?:\\.|[^=\\])*?(?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) where: oneOf("log.paFormat", ["CEF", "LEEF-legacy"]) - grok: source: log.paCefExtensions @@ -4589,9 +3697,7 @@ pipeline: - fieldName: log.paIgnored pattern: ^(?:[A-Za-z][A-Za-z0-9_]*=(?:\\.|[^=\\])*?[ \t]+)*?panOSPrivateIPv6= - fieldName: log.panOSPrivateIPv6 - pattern: (?:\\.|[^=\\])*? - - fieldName: log.paSuffix - pattern: (?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) + pattern: (?:\\.|[^=\\])*?(?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) where: oneOf("log.paFormat", ["CEF", "LEEF-legacy"]) - grok: source: log.paCefExtensions @@ -4599,9 +3705,7 @@ pipeline: - fieldName: log.paIgnored pattern: ^(?:[A-Za-z][A-Za-z0-9_]*=(?:\\.|[^=\\])*?[ \t]+)*?panOSProxyType= - fieldName: log.panOSProxyType - pattern: (?:\\.|[^=\\])*? - - fieldName: log.paSuffix - pattern: (?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) + pattern: (?:\\.|[^=\\])*?(?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) where: oneOf("log.paFormat", ["CEF", "LEEF-legacy"]) - grok: source: log.paCefExtensions @@ -4609,9 +3713,7 @@ pipeline: - fieldName: log.paIgnored pattern: ^(?:[A-Za-z][A-Za-z0-9_]*=(?:\\.|[^=\\])*?[ \t]+)*?panOSPublicIPv4= - fieldName: log.panOSPublicIPv4 - pattern: (?:\\.|[^=\\])*? - - fieldName: log.paSuffix - pattern: (?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) + pattern: (?:\\.|[^=\\])*?(?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) where: oneOf("log.paFormat", ["CEF", "LEEF-legacy"]) - grok: source: log.paCefExtensions @@ -4619,9 +3721,7 @@ pipeline: - fieldName: log.paIgnored pattern: ^(?:[A-Za-z][A-Za-z0-9_]*=(?:\\.|[^=\\])*?[ \t]+)*?panOSPublicIPv6= - fieldName: log.panOSPublicIPv6 - pattern: (?:\\.|[^=\\])*? - - fieldName: log.paSuffix - pattern: (?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) + pattern: (?:\\.|[^=\\])*?(?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) where: oneOf("log.paFormat", ["CEF", "LEEF-legacy"]) - grok: source: log.paCefExtensions @@ -4629,9 +3729,7 @@ pipeline: - fieldName: log.paIgnored pattern: ^(?:[A-Za-z][A-Za-z0-9_]*=(?:\\.|[^=\\])*?[ \t]+)*?panOSQuarantineReason= - fieldName: log.panOSQuarantineReason - pattern: (?:\\.|[^=\\])*? - - fieldName: log.paSuffix - pattern: (?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) + pattern: (?:\\.|[^=\\])*?(?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) where: oneOf("log.paFormat", ["CEF", "LEEF-legacy"]) - grok: source: log.paCefExtensions @@ -4639,9 +3737,7 @@ pipeline: - fieldName: log.paIgnored pattern: ^(?:[A-Za-z][A-Za-z0-9_]*=(?:\\.|[^=\\])*?[ \t]+)*?panOSRadioTech= - fieldName: log.panOSRadioTech - pattern: (?:\\.|[^=\\])*? - - fieldName: log.paSuffix - pattern: (?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) + pattern: (?:\\.|[^=\\])*?(?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) where: oneOf("log.paFormat", ["CEF", "LEEF-legacy"]) - grok: source: log.paCefExtensions @@ -4649,9 +3745,7 @@ pipeline: - fieldName: log.paIgnored pattern: ^(?:[A-Za-z][A-Za-z0-9_]*=(?:\\.|[^=\\])*?[ \t]+)*?panOSReferer= - fieldName: log.panOSReferer - pattern: (?:\\.|[^=\\])*? - - fieldName: log.paSuffix - pattern: (?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) + pattern: (?:\\.|[^=\\])*?(?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) where: oneOf("log.paFormat", ["CEF", "LEEF-legacy"]) - grok: source: log.paCefExtensions @@ -4659,9 +3753,7 @@ pipeline: - fieldName: log.paIgnored pattern: ^(?:[A-Za-z][A-Za-z0-9_]*=(?:\\.|[^=\\])*?[ \t]+)*?panOSRmtUserID= - fieldName: log.panOSRmtUserID - pattern: (?:\\.|[^=\\])*? - - fieldName: log.paSuffix - pattern: (?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) + pattern: (?:\\.|[^=\\])*?(?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) where: oneOf("log.paFormat", ["CEF", "LEEF-legacy"]) - grok: source: log.paCefExtensions @@ -4669,9 +3761,7 @@ pipeline: - fieldName: log.paIgnored pattern: ^(?:[A-Za-z][A-Za-z0-9_]*=(?:\\.|[^=\\])*?[ \t]+)*?panOSRmtUserIP= - fieldName: log.panOSRmtUserIP - pattern: (?:\\.|[^=\\])*? - - fieldName: log.paSuffix - pattern: (?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) + pattern: (?:\\.|[^=\\])*?(?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) where: oneOf("log.paFormat", ["CEF", "LEEF-legacy"]) - grok: source: log.paCefExtensions @@ -4679,9 +3769,7 @@ pipeline: - fieldName: log.paIgnored pattern: ^(?:[A-Za-z][A-Za-z0-9_]*=(?:\\.|[^=\\])*?[ \t]+)*?panOSRootCNLength= - fieldName: log.panOSRootCNLength - pattern: (?:\\.|[^=\\])*? - - fieldName: log.paSuffix - pattern: (?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) + pattern: (?:\\.|[^=\\])*?(?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) where: oneOf("log.paFormat", ["CEF", "LEEF-legacy"]) - grok: source: log.paCefExtensions @@ -4689,9 +3777,7 @@ pipeline: - fieldName: log.paIgnored pattern: ^(?:[A-Za-z][A-Za-z0-9_]*=(?:\\.|[^=\\])*?[ \t]+)*?panOSRootCommonName= - fieldName: log.panOSRootCommonName - pattern: (?:\\.|[^=\\])*? - - fieldName: log.paSuffix - pattern: (?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) + pattern: (?:\\.|[^=\\])*?(?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) where: oneOf("log.paFormat", ["CEF", "LEEF-legacy"]) - grok: source: log.paCefExtensions @@ -4699,9 +3785,7 @@ pipeline: - fieldName: log.paIgnored pattern: ^(?:[A-Za-z][A-Za-z0-9_]*=(?:\\.|[^=\\])*?[ \t]+)*?panOSRootStatus= - fieldName: log.panOSRootStatus - pattern: (?:\\.|[^=\\])*? - - fieldName: log.paSuffix - pattern: (?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) + pattern: (?:\\.|[^=\\])*?(?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) where: oneOf("log.paFormat", ["CEF", "LEEF-legacy"]) - grok: source: log.paCefExtensions @@ -4709,9 +3793,7 @@ pipeline: - fieldName: log.paIgnored pattern: ^(?:[A-Za-z][A-Za-z0-9_]*=(?:\\.|[^=\\])*?[ \t]+)*?panOSRuleUUID= - fieldName: log.panOSRuleUUID - pattern: (?:\\.|[^=\\])*? - - fieldName: log.paSuffix - pattern: (?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) + pattern: (?:\\.|[^=\\])*?(?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) where: oneOf("log.paFormat", ["CEF", "LEEF-legacy"]) - grok: source: log.paCefExtensions @@ -4719,9 +3801,7 @@ pipeline: - fieldName: log.paIgnored pattern: ^(?:[A-Za-z][A-Za-z0-9_]*=(?:\\.|[^=\\])*?[ \t]+)*?panOSSCCPCallingGT= - fieldName: log.panOSSCCPCallingGT - pattern: (?:\\.|[^=\\])*? - - fieldName: log.paSuffix - pattern: (?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) + pattern: (?:\\.|[^=\\])*?(?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) where: oneOf("log.paFormat", ["CEF", "LEEF-legacy"]) - grok: source: log.paCefExtensions @@ -4729,9 +3809,7 @@ pipeline: - fieldName: log.paIgnored pattern: ^(?:[A-Za-z][A-Za-z0-9_]*=(?:\\.|[^=\\])*?[ \t]+)*?panOSSCCPCallingPartySSN= - fieldName: log.panOSSCCPCallingPartySSN - pattern: (?:\\.|[^=\\])*? - - fieldName: log.paSuffix - pattern: (?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) + pattern: (?:\\.|[^=\\])*?(?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) where: oneOf("log.paFormat", ["CEF", "LEEF-legacy"]) - grok: source: log.paCefExtensions @@ -4739,9 +3817,7 @@ pipeline: - fieldName: log.paIgnored pattern: ^(?:[A-Za-z][A-Za-z0-9_]*=(?:\\.|[^=\\])*?[ \t]+)*?panOSSCTPAssocEndReason= - fieldName: log.panOSSCTPAssocEndReason - pattern: (?:\\.|[^=\\])*? - - fieldName: log.paSuffix - pattern: (?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) + pattern: (?:\\.|[^=\\])*?(?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) where: oneOf("log.paFormat", ["CEF", "LEEF-legacy"]) - grok: source: log.paCefExtensions @@ -4749,9 +3825,7 @@ pipeline: - fieldName: log.paIgnored pattern: ^(?:[A-Za-z][A-Za-z0-9_]*=(?:\\.|[^=\\])*?[ \t]+)*?panOSSCTPAssocID= - fieldName: log.panOSSCTPAssocID - pattern: (?:\\.|[^=\\])*? - - fieldName: log.paSuffix - pattern: (?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) + pattern: (?:\\.|[^=\\])*?(?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) where: oneOf("log.paFormat", ["CEF", "LEEF-legacy"]) - grok: source: log.paCefExtensions @@ -4759,9 +3833,7 @@ pipeline: - fieldName: log.paIgnored pattern: ^(?:[A-Za-z][A-Za-z0-9_]*=(?:\\.|[^=\\])*?[ \t]+)*?panOSSCTPCauseCode= - fieldName: log.panOSSCTPCauseCode - pattern: (?:\\.|[^=\\])*? - - fieldName: log.paSuffix - pattern: (?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) + pattern: (?:\\.|[^=\\])*?(?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) where: oneOf("log.paFormat", ["CEF", "LEEF-legacy"]) - grok: source: log.paCefExtensions @@ -4769,9 +3841,7 @@ pipeline: - fieldName: log.paIgnored pattern: ^(?:[A-Za-z][A-Za-z0-9_]*=(?:\\.|[^=\\])*?[ \t]+)*?panOSSCTPChunkRcv= - fieldName: log.panOSSCTPChunkRcv - pattern: (?:\\.|[^=\\])*? - - fieldName: log.paSuffix - pattern: (?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) + pattern: (?:\\.|[^=\\])*?(?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) where: oneOf("log.paFormat", ["CEF", "LEEF-legacy"]) - grok: source: log.paCefExtensions @@ -4779,9 +3849,7 @@ pipeline: - fieldName: log.paIgnored pattern: ^(?:[A-Za-z][A-Za-z0-9_]*=(?:\\.|[^=\\])*?[ \t]+)*?panOSSCTPChunkSent= - fieldName: log.panOSSCTPChunkSent - pattern: (?:\\.|[^=\\])*? - - fieldName: log.paSuffix - pattern: (?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) + pattern: (?:\\.|[^=\\])*?(?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) where: oneOf("log.paFormat", ["CEF", "LEEF-legacy"]) - grok: source: log.paCefExtensions @@ -4789,9 +3857,7 @@ pipeline: - fieldName: log.paIgnored pattern: ^(?:[A-Za-z][A-Za-z0-9_]*=(?:\\.|[^=\\])*?[ \t]+)*?panOSSCTPChunks= - fieldName: log.panOSSCTPChunks - pattern: (?:\\.|[^=\\])*? - - fieldName: log.paSuffix - pattern: (?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) + pattern: (?:\\.|[^=\\])*?(?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) where: oneOf("log.paFormat", ["CEF", "LEEF-legacy"]) - grok: source: log.paCefExtensions @@ -4799,9 +3865,7 @@ pipeline: - fieldName: log.paIgnored pattern: ^(?:[A-Za-z][A-Za-z0-9_]*=(?:\\.|[^=\\])*?[ \t]+)*?panOSSCTPChunksRcv= - fieldName: log.panOSSCTPChunksRcv - pattern: (?:\\.|[^=\\])*? - - fieldName: log.paSuffix - pattern: (?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) + pattern: (?:\\.|[^=\\])*?(?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) where: oneOf("log.paFormat", ["CEF", "LEEF-legacy"]) - grok: source: log.paCefExtensions @@ -4809,9 +3873,7 @@ pipeline: - fieldName: log.paIgnored pattern: ^(?:[A-Za-z][A-Za-z0-9_]*=(?:\\.|[^=\\])*?[ \t]+)*?panOSSCTPFilter= - fieldName: log.panOSSCTPFilter - pattern: (?:\\.|[^=\\])*? - - fieldName: log.paSuffix - pattern: (?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) + pattern: (?:\\.|[^=\\])*?(?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) where: oneOf("log.paFormat", ["CEF", "LEEF-legacy"]) - grok: source: log.paCefExtensions @@ -4819,9 +3881,7 @@ pipeline: - fieldName: log.paIgnored pattern: ^(?:[A-Za-z][A-Za-z0-9_]*=(?:\\.|[^=\\])*?[ \t]+)*?panOSSCTPStreamID= - fieldName: log.panOSSCTPStreamID - pattern: (?:\\.|[^=\\])*? - - fieldName: log.paSuffix - pattern: (?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) + pattern: (?:\\.|[^=\\])*?(?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) where: oneOf("log.paFormat", ["CEF", "LEEF-legacy"]) - grok: source: log.paCefExtensions @@ -4829,9 +3889,7 @@ pipeline: - fieldName: log.paIgnored pattern: ^(?:[A-Za-z][A-Za-z0-9_]*=(?:\\.|[^=\\])*?[ \t]+)*?panOSSCTPVerTag1= - fieldName: log.panOSSCTPVerTag1 - pattern: (?:\\.|[^=\\])*? - - fieldName: log.paSuffix - pattern: (?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) + pattern: (?:\\.|[^=\\])*?(?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) where: oneOf("log.paFormat", ["CEF", "LEEF-legacy"]) - grok: source: log.paCefExtensions @@ -4839,9 +3897,7 @@ pipeline: - fieldName: log.paIgnored pattern: ^(?:[A-Za-z][A-Za-z0-9_]*=(?:\\.|[^=\\])*?[ \t]+)*?panOSSCTPVerTag2= - fieldName: log.panOSSCTPVerTag2 - pattern: (?:\\.|[^=\\])*? - - fieldName: log.paSuffix - pattern: (?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) + pattern: (?:\\.|[^=\\])*?(?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) where: oneOf("log.paFormat", ["CEF", "LEEF-legacy"]) - grok: source: log.paCefExtensions @@ -4849,9 +3905,7 @@ pipeline: - fieldName: log.paIgnored pattern: ^(?:[A-Za-z][A-Za-z0-9_]*=(?:\\.|[^=\\])*?[ \t]+)*?panOSSNILength= - fieldName: log.panOSSNILength - pattern: (?:\\.|[^=\\])*? - - fieldName: log.paSuffix - pattern: (?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) + pattern: (?:\\.|[^=\\])*?(?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) where: oneOf("log.paFormat", ["CEF", "LEEF-legacy"]) - grok: source: log.paCefExtensions @@ -4859,9 +3913,7 @@ pipeline: - fieldName: log.paIgnored pattern: ^(?:[A-Za-z][A-Za-z0-9_]*=(?:\\.|[^=\\])*?[ \t]+)*?panOSSSLResponseTime= - fieldName: log.panOSSSLResponseTime - pattern: (?:\\.|[^=\\])*? - - fieldName: log.paSuffix - pattern: (?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) + pattern: (?:\\.|[^=\\])*?(?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) where: oneOf("log.paFormat", ["CEF", "LEEF-legacy"]) - grok: source: log.paCefExtensions @@ -4869,9 +3921,7 @@ pipeline: - fieldName: log.paIgnored pattern: ^(?:[A-Za-z][A-Za-z0-9_]*=(?:\\.|[^=\\])*?[ \t]+)*?panOSSequenceNo= - fieldName: log.panOSSequenceNo - pattern: (?:\\.|[^=\\])*? - - fieldName: log.paSuffix - pattern: (?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) + pattern: (?:\\.|[^=\\])*?(?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) where: oneOf("log.paFormat", ["CEF", "LEEF-legacy"]) - grok: source: log.paCefExtensions @@ -4879,9 +3929,7 @@ pipeline: - fieldName: log.paIgnored pattern: ^(?:[A-Za-z][A-Za-z0-9_]*=(?:\\.|[^=\\])*?[ \t]+)*?panOSServerNameIndication= - fieldName: log.panOSServerNameIndication - pattern: (?:\\.|[^=\\])*? - - fieldName: log.paSuffix - pattern: (?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) + pattern: (?:\\.|[^=\\])*?(?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) where: oneOf("log.paFormat", ["CEF", "LEEF-legacy"]) - grok: source: log.paCefExtensions @@ -4889,9 +3937,7 @@ pipeline: - fieldName: log.paIgnored pattern: ^(?:[A-Za-z][A-Za-z0-9_]*=(?:\\.|[^=\\])*?[ \t]+)*?panOSServingCntryMCC= - fieldName: log.panOSServingCntryMCC - pattern: (?:\\.|[^=\\])*? - - fieldName: log.paSuffix - pattern: (?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) + pattern: (?:\\.|[^=\\])*?(?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) where: oneOf("log.paFormat", ["CEF", "LEEF-legacy"]) - grok: source: log.paCefExtensions @@ -4899,9 +3945,7 @@ pipeline: - fieldName: log.paIgnored pattern: ^(?:[A-Za-z][A-Za-z0-9_]*=(?:\\.|[^=\\])*?[ \t]+)*?panOSServingNetMNC= - fieldName: log.panOSServingNetMNC - pattern: (?:\\.|[^=\\])*? - - fieldName: log.paSuffix - pattern: (?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) + pattern: (?:\\.|[^=\\])*?(?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) where: oneOf("log.paFormat", ["CEF", "LEEF-legacy"]) - grok: source: log.paCefExtensions @@ -4909,9 +3953,7 @@ pipeline: - fieldName: log.paIgnored pattern: ^(?:[A-Za-z][A-Za-z0-9_]*=(?:\\.|[^=\\])*?[ \t]+)*?panOSSeverity= - fieldName: log.panOSSeverity - pattern: (?:\\.|[^=\\])*? - - fieldName: log.paSuffix - pattern: (?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) + pattern: (?:\\.|[^=\\])*?(?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) where: oneOf("log.paFormat", ["CEF", "LEEF-legacy"]) - grok: source: log.paCefExtensions @@ -4919,9 +3961,7 @@ pipeline: - fieldName: log.paIgnored pattern: ^(?:[A-Za-z][A-Za-z0-9_]*=(?:\\.|[^=\\])*?[ \t]+)*?panOSSourceDeviceCategory= - fieldName: log.panOSSourceDeviceCategory - pattern: (?:\\.|[^=\\])*? - - fieldName: log.paSuffix - pattern: (?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) + pattern: (?:\\.|[^=\\])*?(?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) where: oneOf("log.paFormat", ["CEF", "LEEF-legacy"]) - grok: source: log.paCefExtensions @@ -4929,9 +3969,7 @@ pipeline: - fieldName: log.paIgnored pattern: ^(?:[A-Za-z][A-Za-z0-9_]*=(?:\\.|[^=\\])*?[ \t]+)*?panOSSourceDeviceHost= - fieldName: log.panOSSourceDeviceHost - pattern: (?:\\.|[^=\\])*? - - fieldName: log.paSuffix - pattern: (?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) + pattern: (?:\\.|[^=\\])*?(?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) where: oneOf("log.paFormat", ["CEF", "LEEF-legacy"]) - grok: source: log.paCefExtensions @@ -4939,9 +3977,7 @@ pipeline: - fieldName: log.paIgnored pattern: ^(?:[A-Za-z][A-Za-z0-9_]*=(?:\\.|[^=\\])*?[ \t]+)*?panOSSourceDeviceMac= - fieldName: log.panOSSourceDeviceMac - pattern: (?:\\.|[^=\\])*? - - fieldName: log.paSuffix - pattern: (?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) + pattern: (?:\\.|[^=\\])*?(?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) where: oneOf("log.paFormat", ["CEF", "LEEF-legacy"]) - grok: source: log.paCefExtensions @@ -4949,9 +3985,7 @@ pipeline: - fieldName: log.paIgnored pattern: ^(?:[A-Za-z][A-Za-z0-9_]*=(?:\\.|[^=\\])*?[ \t]+)*?panOSSourceDeviceModel= - fieldName: log.panOSSourceDeviceModel - pattern: (?:\\.|[^=\\])*? - - fieldName: log.paSuffix - pattern: (?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) + pattern: (?:\\.|[^=\\])*?(?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) where: oneOf("log.paFormat", ["CEF", "LEEF-legacy"]) - grok: source: log.paCefExtensions @@ -4959,9 +3993,7 @@ pipeline: - fieldName: log.paIgnored pattern: ^(?:[A-Za-z][A-Za-z0-9_]*=(?:\\.|[^=\\])*?[ \t]+)*?panOSSourceDeviceOSFamily= - fieldName: log.panOSSourceDeviceOSFamily - pattern: (?:\\.|[^=\\])*? - - fieldName: log.paSuffix - pattern: (?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) + pattern: (?:\\.|[^=\\])*?(?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) where: oneOf("log.paFormat", ["CEF", "LEEF-legacy"]) - grok: source: log.paCefExtensions @@ -4969,9 +4001,7 @@ pipeline: - fieldName: log.paIgnored pattern: ^(?:[A-Za-z][A-Za-z0-9_]*=(?:\\.|[^=\\])*?[ \t]+)*?panOSSourceDeviceOSVersion= - fieldName: log.panOSSourceDeviceOSVersion - pattern: (?:\\.|[^=\\])*? - - fieldName: log.paSuffix - pattern: (?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) + pattern: (?:\\.|[^=\\])*?(?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) where: oneOf("log.paFormat", ["CEF", "LEEF-legacy"]) - grok: source: log.paCefExtensions @@ -4979,9 +4009,7 @@ pipeline: - fieldName: log.paIgnored pattern: ^(?:[A-Za-z][A-Za-z0-9_]*=(?:\\.|[^=\\])*?[ \t]+)*?panOSSourceDeviceProfile= - fieldName: log.panOSSourceDeviceProfile - pattern: (?:\\.|[^=\\])*? - - fieldName: log.paSuffix - pattern: (?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) + pattern: (?:\\.|[^=\\])*?(?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) where: oneOf("log.paFormat", ["CEF", "LEEF-legacy"]) - grok: source: log.paCefExtensions @@ -4989,9 +4017,7 @@ pipeline: - fieldName: log.paIgnored pattern: ^(?:[A-Za-z][A-Za-z0-9_]*=(?:\\.|[^=\\])*?[ \t]+)*?panOSSourceDeviceVendor= - fieldName: log.panOSSourceDeviceVendor - pattern: (?:\\.|[^=\\])*? - - fieldName: log.paSuffix - pattern: (?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) + pattern: (?:\\.|[^=\\])*?(?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) where: oneOf("log.paFormat", ["CEF", "LEEF-legacy"]) - grok: source: log.paCefExtensions @@ -4999,9 +4025,7 @@ pipeline: - fieldName: log.paIgnored pattern: ^(?:[A-Za-z][A-Za-z0-9_]*=(?:\\.|[^=\\])*?[ \t]+)*?panOSSourceDynamicAddressGroup= - fieldName: log.panOSSourceDynamicAddressGroup - pattern: (?:\\.|[^=\\])*? - - fieldName: log.paSuffix - pattern: (?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) + pattern: (?:\\.|[^=\\])*?(?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) where: oneOf("log.paFormat", ["CEF", "LEEF-legacy"]) - grok: source: log.paCefExtensions @@ -5009,9 +4033,7 @@ pipeline: - fieldName: log.paIgnored pattern: ^(?:[A-Za-z][A-Za-z0-9_]*=(?:\\.|[^=\\])*?[ \t]+)*?panOSSourceEDL= - fieldName: log.panOSSourceEDL - pattern: (?:\\.|[^=\\])*? - - fieldName: log.paSuffix - pattern: (?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) + pattern: (?:\\.|[^=\\])*?(?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) where: oneOf("log.paFormat", ["CEF", "LEEF-legacy"]) - grok: source: log.paCefExtensions @@ -5019,9 +4041,7 @@ pipeline: - fieldName: log.paIgnored pattern: ^(?:[A-Za-z][A-Za-z0-9_]*=(?:\\.|[^=\\])*?[ \t]+)*?panOSSourceHostname= - fieldName: log.panOSSourceHostname - pattern: (?:\\.|[^=\\])*? - - fieldName: log.paSuffix - pattern: (?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) + pattern: (?:\\.|[^=\\])*?(?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) where: oneOf("log.paFormat", ["CEF", "LEEF-legacy"]) - grok: source: log.paCefExtensions @@ -5029,9 +4049,7 @@ pipeline: - fieldName: log.paIgnored pattern: ^(?:[A-Za-z][A-Za-z0-9_]*=(?:\\.|[^=\\])*?[ \t]+)*?panOSSourceMac= - fieldName: log.panOSSourceMac - pattern: (?:\\.|[^=\\])*? - - fieldName: log.paSuffix - pattern: (?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) + pattern: (?:\\.|[^=\\])*?(?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) where: oneOf("log.paFormat", ["CEF", "LEEF-legacy"]) - grok: source: log.paCefExtensions @@ -5039,9 +4057,7 @@ pipeline: - fieldName: log.paIgnored pattern: ^(?:[A-Za-z][A-Za-z0-9_]*=(?:\\.|[^=\\])*?[ \t]+)*?panOSSourceRegion= - fieldName: log.panOSSourceRegion - pattern: (?:\\.|[^=\\])*? - - fieldName: log.paSuffix - pattern: (?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) + pattern: (?:\\.|[^=\\])*?(?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) where: oneOf("log.paFormat", ["CEF", "LEEF-legacy"]) - grok: source: log.paCefExtensions @@ -5049,9 +4065,7 @@ pipeline: - fieldName: log.paIgnored pattern: ^(?:[A-Za-z][A-Za-z0-9_]*=(?:\\.|[^=\\])*?[ \t]+)*?panOSSourceUUID= - fieldName: log.panOSSourceUUID - pattern: (?:\\.|[^=\\])*? - - fieldName: log.paSuffix - pattern: (?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) + pattern: (?:\\.|[^=\\])*?(?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) where: oneOf("log.paFormat", ["CEF", "LEEF-legacy"]) - grok: source: log.paCefExtensions @@ -5059,9 +4073,7 @@ pipeline: - fieldName: log.paIgnored pattern: ^(?:[A-Za-z][A-Za-z0-9_]*=(?:\\.|[^=\\])*?[ \t]+)*?panOSSourceUserName= - fieldName: log.panOSSourceUserName - pattern: (?:\\.|[^=\\])*? - - fieldName: log.paSuffix - pattern: (?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) + pattern: (?:\\.|[^=\\])*?(?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) where: oneOf("log.paFormat", ["CEF", "LEEF-legacy"]) - grok: source: log.paCefExtensions @@ -5069,9 +4081,7 @@ pipeline: - fieldName: log.paIgnored pattern: ^(?:[A-Za-z][A-Za-z0-9_]*=(?:\\.|[^=\\])*?[ \t]+)*?panOSSrcUUID= - fieldName: log.panOSSrcUUID - pattern: (?:\\.|[^=\\])*? - - fieldName: log.paSuffix - pattern: (?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) + pattern: (?:\\.|[^=\\])*?(?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) where: oneOf("log.paFormat", ["CEF", "LEEF-legacy"]) - grok: source: log.paCefExtensions @@ -5079,9 +4089,7 @@ pipeline: - fieldName: log.paIgnored pattern: ^(?:[A-Za-z][A-Za-z0-9_]*=(?:\\.|[^=\\])*?[ \t]+)*?panOSStage= - fieldName: log.panOSStage - pattern: (?:\\.|[^=\\])*? - - fieldName: log.paSuffix - pattern: (?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) + pattern: (?:\\.|[^=\\])*?(?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) where: oneOf("log.paFormat", ["CEF", "LEEF-legacy"]) - grok: source: log.paCefExtensions @@ -5089,9 +4097,7 @@ pipeline: - fieldName: log.paIgnored pattern: ^(?:[A-Za-z][A-Za-z0-9_]*=(?:\\.|[^=\\])*?[ \t]+)*?panOSTLSAuth= - fieldName: log.panOSTLSAuth - pattern: (?:\\.|[^=\\])*? - - fieldName: log.paSuffix - pattern: (?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) + pattern: (?:\\.|[^=\\])*?(?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) where: oneOf("log.paFormat", ["CEF", "LEEF-legacy"]) - grok: source: log.paCefExtensions @@ -5099,9 +4105,7 @@ pipeline: - fieldName: log.paIgnored pattern: ^(?:[A-Za-z][A-Za-z0-9_]*=(?:\\.|[^=\\])*?[ \t]+)*?panOSTLSEncryptionAlgorithm= - fieldName: log.panOSTLSEncryptionAlgorithm - pattern: (?:\\.|[^=\\])*? - - fieldName: log.paSuffix - pattern: (?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) + pattern: (?:\\.|[^=\\])*?(?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) where: oneOf("log.paFormat", ["CEF", "LEEF-legacy"]) - grok: source: log.paCefExtensions @@ -5109,9 +4113,7 @@ pipeline: - fieldName: log.paIgnored pattern: ^(?:[A-Za-z][A-Za-z0-9_]*=(?:\\.|[^=\\])*?[ \t]+)*?panOSTLSKeyExchange= - fieldName: log.panOSTLSKeyExchange - pattern: (?:\\.|[^=\\])*? - - fieldName: log.paSuffix - pattern: (?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) + pattern: (?:\\.|[^=\\])*?(?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) where: oneOf("log.paFormat", ["CEF", "LEEF-legacy"]) - grok: source: log.paCefExtensions @@ -5119,9 +4121,7 @@ pipeline: - fieldName: log.paIgnored pattern: ^(?:[A-Za-z][A-Za-z0-9_]*=(?:\\.|[^=\\])*?[ \t]+)*?panOSTLSVersion= - fieldName: log.panOSTLSVersion - pattern: (?:\\.|[^=\\])*? - - fieldName: log.paSuffix - pattern: (?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) + pattern: (?:\\.|[^=\\])*?(?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) where: oneOf("log.paFormat", ["CEF", "LEEF-legacy"]) - grok: source: log.paCefExtensions @@ -5129,9 +4129,7 @@ pipeline: - fieldName: log.paIgnored pattern: ^(?:[A-Za-z][A-Za-z0-9_]*=(?:\\.|[^=\\])*?[ \t]+)*?panOSTagName= - fieldName: log.panOSTagName - pattern: (?:\\.|[^=\\])*? - - fieldName: log.paSuffix - pattern: (?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) + pattern: (?:\\.|[^=\\])*?(?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) where: oneOf("log.paFormat", ["CEF", "LEEF-legacy"]) - grok: source: log.paCefExtensions @@ -5139,9 +4137,7 @@ pipeline: - fieldName: log.paIgnored pattern: ^(?:[A-Za-z][A-Za-z0-9_]*=(?:\\.|[^=\\])*?[ \t]+)*?panOSThreatCategory= - fieldName: log.panOSThreatCategory - pattern: (?:\\.|[^=\\])*? - - fieldName: log.paSuffix - pattern: (?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) + pattern: (?:\\.|[^=\\])*?(?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) where: oneOf("log.paFormat", ["CEF", "LEEF-legacy"]) - grok: source: log.paCefExtensions @@ -5149,9 +4145,7 @@ pipeline: - fieldName: log.paIgnored pattern: ^(?:[A-Za-z][A-Za-z0-9_]*=(?:\\.|[^=\\])*?[ \t]+)*?panOSTimeGeneratedHighResolution= - fieldName: log.panOSTimeGeneratedHighResolution - pattern: (?:\\.|[^=\\])*? - - fieldName: log.paSuffix - pattern: (?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) + pattern: (?:\\.|[^=\\])*?(?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) where: oneOf("log.paFormat", ["CEF", "LEEF-legacy"]) - grok: source: log.paCefExtensions @@ -5159,9 +4153,7 @@ pipeline: - fieldName: log.paIgnored pattern: ^(?:[A-Za-z][A-Za-z0-9_]*=(?:\\.|[^=\\])*?[ \t]+)*?panOSTimeNotAfter= - fieldName: log.panOSTimeNotAfter - pattern: (?:\\.|[^=\\])*? - - fieldName: log.paSuffix - pattern: (?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) + pattern: (?:\\.|[^=\\])*?(?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) where: oneOf("log.paFormat", ["CEF", "LEEF-legacy"]) - grok: source: log.paCefExtensions @@ -5169,9 +4161,7 @@ pipeline: - fieldName: log.paIgnored pattern: ^(?:[A-Za-z][A-Za-z0-9_]*=(?:\\.|[^=\\])*?[ \t]+)*?panOSTimeNotBefore= - fieldName: log.panOSTimeNotBefore - pattern: (?:\\.|[^=\\])*? - - fieldName: log.paSuffix - pattern: (?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) + pattern: (?:\\.|[^=\\])*?(?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) where: oneOf("log.paFormat", ["CEF", "LEEF-legacy"]) - grok: source: log.paCefExtensions @@ -5179,9 +4169,7 @@ pipeline: - fieldName: log.paIgnored pattern: ^(?:[A-Za-z][A-Za-z0-9_]*=(?:\\.|[^=\\])*?[ \t]+)*?panOSTimeReceivedManagementPlane= - fieldName: log.panOSTimeReceivedManagementPlane - pattern: (?:\\.|[^=\\])*? - - fieldName: log.paSuffix - pattern: (?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) + pattern: (?:\\.|[^=\\])*?(?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) where: oneOf("log.paFormat", ["CEF", "LEEF-legacy"]) - grok: source: log.paCefExtensions @@ -5189,9 +4177,7 @@ pipeline: - fieldName: log.paIgnored pattern: ^(?:[A-Za-z][A-Za-z0-9_]*=(?:\\.|[^=\\])*?[ \t]+)*?panOSTimeout= - fieldName: log.panOSTimeout - pattern: (?:\\.|[^=\\])*? - - fieldName: log.paSuffix - pattern: (?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) + pattern: (?:\\.|[^=\\])*?(?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) where: oneOf("log.paFormat", ["CEF", "LEEF-legacy"]) - grok: source: log.paCefExtensions @@ -5199,9 +4185,7 @@ pipeline: - fieldName: log.paIgnored pattern: ^(?:[A-Za-z][A-Za-z0-9_]*=(?:\\.|[^=\\])*?[ \t]+)*?panOSTrafficOriginRegion= - fieldName: log.panOSTrafficOriginRegion - pattern: (?:\\.|[^=\\])*? - - fieldName: log.paSuffix - pattern: (?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) + pattern: (?:\\.|[^=\\])*?(?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) where: oneOf("log.paFormat", ["CEF", "LEEF-legacy"]) - grok: source: log.paCefExtensions @@ -5209,9 +4193,7 @@ pipeline: - fieldName: log.paIgnored pattern: ^(?:[A-Za-z][A-Za-z0-9_]*=(?:\\.|[^=\\])*?[ \t]+)*?panOSTrafficSessionID= - fieldName: log.panOSTrafficSessionID - pattern: (?:\\.|[^=\\])*? - - fieldName: log.paSuffix - pattern: (?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) + pattern: (?:\\.|[^=\\])*?(?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) where: oneOf("log.paFormat", ["CEF", "LEEF-legacy"]) - grok: source: log.paCefExtensions @@ -5219,9 +4201,7 @@ pipeline: - fieldName: log.paIgnored pattern: ^(?:[A-Za-z][A-Za-z0-9_]*=(?:\\.|[^=\\])*?[ \t]+)*?panOSTunneInspectionRule= - fieldName: log.panOSTunneInspectionRule - pattern: (?:\\.|[^=\\])*? - - fieldName: log.paSuffix - pattern: (?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) + pattern: (?:\\.|[^=\\])*?(?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) where: oneOf("log.paFormat", ["CEF", "LEEF-legacy"]) - grok: source: log.paCefExtensions @@ -5229,9 +4209,7 @@ pipeline: - fieldName: log.paIgnored pattern: ^(?:[A-Za-z][A-Za-z0-9_]*=(?:\\.|[^=\\])*?[ \t]+)*?panOSTunnel= - fieldName: log.panOSTunnel - pattern: (?:\\.|[^=\\])*? - - fieldName: log.paSuffix - pattern: (?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) + pattern: (?:\\.|[^=\\])*?(?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) where: oneOf("log.paFormat", ["CEF", "LEEF-legacy"]) - grok: source: log.paCefExtensions @@ -5239,9 +4217,7 @@ pipeline: - fieldName: log.paIgnored pattern: ^(?:[A-Za-z][A-Za-z0-9_]*=(?:\\.|[^=\\])*?[ \t]+)*?panOSTunnelEndptID1= - fieldName: log.panOSTunnelEndptID1 - pattern: (?:\\.|[^=\\])*? - - fieldName: log.paSuffix - pattern: (?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) + pattern: (?:\\.|[^=\\])*?(?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) where: oneOf("log.paFormat", ["CEF", "LEEF-legacy"]) - grok: source: log.paCefExtensions @@ -5249,9 +4225,7 @@ pipeline: - fieldName: log.paIgnored pattern: ^(?:[A-Za-z][A-Za-z0-9_]*=(?:\\.|[^=\\])*?[ \t]+)*?panOSTunnelEndptID2= - fieldName: log.panOSTunnelEndptID2 - pattern: (?:\\.|[^=\\])*? - - fieldName: log.paSuffix - pattern: (?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) + pattern: (?:\\.|[^=\\])*?(?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) where: oneOf("log.paFormat", ["CEF", "LEEF-legacy"]) - grok: source: log.paCefExtensions @@ -5259,9 +4233,7 @@ pipeline: - fieldName: log.paIgnored pattern: ^(?:[A-Za-z][A-Za-z0-9_]*=(?:\\.|[^=\\])*?[ \t]+)*?panOSTunnelFragment= - fieldName: log.panOSTunnelFragment - pattern: (?:\\.|[^=\\])*? - - fieldName: log.paSuffix - pattern: (?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) + pattern: (?:\\.|[^=\\])*?(?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) where: oneOf("log.paFormat", ["CEF", "LEEF-legacy"]) - grok: source: log.paCefExtensions @@ -5269,9 +4241,7 @@ pipeline: - fieldName: log.paIgnored pattern: ^(?:[A-Za-z][A-Za-z0-9_]*=(?:\\.|[^=\\])*?[ \t]+)*?panOSTunnelID= - fieldName: log.panOSTunnelID - pattern: (?:\\.|[^=\\])*? - - fieldName: log.paSuffix - pattern: (?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) + pattern: (?:\\.|[^=\\])*?(?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) where: oneOf("log.paFormat", ["CEF", "LEEF-legacy"]) - grok: source: log.paCefExtensions @@ -5279,9 +4249,7 @@ pipeline: - fieldName: log.paIgnored pattern: ^(?:[A-Za-z][A-Za-z0-9_]*=(?:\\.|[^=\\])*?[ \t]+)*?panOSTunnelInspectionRule= - fieldName: log.panOSTunnelInspectionRule - pattern: (?:\\.|[^=\\])*? - - fieldName: log.paSuffix - pattern: (?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) + pattern: (?:\\.|[^=\\])*?(?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) where: oneOf("log.paFormat", ["CEF", "LEEF-legacy"]) - grok: source: log.paCefExtensions @@ -5289,9 +4257,7 @@ pipeline: - fieldName: log.paIgnored pattern: ^(?:[A-Za-z][A-Za-z0-9_]*=(?:\\.|[^=\\])*?[ \t]+)*?panOSTunnelType= - fieldName: log.panOSTunnelType - pattern: (?:\\.|[^=\\])*? - - fieldName: log.paSuffix - pattern: (?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) + pattern: (?:\\.|[^=\\])*?(?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) where: oneOf("log.paFormat", ["CEF", "LEEF-legacy"]) - grok: source: log.paCefExtensions @@ -5299,9 +4265,7 @@ pipeline: - fieldName: log.paIgnored pattern: ^(?:[A-Za-z][A-Za-z0-9_]*=(?:\\.|[^=\\])*?[ \t]+)*?panOSUGFlags= - fieldName: log.panOSUGFlags - pattern: (?:\\.|[^=\\])*? - - fieldName: log.paSuffix - pattern: (?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) + pattern: (?:\\.|[^=\\])*?(?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) where: oneOf("log.paFormat", ["CEF", "LEEF-legacy"]) - grok: source: log.paCefExtensions @@ -5309,9 +4273,7 @@ pipeline: - fieldName: log.paIgnored pattern: ^(?:[A-Za-z][A-Za-z0-9_]*=(?:\\.|[^=\\])*?[ \t]+)*?panOSURLCatList= - fieldName: log.panOSURLCatList - pattern: (?:\\.|[^=\\])*? - - fieldName: log.paSuffix - pattern: (?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) + pattern: (?:\\.|[^=\\])*?(?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) where: oneOf("log.paFormat", ["CEF", "LEEF-legacy"]) - grok: source: log.paCefExtensions @@ -5319,9 +4281,7 @@ pipeline: - fieldName: log.paIgnored pattern: ^(?:[A-Za-z][A-Za-z0-9_]*=(?:\\.|[^=\\])*?[ \t]+)*?panOSUserBySource= - fieldName: log.panOSUserBySource - pattern: (?:\\.|[^=\\])*? - - fieldName: log.paSuffix - pattern: (?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) + pattern: (?:\\.|[^=\\])*?(?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) where: oneOf("log.paFormat", ["CEF", "LEEF-legacy"]) - grok: source: log.paCefExtensions @@ -5329,9 +4289,7 @@ pipeline: - fieldName: log.paIgnored pattern: ^(?:[A-Za-z][A-Za-z0-9_]*=(?:\\.|[^=\\])*?[ \t]+)*?panOSVirtualSystem= - fieldName: log.panOSVirtualSystem - pattern: (?:\\.|[^=\\])*? - - fieldName: log.paSuffix - pattern: (?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) + pattern: (?:\\.|[^=\\])*?(?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) where: oneOf("log.paFormat", ["CEF", "LEEF-legacy"]) - grok: source: log.paCefExtensions @@ -5339,9 +4297,7 @@ pipeline: - fieldName: log.paIgnored pattern: ^(?:[A-Za-z][A-Za-z0-9_]*=(?:\\.|[^=\\])*?[ \t]+)*?panOSVsysName= - fieldName: log.panOSVsysName - pattern: (?:\\.|[^=\\])*? - - fieldName: log.paSuffix - pattern: (?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) + pattern: (?:\\.|[^=\\])*?(?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) where: oneOf("log.paFormat", ["CEF", "LEEF-legacy"]) - grok: source: log.paCefExtensions @@ -5349,9 +4305,7 @@ pipeline: - fieldName: log.paIgnored pattern: ^(?:[A-Za-z][A-Za-z0-9_]*=(?:\\.|[^=\\])*?[ \t]+)*?panOSXForwarderfor= - fieldName: log.panOSXForwarderfor - pattern: (?:\\.|[^=\\])*? - - fieldName: log.paSuffix - pattern: (?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) + pattern: (?:\\.|[^=\\])*?(?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) where: oneOf("log.paFormat", ["CEF", "LEEF-legacy"]) - grok: source: log.paCefExtensions @@ -5359,9 +4313,7 @@ pipeline: - fieldName: log.paIgnored pattern: ^(?:[A-Za-z][A-Za-z0-9_]*=(?:\\.|[^=\\])*?[ \t]+)*?panPODName= - fieldName: log.panPODName - pattern: (?:\\.|[^=\\])*? - - fieldName: log.paSuffix - pattern: (?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) + pattern: (?:\\.|[^=\\])*?(?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) where: oneOf("log.paFormat", ["CEF", "LEEF-legacy"]) - grok: source: log.paCefExtensions @@ -5369,9 +4321,7 @@ pipeline: - fieldName: log.paIgnored pattern: ^(?:[A-Za-z][A-Za-z0-9_]*=(?:\\.|[^=\\])*?[ \t]+)*?panPODNamespace= - fieldName: log.panPODNamespace - pattern: (?:\\.|[^=\\])*? - - fieldName: log.paSuffix - pattern: (?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) + pattern: (?:\\.|[^=\\])*?(?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) where: oneOf("log.paFormat", ["CEF", "LEEF-legacy"]) - grok: source: log.paCefExtensions @@ -5379,9 +4329,7 @@ pipeline: - fieldName: log.paIgnored pattern: ^(?:[A-Za-z][A-Za-z0-9_]*=(?:\\.|[^=\\])*?[ \t]+)*?panPartialHash= - fieldName: log.panPartialHash - pattern: (?:\\.|[^=\\])*? - - fieldName: log.paSuffix - pattern: (?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) + pattern: (?:\\.|[^=\\])*?(?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) where: oneOf("log.paFormat", ["CEF", "LEEF-legacy"]) - grok: source: log.paCefExtensions @@ -5389,9 +4337,7 @@ pipeline: - fieldName: log.paIgnored pattern: ^(?:[A-Za-z][A-Za-z0-9_]*=(?:\\.|[^=\\])*?[ \t]+)*?panPolicyID= - fieldName: log.panPolicyID - pattern: (?:\\.|[^=\\])*? - - fieldName: log.paSuffix - pattern: (?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) + pattern: (?:\\.|[^=\\])*?(?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) where: oneOf("log.paFormat", ["CEF", "LEEF-legacy"]) - grok: source: log.paCefExtensions @@ -5399,9 +4345,7 @@ pipeline: - fieldName: log.paIgnored pattern: ^(?:[A-Za-z][A-Za-z0-9_]*=(?:\\.|[^=\\])*?[ \t]+)*?panReasonFilteringAction= - fieldName: log.panReasonFilteringAction - pattern: (?:\\.|[^=\\])*? - - fieldName: log.paSuffix - pattern: (?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) + pattern: (?:\\.|[^=\\])*?(?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) where: oneOf("log.paFormat", ["CEF", "LEEF-legacy"]) - grok: source: log.paCefExtensions @@ -5409,9 +4353,7 @@ pipeline: - fieldName: log.paIgnored pattern: ^(?:[A-Za-z][A-Za-z0-9_]*=(?:\\.|[^=\\])*?[ \t]+)*?panSDWANCluster= - fieldName: log.panSDWANCluster - pattern: (?:\\.|[^=\\])*? - - fieldName: log.paSuffix - pattern: (?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) + pattern: (?:\\.|[^=\\])*?(?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) where: oneOf("log.paFormat", ["CEF", "LEEF-legacy"]) - grok: source: log.paCefExtensions @@ -5419,9 +4361,7 @@ pipeline: - fieldName: log.paIgnored pattern: ^(?:[A-Za-z][A-Za-z0-9_]*=(?:\\.|[^=\\])*?[ \t]+)*?panSDWANClustype= - fieldName: log.panSDWANClustype - pattern: (?:\\.|[^=\\])*? - - fieldName: log.paSuffix - pattern: (?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) + pattern: (?:\\.|[^=\\])*?(?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) where: oneOf("log.paFormat", ["CEF", "LEEF-legacy"]) - grok: source: log.paCefExtensions @@ -5429,9 +4369,7 @@ pipeline: - fieldName: log.paIgnored pattern: ^(?:[A-Za-z][A-Za-z0-9_]*=(?:\\.|[^=\\])*?[ \t]+)*?panSDWANDevice= - fieldName: log.panSDWANDevice - pattern: (?:\\.|[^=\\])*? - - fieldName: log.paSuffix - pattern: (?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) + pattern: (?:\\.|[^=\\])*?(?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) where: oneOf("log.paFormat", ["CEF", "LEEF-legacy"]) - grok: source: log.paCefExtensions @@ -5439,9 +4377,7 @@ pipeline: - fieldName: log.paIgnored pattern: ^(?:[A-Za-z][A-Za-z0-9_]*=(?:\\.|[^=\\])*?[ \t]+)*?panSDWANSite= - fieldName: log.panSDWANSite - pattern: (?:\\.|[^=\\])*? - - fieldName: log.paSuffix - pattern: (?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) + pattern: (?:\\.|[^=\\])*?(?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) where: oneOf("log.paFormat", ["CEF", "LEEF-legacy"]) - grok: source: log.paCefExtensions @@ -5449,9 +4385,7 @@ pipeline: - fieldName: log.paIgnored pattern: ^(?:[A-Za-z][A-Za-z0-9_]*=(?:\\.|[^=\\])*?[ \t]+)*?panSrcDAG= - fieldName: log.panSrcDAG - pattern: (?:\\.|[^=\\])*? - - fieldName: log.paSuffix - pattern: (?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) + pattern: (?:\\.|[^=\\])*?(?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) where: oneOf("log.paFormat", ["CEF", "LEEF-legacy"]) - grok: source: log.paCefExtensions @@ -5459,9 +4393,7 @@ pipeline: - fieldName: log.paIgnored pattern: ^(?:[A-Za-z][A-Za-z0-9_]*=(?:\\.|[^=\\])*?[ \t]+)*?panSrcDeviceCat= - fieldName: log.panSrcDeviceCat - pattern: (?:\\.|[^=\\])*? - - fieldName: log.paSuffix - pattern: (?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) + pattern: (?:\\.|[^=\\])*?(?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) where: oneOf("log.paFormat", ["CEF", "LEEF-legacy"]) - grok: source: log.paCefExtensions @@ -5469,9 +4401,7 @@ pipeline: - fieldName: log.paIgnored pattern: ^(?:[A-Za-z][A-Za-z0-9_]*=(?:\\.|[^=\\])*?[ \t]+)*?panSrcDeviceModel= - fieldName: log.panSrcDeviceModel - pattern: (?:\\.|[^=\\])*? - - fieldName: log.paSuffix - pattern: (?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) + pattern: (?:\\.|[^=\\])*?(?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) where: oneOf("log.paFormat", ["CEF", "LEEF-legacy"]) - grok: source: log.paCefExtensions @@ -5479,9 +4409,7 @@ pipeline: - fieldName: log.paIgnored pattern: ^(?:[A-Za-z][A-Za-z0-9_]*=(?:\\.|[^=\\])*?[ \t]+)*?panSrcDeviceOS= - fieldName: log.panSrcDeviceOS - pattern: (?:\\.|[^=\\])*? - - fieldName: log.paSuffix - pattern: (?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) + pattern: (?:\\.|[^=\\])*?(?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) where: oneOf("log.paFormat", ["CEF", "LEEF-legacy"]) - grok: source: log.paCefExtensions @@ -5489,9 +4417,7 @@ pipeline: - fieldName: log.paIgnored pattern: ^(?:[A-Za-z][A-Za-z0-9_]*=(?:\\.|[^=\\])*?[ \t]+)*?panSrcDeviceOSv= - fieldName: log.panSrcDeviceOSv - pattern: (?:\\.|[^=\\])*? - - fieldName: log.paSuffix - pattern: (?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) + pattern: (?:\\.|[^=\\])*?(?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) where: oneOf("log.paFormat", ["CEF", "LEEF-legacy"]) - grok: source: log.paCefExtensions @@ -5499,9 +4425,7 @@ pipeline: - fieldName: log.paIgnored pattern: ^(?:[A-Za-z][A-Za-z0-9_]*=(?:\\.|[^=\\])*?[ \t]+)*?panSrcDeviceProf= - fieldName: log.panSrcDeviceProf - pattern: (?:\\.|[^=\\])*? - - fieldName: log.paSuffix - pattern: (?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) + pattern: (?:\\.|[^=\\])*?(?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) where: oneOf("log.paFormat", ["CEF", "LEEF-legacy"]) - grok: source: log.paCefExtensions @@ -5509,9 +4433,7 @@ pipeline: - fieldName: log.paIgnored pattern: ^(?:[A-Za-z][A-Za-z0-9_]*=(?:\\.|[^=\\])*?[ \t]+)*?panSrcDeviceVendor= - fieldName: log.panSrcDeviceVendor - pattern: (?:\\.|[^=\\])*? - - fieldName: log.paSuffix - pattern: (?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) + pattern: (?:\\.|[^=\\])*?(?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) where: oneOf("log.paFormat", ["CEF", "LEEF-legacy"]) - grok: source: log.paCefExtensions @@ -5519,9 +4441,7 @@ pipeline: - fieldName: log.paIgnored pattern: ^(?:[A-Za-z][A-Za-z0-9_]*=(?:\\.|[^=\\])*?[ \t]+)*?panSrcEDL= - fieldName: log.panSrcEDL - pattern: (?:\\.|[^=\\])*? - - fieldName: log.paSuffix - pattern: (?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) + pattern: (?:\\.|[^=\\])*?(?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) where: oneOf("log.paFormat", ["CEF", "LEEF-legacy"]) - grok: source: log.paCefExtensions @@ -5529,9 +4449,7 @@ pipeline: - fieldName: log.paIgnored pattern: ^(?:[A-Za-z][A-Za-z0-9_]*=(?:\\.|[^=\\])*?[ \t]+)*?panSrcHostname= - fieldName: log.panSrcHostname - pattern: (?:\\.|[^=\\])*? - - fieldName: log.paSuffix - pattern: (?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) + pattern: (?:\\.|[^=\\])*?(?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) where: oneOf("log.paFormat", ["CEF", "LEEF-legacy"]) - grok: source: log.paCefExtensions @@ -5539,9 +4457,7 @@ pipeline: - fieldName: log.paIgnored pattern: ^(?:[A-Za-z][A-Za-z0-9_]*=(?:\\.|[^=\\])*?[ \t]+)*?panSrcMac= - fieldName: log.panSrcMac - pattern: (?:\\.|[^=\\])*? - - fieldName: log.paSuffix - pattern: (?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) + pattern: (?:\\.|[^=\\])*?(?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) where: oneOf("log.paFormat", ["CEF", "LEEF-legacy"]) - grok: source: log.paCefExtensions @@ -5549,9 +4465,7 @@ pipeline: - fieldName: log.paIgnored pattern: ^(?:[A-Za-z][A-Za-z0-9_]*=(?:\\.|[^=\\])*?[ \t]+)*?panTimeHighRes= - fieldName: log.panTimeHighRes - pattern: (?:\\.|[^=\\])*? - - fieldName: log.paSuffix - pattern: (?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) + pattern: (?:\\.|[^=\\])*?(?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) where: oneOf("log.paFormat", ["CEF", "LEEF-legacy"]) - grok: source: log.paCefExtensions @@ -5559,9 +4473,7 @@ pipeline: - fieldName: log.paIgnored pattern: ^(?:[A-Za-z][A-Za-z0-9_]*=(?:\\.|[^=\\])*?[ \t]+)*?panXFFIP= - fieldName: log.panXFFIP - pattern: (?:\\.|[^=\\])*? - - fieldName: log.paSuffix - pattern: (?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) + pattern: (?:\\.|[^=\\])*?(?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) where: oneOf("log.paFormat", ["CEF", "LEEF-legacy"]) - grok: source: log.paCefExtensions @@ -5569,9 +4481,7 @@ pipeline: - fieldName: log.paIgnored pattern: ^(?:[A-Za-z][A-Za-z0-9_]*=(?:\\.|[^=\\])*?[ \t]+)*?parent_session_idPanOSParentStartTime= - fieldName: log.parentSessionIdPanOSParentStartTime - pattern: (?:\\.|[^=\\])*? - - fieldName: log.paSuffix - pattern: (?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) + pattern: (?:\\.|[^=\\])*?(?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) where: oneOf("log.paFormat", ["CEF", "LEEF-legacy"]) - grok: source: log.paCefExtensions @@ -5579,9 +4489,7 @@ pipeline: - fieldName: log.paIgnored pattern: ^(?:[A-Za-z][A-Za-z0-9_]*=(?:\\.|[^=\\])*?[ \t]+)*?partial_hashPanTimeHighRes= - fieldName: log.partialHashPanTimeHighRes - pattern: (?:\\.|[^=\\])*? - - fieldName: log.paSuffix - pattern: (?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) + pattern: (?:\\.|[^=\\])*?(?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) where: oneOf("log.paFormat", ["CEF", "LEEF-legacy"]) - grok: source: log.paCefExtensions @@ -5589,9 +4497,7 @@ pipeline: - fieldName: log.paIgnored pattern: ^(?:[A-Za-z][A-Za-z0-9_]*=(?:\\.|[^=\\])*?[ \t]+)*?pcap_idfileHash= - fieldName: log.pcapIdfileHash - pattern: (?:\\.|[^=\\])*? - - fieldName: log.paSuffix - pattern: (?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) + pattern: (?:\\.|[^=\\])*?(?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) where: oneOf("log.paFormat", ["CEF", "LEEF-legacy"]) - grok: source: log.paCefExtensions @@ -5599,9 +4505,7 @@ pipeline: - fieldName: log.paIgnored pattern: ^(?:[A-Za-z][A-Za-z0-9_]*=(?:\\.|[^=\\])*?[ \t]+)*?pcap_idrequestMethod= - fieldName: log.pcapIdrequestMethod - pattern: (?:\\.|[^=\\])*? - - fieldName: log.paSuffix - pattern: (?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) + pattern: (?:\\.|[^=\\])*?(?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) where: oneOf("log.paFormat", ["CEF", "LEEF-legacy"]) - grok: source: log.paCefExtensions @@ -5609,9 +4513,7 @@ pipeline: - fieldName: log.paIgnored pattern: ^(?:[A-Za-z][A-Za-z0-9_]*=(?:\\.|[^=\\])*?[ \t]+)*?pod_namePanSrcEDL= - fieldName: log.podNamePanSrcEDL - pattern: (?:\\.|[^=\\])*? - - fieldName: log.paSuffix - pattern: (?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) + pattern: (?:\\.|[^=\\])*?(?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) where: oneOf("log.paFormat", ["CEF", "LEEF-legacy"]) - grok: source: log.paCefExtensions @@ -5619,9 +4521,7 @@ pipeline: - fieldName: log.paIgnored pattern: ^(?:[A-Za-z][A-Za-z0-9_]*=(?:\\.|[^=\\])*?[ \t]+)*?pod_namespacePanOSContainerName= - fieldName: log.podNamespacePanOSContainerName - pattern: (?:\\.|[^=\\])*? - - fieldName: log.paSuffix - pattern: (?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) + pattern: (?:\\.|[^=\\])*?(?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) where: oneOf("log.paFormat", ["CEF", "LEEF-legacy"]) - grok: source: log.paCefExtensions @@ -5629,9 +4529,7 @@ pipeline: - fieldName: log.paIgnored pattern: ^(?:[A-Za-z][A-Za-z0-9_]*=(?:\\.|[^=\\])*?[ \t]+)*?ppidPanOSHTTPHeader= - fieldName: log.ppidPanOSHTTPHeader - pattern: (?:\\.|[^=\\])*? - - fieldName: log.paSuffix - pattern: (?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) + pattern: (?:\\.|[^=\\])*?(?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) where: oneOf("log.paFormat", ["CEF", "LEEF-legacy"]) - grok: source: log.paCefExtensions @@ -5639,9 +4537,7 @@ pipeline: - fieldName: log.paIgnored pattern: ^(?:[A-Za-z][A-Za-z0-9_]*=(?:\\.|[^=\\])*?[ \t]+)*?priorityPanOSAttemptedGateways= - fieldName: log.priorityPanOSAttemptedGateways - pattern: (?:\\.|[^=\\])*? - - fieldName: log.paSuffix - pattern: (?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) + pattern: (?:\\.|[^=\\])*?(?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) where: oneOf("log.paFormat", ["CEF", "LEEF-legacy"]) - grok: source: log.paCefExtensions @@ -5649,9 +4545,7 @@ pipeline: - fieldName: log.paIgnored pattern: ^(?:[A-Za-z][A-Za-z0-9_]*=(?:\\.|[^=\\])*?[ \t]+)*?proto= - fieldName: log.proto - pattern: (?:\\.|[^=\\])*? - - fieldName: log.paSuffix - pattern: (?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) + pattern: (?:\\.|[^=\\])*?(?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) where: oneOf("log.paFormat", ["CEF", "LEEF-legacy"]) - grok: source: log.paCefExtensions @@ -5659,9 +4553,7 @@ pipeline: - fieldName: log.paIgnored pattern: ^(?:[A-Za-z][A-Za-z0-9_]*=(?:\\.|[^=\\])*?[ \t]+)*?proxy_typePanOSCertificateSerial= - fieldName: log.proxyTypePanOSCertificateSerial - pattern: (?:\\.|[^=\\])*? - - fieldName: log.paSuffix - pattern: (?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) + pattern: (?:\\.|[^=\\])*?(?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) where: oneOf("log.paFormat", ["CEF", "LEEF-legacy"]) - grok: source: log.paCefExtensions @@ -5669,9 +4561,7 @@ pipeline: - fieldName: log.paIgnored pattern: ^(?:[A-Za-z][A-Za-z0-9_]*=(?:\\.|[^=\\])*?[ \t]+)*?public_ipPanOSPublicIPv6= - fieldName: log.publicIpPanOSPublicIPv6 - pattern: (?:\\.|[^=\\])*? - - fieldName: log.paSuffix - pattern: (?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) + pattern: (?:\\.|[^=\\])*?(?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) where: oneOf("log.paFormat", ["CEF", "LEEF-legacy"]) - grok: source: log.paCefExtensions @@ -5679,9 +4569,7 @@ pipeline: - fieldName: log.paIgnored pattern: ^(?:[A-Za-z][A-Za-z0-9_]*=(?:\\.|[^=\\])*?[ \t]+)*?reason= - fieldName: log.reason - pattern: (?:\\.|[^=\\])*? - - fieldName: log.paSuffix - pattern: (?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) + pattern: (?:\\.|[^=\\])*?(?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) where: oneOf("log.paFormat", ["CEF", "LEEF-legacy"]) - grok: source: log.paCefExtensions @@ -5689,9 +4577,7 @@ pipeline: - fieldName: log.paIgnored pattern: ^(?:[A-Za-z][A-Za-z0-9_]*=(?:\\.|[^=\\])*?[ \t]+)*?reasonPanOSConnectionError= - fieldName: log.reasonPanOSConnectionError - pattern: (?:\\.|[^=\\])*? - - fieldName: log.paSuffix - pattern: (?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) + pattern: (?:\\.|[^=\\])*?(?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) where: oneOf("log.paFormat", ["CEF", "LEEF-legacy"]) - grok: source: log.paCefExtensions @@ -5699,9 +4585,7 @@ pipeline: - fieldName: log.paIgnored pattern: ^(?:[A-Za-z][A-Za-z0-9_]*=(?:\\.|[^=\\])*?[ \t]+)*?receive_timePanOSDeviceSN= - fieldName: log.receiveTimePanOSDeviceSN - pattern: (?:\\.|[^=\\])*? - - fieldName: log.paSuffix - pattern: (?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) + pattern: (?:\\.|[^=\\])*?(?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) where: oneOf("log.paFormat", ["CEF", "LEEF-legacy"]) - grok: source: log.paCefExtensions @@ -5709,9 +4593,7 @@ pipeline: - fieldName: log.paIgnored pattern: ^(?:[A-Za-z][A-Za-z0-9_]*=(?:\\.|[^=\\])*?[ \t]+)*?receive_timedeviceExternalId= - fieldName: log.receiveTimedeviceExternalId - pattern: (?:\\.|[^=\\])*? - - fieldName: log.paSuffix - pattern: (?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) + pattern: (?:\\.|[^=\\])*?(?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) where: oneOf("log.paFormat", ["CEF", "LEEF-legacy"]) - grok: source: log.paCefExtensions @@ -5719,9 +4601,7 @@ pipeline: - fieldName: log.paIgnored pattern: ^(?:[A-Za-z][A-Za-z0-9_]*=(?:\\.|[^=\\])*?[ \t]+)*?reportidPanOSDGl1= - fieldName: log.reportidPanOSDGl1 - pattern: (?:\\.|[^=\\])*? - - fieldName: log.paSuffix - pattern: (?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) + pattern: (?:\\.|[^=\\])*?(?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) where: oneOf("log.paFormat", ["CEF", "LEEF-legacy"]) - grok: source: log.paCefExtensions @@ -5729,9 +4609,7 @@ pipeline: - fieldName: log.paIgnored pattern: ^(?:[A-Za-z][A-Za-z0-9_]*=(?:\\.|[^=\\])*?[ \t]+)*?request= - fieldName: log.request - pattern: (?:\\.|[^=\\])*? - - fieldName: log.paSuffix - pattern: (?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) + pattern: (?:\\.|[^=\\])*?(?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) where: oneOf("log.paFormat", ["CEF", "LEEF-legacy"]) - grok: source: log.paCefExtensions @@ -5739,9 +4617,7 @@ pipeline: - fieldName: log.paIgnored pattern: ^(?:[A-Za-z][A-Za-z0-9_]*=(?:\\.|[^=\\])*?[ \t]+)*?requestClientApplication= - fieldName: log.requestClientApplication - pattern: (?:\\.|[^=\\])*? - - fieldName: log.paSuffix - pattern: (?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) + pattern: (?:\\.|[^=\\])*?(?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) where: oneOf("log.paFormat", ["CEF", "LEEF-legacy"]) - grok: source: log.paCefExtensions @@ -5749,9 +4625,7 @@ pipeline: - fieldName: log.paIgnored pattern: ^(?:[A-Za-z][A-Za-z0-9_]*=(?:\\.|[^=\\])*?[ \t]+)*?requestContext= - fieldName: log.requestContext - pattern: (?:\\.|[^=\\])*? - - fieldName: log.paSuffix - pattern: (?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) + pattern: (?:\\.|[^=\\])*?(?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) where: oneOf("log.paFormat", ["CEF", "LEEF-legacy"]) - grok: source: log.paCefExtensions @@ -5759,9 +4633,7 @@ pipeline: - fieldName: log.paIgnored pattern: ^(?:[A-Za-z][A-Za-z0-9_]*=(?:\\.|[^=\\])*?[ \t]+)*?requestMethod= - fieldName: log.requestMethod - pattern: (?:\\.|[^=\\])*? - - fieldName: log.paSuffix - pattern: (?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) + pattern: (?:\\.|[^=\\])*?(?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) where: oneOf("log.paFormat", ["CEF", "LEEF-legacy"]) - grok: source: log.paCefExtensions @@ -5769,9 +4641,7 @@ pipeline: - fieldName: log.paIgnored pattern: ^(?:[A-Za-z][A-Za-z0-9_]*=(?:\\.|[^=\\])*?[ \t]+)*?rootcn_lenPanOSSNILength= - fieldName: log.rootcnLenPanOSSNILength - pattern: (?:\\.|[^=\\])*? - - fieldName: log.paSuffix - pattern: (?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) + pattern: (?:\\.|[^=\\])*?(?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) where: oneOf("log.paFormat", ["CEF", "LEEF-legacy"]) - grok: source: log.paCefExtensions @@ -5779,9 +4649,7 @@ pipeline: - fieldName: log.paIgnored pattern: ^(?:[A-Za-z][A-Za-z0-9_]*=(?:\\.|[^=\\])*?[ \t]+)*?rt= - fieldName: log.rt - pattern: (?:\\.|[^=\\])*? - - fieldName: log.paSuffix - pattern: (?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) + pattern: (?:\\.|[^=\\])*?(?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) where: oneOf("log.paFormat", ["CEF", "LEEF-legacy"]) - grok: source: log.paCefExtensions @@ -5789,9 +4657,7 @@ pipeline: - fieldName: log.paIgnored pattern: ^(?:[A-Za-z][A-Za-z0-9_]*=(?:\\.|[^=\\])*?[ \t]+)*?rule_uuidPanOSClientToFirewall= - fieldName: log.ruleUuidPanOSClientToFirewall - pattern: (?:\\.|[^=\\])*? - - fieldName: log.paSuffix - pattern: (?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) + pattern: (?:\\.|[^=\\])*?(?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) where: oneOf("log.paFormat", ["CEF", "LEEF-legacy"]) - grok: source: log.paCefExtensions @@ -5799,9 +4665,7 @@ pipeline: - fieldName: log.paIgnored pattern: ^(?:[A-Za-z][A-Za-z0-9_]*=(?:\\.|[^=\\])*?[ \t]+)*?rule_uuidPanOSTimeGeneratedHighResolution= - fieldName: log.ruleUuidPanOSTimeGeneratedHighResolution - pattern: (?:\\.|[^=\\])*? - - fieldName: log.paSuffix - pattern: (?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) + pattern: (?:\\.|[^=\\])*?(?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) where: oneOf("log.paFormat", ["CEF", "LEEF-legacy"]) - grok: source: log.paCefExtensions @@ -5809,9 +4673,7 @@ pipeline: - fieldName: log.paIgnored pattern: ^(?:[A-Za-z][A-Za-z0-9_]*=(?:\\.|[^=\\])*?[ \t]+)*?rulesuser= - fieldName: log.rulesuser - pattern: (?:\\.|[^=\\])*? - - fieldName: log.paSuffix - pattern: (?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) + pattern: (?:\\.|[^=\\])*?(?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) where: oneOf("log.paFormat", ["CEF", "LEEF-legacy"]) - grok: source: log.paCefExtensions @@ -5819,9 +4681,7 @@ pipeline: - fieldName: log.paIgnored pattern: ^(?:[A-Za-z][A-Za-z0-9_]*=(?:\\.|[^=\\])*?[ \t]+)*?selection_typePanOSSSLResponseTime= - fieldName: log.selectionTypePanOSSSLResponseTime - pattern: (?:\\.|[^=\\])*? - - fieldName: log.paSuffix - pattern: (?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) + pattern: (?:\\.|[^=\\])*?(?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) where: oneOf("log.paFormat", ["CEF", "LEEF-legacy"]) - grok: source: log.paCefExtensions @@ -5829,9 +4689,7 @@ pipeline: - fieldName: log.paIgnored pattern: ^(?:[A-Za-z][A-Za-z0-9_]*=(?:\\.|[^=\\])*?[ \t]+)*?seqnoPanOSActionFlags= - fieldName: log.seqnoPanOSActionFlags - pattern: (?:\\.|[^=\\])*? - - fieldName: log.paSuffix - pattern: (?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) + pattern: (?:\\.|[^=\\])*?(?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) where: oneOf("log.paFormat", ["CEF", "LEEF-legacy"]) - grok: source: log.paCefExtensions @@ -5839,9 +4697,7 @@ pipeline: - fieldName: log.paIgnored pattern: ^(?:[A-Za-z][A-Za-z0-9_]*=(?:\\.|[^=\\])*?[ \t]+)*?serialPanOSLogTimeStamp= - fieldName: log.serialPanOSLogTimeStamp - pattern: (?:\\.|[^=\\])*? - - fieldName: log.paSuffix - pattern: (?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) + pattern: (?:\\.|[^=\\])*?(?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) where: oneOf("log.paFormat", ["CEF", "LEEF-legacy"]) - grok: source: log.paCefExtensions @@ -5849,9 +4705,7 @@ pipeline: - fieldName: log.paIgnored pattern: ^(?:[A-Za-z][A-Za-z0-9_]*=(?:\\.|[^=\\])*?[ \t]+)*?serialnumberPanDomainEDL= - fieldName: log.serialnumberPanDomainEDL - pattern: (?:\\.|[^=\\])*? - - fieldName: log.paSuffix - pattern: (?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) + pattern: (?:\\.|[^=\\])*?(?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) where: oneOf("log.paFormat", ["CEF", "LEEF-legacy"]) - grok: source: log.paCefExtensions @@ -5859,9 +4713,7 @@ pipeline: - fieldName: log.paIgnored pattern: ^(?:[A-Za-z][A-Za-z0-9_]*=(?:\\.|[^=\\])*?[ \t]+)*?severity= - fieldName: log.severity - pattern: (?:\\.|[^=\\])*? - - fieldName: log.paSuffix - pattern: (?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) + pattern: (?:\\.|[^=\\])*?(?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) where: oneOf("log.paFormat", ["CEF", "LEEF-legacy"]) - grok: source: log.paCefExtensions @@ -5869,9 +4721,7 @@ pipeline: - fieldName: log.paIgnored pattern: ^(?:[A-Za-z][A-Za-z0-9_]*=(?:\\.|[^=\\])*?[ \t]+)*?shost= - fieldName: log.shost - pattern: (?:\\.|[^=\\])*? - - fieldName: log.paSuffix - pattern: (?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) + pattern: (?:\\.|[^=\\])*?(?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) where: oneOf("log.paFormat", ["CEF", "LEEF-legacy"]) - grok: source: log.paCefExtensions @@ -5879,9 +4729,7 @@ pipeline: - fieldName: log.paIgnored pattern: ^(?:[A-Za-z][A-Za-z0-9_]*=(?:\\.|[^=\\])*?[ \t]+)*?sni_lenPanOSErrorMessage= - fieldName: log.sniLenPanOSErrorMessage - pattern: (?:\\.|[^=\\])*? - - fieldName: log.paSuffix - pattern: (?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) + pattern: (?:\\.|[^=\\])*?(?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) where: oneOf("log.paFormat", ["CEF", "LEEF-legacy"]) - grok: source: log.paCefExtensions @@ -5889,9 +4737,7 @@ pipeline: - fieldName: log.paIgnored pattern: ^(?:[A-Za-z][A-Za-z0-9_]*=(?:\\.|[^=\\])*?[ \t]+)*?sourceTranslatedAddress= - fieldName: log.sourceTranslatedAddress - pattern: (?:\\.|[^=\\])*? - - fieldName: log.paSuffix - pattern: (?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) + pattern: (?:\\.|[^=\\])*?(?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) where: oneOf("log.paFormat", ["CEF", "LEEF-legacy"]) - grok: source: log.paCefExtensions @@ -5899,9 +4745,7 @@ pipeline: - fieldName: log.paIgnored pattern: ^(?:[A-Za-z][A-Za-z0-9_]*=(?:\\.|[^=\\])*?[ \t]+)*?sourceTranslatedPort= - fieldName: log.sourceTranslatedPort - pattern: (?:\\.|[^=\\])*? - - fieldName: log.paSuffix - pattern: (?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) + pattern: (?:\\.|[^=\\])*?(?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) where: oneOf("log.paFormat", ["CEF", "LEEF-legacy"]) - grok: source: log.paCefExtensions @@ -5909,9 +4753,7 @@ pipeline: - fieldName: log.paIgnored pattern: ^(?:[A-Za-z][A-Za-z0-9_]*=(?:\\.|[^=\\])*?[ \t]+)*?spt= - fieldName: log.spt - pattern: (?:\\.|[^=\\])*? - - fieldName: log.paSuffix - pattern: (?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) + pattern: (?:\\.|[^=\\])*?(?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) where: oneOf("log.paFormat", ["CEF", "LEEF-legacy"]) - grok: source: log.paCefExtensions @@ -5919,9 +4761,7 @@ pipeline: - fieldName: log.paIgnored pattern: ^(?:[A-Za-z][A-Za-z0-9_]*=(?:\\.|[^=\\])*?[ \t]+)*?src= - fieldName: log.src - pattern: (?:\\.|[^=\\])*? - - fieldName: log.paSuffix - pattern: (?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) + pattern: (?:\\.|[^=\\])*?(?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) where: oneOf("log.paFormat", ["CEF", "LEEF-legacy"]) - grok: source: log.paCefExtensions @@ -5929,9 +4769,7 @@ pipeline: - fieldName: log.paIgnored pattern: ^(?:[A-Za-z][A-Za-z0-9_]*=(?:\\.|[^=\\])*?[ \t]+)*?src_categoryPanOSSourceDeviceProfile= - fieldName: log.srcCategoryPanOSSourceDeviceProfile - pattern: (?:\\.|[^=\\])*? - - fieldName: log.paSuffix - pattern: (?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) + pattern: (?:\\.|[^=\\])*?(?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) where: oneOf("log.paFormat", ["CEF", "LEEF-legacy"]) - grok: source: log.paCefExtensions @@ -5939,9 +4777,7 @@ pipeline: - fieldName: log.paIgnored pattern: ^(?:[A-Za-z][A-Za-z0-9_]*=(?:\\.|[^=\\])*?[ \t]+)*?src_categoryPanSrcDeviceProf= - fieldName: log.srcCategoryPanSrcDeviceProf - pattern: (?:\\.|[^=\\])*? - - fieldName: log.paSuffix - pattern: (?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) + pattern: (?:\\.|[^=\\])*?(?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) where: oneOf("log.paFormat", ["CEF", "LEEF-legacy"]) - grok: source: log.paCefExtensions @@ -5949,9 +4785,7 @@ pipeline: - fieldName: log.paIgnored pattern: ^(?:[A-Za-z][A-Za-z0-9_]*=(?:\\.|[^=\\])*?[ \t]+)*?src_hostPanOSSourceDeviceMac= - fieldName: log.srcHostPanOSSourceDeviceMac - pattern: (?:\\.|[^=\\])*? - - fieldName: log.paSuffix - pattern: (?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) + pattern: (?:\\.|[^=\\])*?(?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) where: oneOf("log.paFormat", ["CEF", "LEEF-legacy"]) - grok: source: log.paCefExtensions @@ -5959,9 +4793,7 @@ pipeline: - fieldName: log.paIgnored pattern: ^(?:[A-Za-z][A-Za-z0-9_]*=(?:\\.|[^=\\])*?[ \t]+)*?src_hostPanSrcMac= - fieldName: log.srcHostPanSrcMac - pattern: (?:\\.|[^=\\])*? - - fieldName: log.paSuffix - pattern: (?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) + pattern: (?:\\.|[^=\\])*?(?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) where: oneOf("log.paFormat", ["CEF", "LEEF-legacy"]) - grok: source: log.paCefExtensions @@ -5969,9 +4801,7 @@ pipeline: - fieldName: log.paIgnored pattern: ^(?:[A-Za-z][A-Za-z0-9_]*=(?:\\.|[^=\\])*?[ \t]+)*?src_macPanOSTrafficOriginRegion= - fieldName: log.srcMacPanOSTrafficOriginRegion - pattern: (?:\\.|[^=\\])*? - - fieldName: log.paSuffix - pattern: (?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) + pattern: (?:\\.|[^=\\])*?(?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) where: oneOf("log.paFormat", ["CEF", "LEEF-legacy"]) - grok: source: log.paCefExtensions @@ -5979,9 +4809,7 @@ pipeline: - fieldName: log.paIgnored pattern: ^(?:[A-Za-z][A-Za-z0-9_]*=(?:\\.|[^=\\])*?[ \t]+)*?src_modelPanOSSourceDeviceVendor= - fieldName: log.srcModelPanOSSourceDeviceVendor - pattern: (?:\\.|[^=\\])*? - - fieldName: log.paSuffix - pattern: (?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) + pattern: (?:\\.|[^=\\])*?(?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) where: oneOf("log.paFormat", ["CEF", "LEEF-legacy"]) - grok: source: log.paCefExtensions @@ -5989,9 +4817,7 @@ pipeline: - fieldName: log.paIgnored pattern: ^(?:[A-Za-z][A-Za-z0-9_]*=(?:\\.|[^=\\])*?[ \t]+)*?src_modelPanSrcDeviceVendor= - fieldName: log.srcModelPanSrcDeviceVendor - pattern: (?:\\.|[^=\\])*? - - fieldName: log.paSuffix - pattern: (?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) + pattern: (?:\\.|[^=\\])*?(?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) where: oneOf("log.paFormat", ["CEF", "LEEF-legacy"]) - grok: source: log.paCefExtensions @@ -5999,9 +4825,7 @@ pipeline: - fieldName: log.paIgnored pattern: ^(?:[A-Za-z][A-Za-z0-9_]*=(?:\\.|[^=\\])*?[ \t]+)*?src_osfamilyPanOSSourceDeviceOSVersion= - fieldName: log.srcOsfamilyPanOSSourceDeviceOSVersion - pattern: (?:\\.|[^=\\])*? - - fieldName: log.paSuffix - pattern: (?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) + pattern: (?:\\.|[^=\\])*?(?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) where: oneOf("log.paFormat", ["CEF", "LEEF-legacy"]) - grok: source: log.paCefExtensions @@ -6009,9 +4833,7 @@ pipeline: - fieldName: log.paIgnored pattern: ^(?:[A-Za-z][A-Za-z0-9_]*=(?:\\.|[^=\\])*?[ \t]+)*?src_osversionPanSrcHostname= - fieldName: log.srcOsversionPanSrcHostname - pattern: (?:\\.|[^=\\])*? - - fieldName: log.paSuffix - pattern: (?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) + pattern: (?:\\.|[^=\\])*?(?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) where: oneOf("log.paFormat", ["CEF", "LEEF-legacy"]) - grok: source: log.paCefExtensions @@ -6019,9 +4841,7 @@ pipeline: - fieldName: log.paIgnored pattern: ^(?:[A-Za-z][A-Za-z0-9_]*=(?:\\.|[^=\\])*?[ \t]+)*?src_uuidPanOSDstUUID= - fieldName: log.srcUuidPanOSDstUUID - pattern: (?:\\.|[^=\\])*? - - fieldName: log.paSuffix - pattern: (?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) + pattern: (?:\\.|[^=\\])*?(?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) where: oneOf("log.paFormat", ["CEF", "LEEF-legacy"]) - grok: source: log.paCefExtensions @@ -6029,9 +4849,7 @@ pipeline: - fieldName: log.paIgnored pattern: ^(?:[A-Za-z][A-Za-z0-9_]*=(?:\\.|[^=\\])*?[ \t]+)*?src_vendorPanSrcDeviceOS= - fieldName: log.srcVendorPanSrcDeviceOS - pattern: (?:\\.|[^=\\])*? - - fieldName: log.paSuffix - pattern: (?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) + pattern: (?:\\.|[^=\\])*?(?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) where: oneOf("log.paFormat", ["CEF", "LEEF-legacy"]) - grok: source: log.paCefExtensions @@ -6039,9 +4857,7 @@ pipeline: - fieldName: log.paIgnored pattern: ^(?:[A-Za-z][A-Za-z0-9_]*=(?:\\.|[^=\\])*?[ \t]+)*?srccnt= - fieldName: log.srccnt - pattern: (?:\\.|[^=\\])*? - - fieldName: log.paSuffix - pattern: (?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) + pattern: (?:\\.|[^=\\])*?(?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) where: oneOf("log.paFormat", ["CEF", "LEEF-legacy"]) - grok: source: log.paCefExtensions @@ -6049,9 +4865,7 @@ pipeline: - fieldName: log.paIgnored pattern: ^(?:[A-Za-z][A-Za-z0-9_]*=(?:\\.|[^=\\])*?[ \t]+)*?srcdst= - fieldName: log.srcdst - pattern: (?:\\.|[^=\\])*? - - fieldName: log.paSuffix - pattern: (?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) + pattern: (?:\\.|[^=\\])*?(?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) where: oneOf("log.paFormat", ["CEF", "LEEF-legacy"]) - grok: source: log.paCefExtensions @@ -6059,9 +4873,7 @@ pipeline: - fieldName: log.paIgnored pattern: ^(?:[A-Za-z][A-Za-z0-9_]*=(?:\\.|[^=\\])*?[ \t]+)*?srcuserPanOSSourceRegion= - fieldName: log.srcuserPanOSSourceRegion - pattern: (?:\\.|[^=\\])*? - - fieldName: log.paSuffix - pattern: (?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) + pattern: (?:\\.|[^=\\])*?(?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) where: oneOf("log.paFormat", ["CEF", "LEEF-legacy"]) - grok: source: log.paCefExtensions @@ -6069,9 +4881,7 @@ pipeline: - fieldName: log.paIgnored pattern: ^(?:[A-Za-z][A-Za-z0-9_]*=(?:\\.|[^=\\])*?[ \t]+)*?stagePanOSAuthMethod= - fieldName: log.stagePanOSAuthMethod - pattern: (?:\\.|[^=\\])*? - - fieldName: log.paSuffix - pattern: (?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) + pattern: (?:\\.|[^=\\])*?(?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) where: oneOf("log.paFormat", ["CEF", "LEEF-legacy"]) - grok: source: log.paCefExtensions @@ -6079,9 +4889,7 @@ pipeline: - fieldName: log.paIgnored pattern: ^(?:[A-Za-z][A-Za-z0-9_]*=(?:\\.|[^=\\])*?[ \t]+)*?start= - fieldName: log.start - pattern: (?:\\.|[^=\\])*? - - fieldName: log.paSuffix - pattern: (?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) + pattern: (?:\\.|[^=\\])*?(?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) where: oneOf("log.paFormat", ["CEF", "LEEF-legacy"]) - grok: source: log.paCefExtensions @@ -6089,9 +4897,7 @@ pipeline: - fieldName: log.paIgnored pattern: ^(?:[A-Za-z][A-Za-z0-9_]*=(?:\\.|[^=\\])*?[ \t]+)*?statusPanOSGPGatewayLocation= - fieldName: log.statusPanOSGPGatewayLocation - pattern: (?:\\.|[^=\\])*? - - fieldName: log.paSuffix - pattern: (?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) + pattern: (?:\\.|[^=\\])*?(?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) where: oneOf("log.paFormat", ["CEF", "LEEF-legacy"]) - grok: source: log.paCefExtensions @@ -6099,9 +4905,7 @@ pipeline: - fieldName: log.paIgnored pattern: ^(?:[A-Za-z][A-Za-z0-9_]*=(?:\\.|[^=\\])*?[ \t]+)*?suid= - fieldName: log.suid - pattern: (?:\\.|[^=\\])*? - - fieldName: log.paSuffix - pattern: (?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) + pattern: (?:\\.|[^=\\])*?(?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) where: oneOf("log.paFormat", ["CEF", "LEEF-legacy"]) - grok: source: log.paCefExtensions @@ -6109,9 +4913,7 @@ pipeline: - fieldName: log.paIgnored pattern: ^(?:[A-Za-z][A-Za-z0-9_]*=(?:\\.|[^=\\])*?[ \t]+)*?suser= - fieldName: log.suser - pattern: (?:\\.|[^=\\])*? - - fieldName: log.paSuffix - pattern: (?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) + pattern: (?:\\.|[^=\\])*?(?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) where: oneOf("log.paFormat", ["CEF", "LEEF-legacy"]) - grok: source: log.paCefExtensions @@ -6119,9 +4921,7 @@ pipeline: - fieldName: log.paIgnored pattern: ^(?:[A-Za-z][A-Za-z0-9_]*=(?:\\.|[^=\\])*?[ \t]+)*?tag_namePanOSEventID= - fieldName: log.tagNamePanOSEventID - pattern: (?:\\.|[^=\\])*? - - fieldName: log.paSuffix - pattern: (?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) + pattern: (?:\\.|[^=\\])*?(?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) where: oneOf("log.paFormat", ["CEF", "LEEF-legacy"]) - grok: source: log.paCefExtensions @@ -6129,9 +4929,7 @@ pipeline: - fieldName: log.paIgnored pattern: ^(?:[A-Za-z][A-Za-z0-9_]*=(?:\\.|[^=\\])*?[ \t]+)*?thr_categoryPanOSContentVer= - fieldName: log.thrCategoryPanOSContentVer - pattern: (?:\\.|[^=\\])*? - - fieldName: log.paSuffix - pattern: (?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) + pattern: (?:\\.|[^=\\])*?(?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) where: oneOf("log.paFormat", ["CEF", "LEEF-legacy"]) - grok: source: log.paCefExtensions @@ -6139,9 +4937,7 @@ pipeline: - fieldName: log.paIgnored pattern: ^(?:[A-Za-z][A-Za-z0-9_]*=(?:\\.|[^=\\])*?[ \t]+)*?tls_authPanOSPolicyName= - fieldName: log.tlsAuthPanOSPolicyName - pattern: (?:\\.|[^=\\])*? - - fieldName: log.paSuffix - pattern: (?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) + pattern: (?:\\.|[^=\\])*?(?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) where: oneOf("log.paFormat", ["CEF", "LEEF-legacy"]) - grok: source: log.paCefExtensions @@ -6149,9 +4945,7 @@ pipeline: - fieldName: log.paIgnored pattern: ^(?:[A-Za-z][A-Za-z0-9_]*=(?:\\.|[^=\\])*?[ \t]+)*?tls_versionPanOSTLSKeyExchange= - fieldName: log.tlsVersionPanOSTLSKeyExchange - pattern: (?:\\.|[^=\\])*? - - fieldName: log.paSuffix - pattern: (?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) + pattern: (?:\\.|[^=\\])*?(?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) where: oneOf("log.paFormat", ["CEF", "LEEF-legacy"]) - grok: source: log.paCefExtensions @@ -6159,9 +4953,7 @@ pipeline: - fieldName: log.paIgnored pattern: ^(?:[A-Za-z][A-Za-z0-9_]*=(?:\\.|[^=\\])*?[ \t]+)*?todeviceInboundInterface= - fieldName: log.todeviceInboundInterface - pattern: (?:\\.|[^=\\])*? - - fieldName: log.paSuffix - pattern: (?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) + pattern: (?:\\.|[^=\\])*?(?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) where: oneOf("log.paFormat", ["CEF", "LEEF-legacy"]) - grok: source: log.paCefExtensions @@ -6169,9 +4961,7 @@ pipeline: - fieldName: log.paIgnored pattern: ^(?:[A-Za-z][A-Za-z0-9_]*=(?:\\.|[^=\\])*?[ \t]+)*?tunnelPanOSThreatCategory= - fieldName: log.tunnelPanOSThreatCategory - pattern: (?:\\.|[^=\\])*? - - fieldName: log.paSuffix - pattern: (?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) + pattern: (?:\\.|[^=\\])*?(?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) where: oneOf("log.paFormat", ["CEF", "LEEF-legacy"]) - grok: source: log.paCefExtensions @@ -6179,9 +4969,7 @@ pipeline: - fieldName: log.paIgnored pattern: ^(?:[A-Za-z][A-Za-z0-9_]*=(?:\\.|[^=\\])*?[ \t]+)*?ugflagsPanOSUserBySource= - fieldName: log.ugflagsPanOSUserBySource - pattern: (?:\\.|[^=\\])*? - - fieldName: log.paSuffix - pattern: (?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) + pattern: (?:\\.|[^=\\])*?(?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) where: oneOf("log.paFormat", ["CEF", "LEEF-legacy"]) - grok: source: log.paCefExtensions @@ -6189,9 +4977,7 @@ pipeline: - fieldName: log.paIgnored pattern: ^(?:[A-Za-z][A-Za-z0-9_]*=(?:\\.|[^=\\])*?[ \t]+)*?url_category_listPanOSHTTP2Con= - fieldName: log.urlCategoryListPanOSHTTP2Con - pattern: (?:\\.|[^=\\])*? - - fieldName: log.paSuffix - pattern: (?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) + pattern: (?:\\.|[^=\\])*?(?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) where: oneOf("log.paFormat", ["CEF", "LEEF-legacy"]) - grok: source: log.paCefExtensions @@ -6199,9 +4985,7 @@ pipeline: - fieldName: log.paIgnored pattern: ^(?:[A-Za-z][A-Za-z0-9_]*=(?:\\.|[^=\\])*?[ \t]+)*?userexternalId= - fieldName: log.userexternalId - pattern: (?:\\.|[^=\\])*? - - fieldName: log.paSuffix - pattern: (?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) + pattern: (?:\\.|[^=\\])*?(?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) where: oneOf("log.paFormat", ["CEF", "LEEF-legacy"]) - grok: source: log.paCefExtensions @@ -6209,9 +4993,7 @@ pipeline: - fieldName: log.paIgnored pattern: ^(?:[A-Za-z][A-Za-z0-9_]*=(?:\\.|[^=\\])*?[ \t]+)*?xffPanOSReferer= - fieldName: log.xffPanOSReferer - pattern: (?:\\.|[^=\\])*? - - fieldName: log.paSuffix - pattern: (?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) + pattern: (?:\\.|[^=\\])*?(?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) where: oneOf("log.paFormat", ["CEF", "LEEF-legacy"]) - grok: source: log.paCefExtensions @@ -6219,9 +5001,625 @@ pipeline: - fieldName: log.paIgnored pattern: ^(?:[A-Za-z][A-Za-z0-9_]*=(?:\\.|[^=\\])*?[ \t]+)*?xff_ipPanSrcDeviceCat= - fieldName: log.xffIpPanSrcDeviceCat - pattern: (?:\\.|[^=\\])*? - - fieldName: log.paSuffix - pattern: (?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) + pattern: (?:\\.|[^=\\])*?(?:[ \t]+[A-Za-z][A-Za-z0-9_]*=|$) + where: oneOf("log.paFormat", ["CEF", "LEEF-legacy"]) + - trim: + function: regex + substring: '[ \t]+[A-Za-z][A-Za-z0-9_]*=$' + fields: + - log.DNSSICategory + - log.ModuleflexString2 + - log.PanASServiceDiff + - log.PanASServiceType + - log.PanContainerName + - log.PanDomainEDL + - log.PanDstDAG + - log.PanDstDeviceCat + - log.PanDstDeviceModel + - log.PanDstDeviceOS + - log.PanDstDeviceOSv + - log.PanDstDeviceProf + - log.PanDstDeviceVendor + - log.PanDstEDL + - log.PanDstHostname + - log.PanDstMac + - log.PanDynamicUsrgrp + - log.PanEPSerial + - log.PanGPHostID + - log.PanHASessionOwner + - log.PanJustification + - log.PanLinkChange + - log.PanLinkDetail + - log.PanOSAPName + - log.PanOSActionFlags + - log.PanOSAreaCode + - log.PanOSAssocID + - log.PanOSAttemptedGateways + - log.PanOSAuthMethod + - log.PanOSCellID + - log.PanOSCertificateFlags + - log.PanOSCertificateSerial + - log.PanOSCertificateSize + - log.PanOSCertificateVersion + - log.PanOSChainStatus + - log.PanOSChunkType + - log.PanOSClientToFirewall + - log.PanOSCommonName + - log.PanOSCommonNameLength + - log.PanOSConfigVersion + - log.PanOSConnectionError + - log.PanOSConnectionErrorID + - log.PanOSConnectionMethod + - log.PanOSContainerID + - log.PanOSContainerName + - log.PanOSContainerNameSpace + - log.PanOSContentVer + - log.PanOSCountOfRepeats + - log.PanOSDGl1 + - log.PanOSDGl2 + - log.PanOSDGl3 + - log.PanOSDGl4 + - log.PanOSDataSourceName + - log.PanOSDataSourceSubType + - log.PanOSDataSourceType + - log.PanOSDesc + - log.PanOSDescription + - log.PanOSDestinationDeviceCategory + - log.PanOSDestinationDeviceHost + - log.PanOSDestinationDeviceMac + - log.PanOSDestinationDeviceModel + - log.PanOSDestinationDeviceOSFamily + - log.PanOSDestinationDeviceOSVersion + - log.PanOSDestinationDeviceProfile + - log.PanOSDestinationDeviceVendor + - log.PanOSDestinationDynamicAddressGroup + - log.PanOSDestinationEDL + - log.PanOSDestinationUUID + - log.PanOSDeviceSN + - log.PanOSDiameterAVPCode + - log.PanOSDiameterApp + - log.PanOSDiameterCmdCode + - log.PanOSDstUUID + - log.PanOSEllipticCurve + - log.PanOSEndUserIP + - log.PanOSEndpointDeviceName + - log.PanOSEndpointMac + - log.PanOSEndpointOSType + - log.PanOSEndpointOSVersion + - log.PanOSEndpointSerialNumber + - log.PanOSErrorIndex + - log.PanOSErrorMessage + - log.PanOSEventID + - log.PanOSEventStatus + - log.PanOSFWDeviceGroup + - log.PanOSFingerprint + - log.PanOSFirewallToServer + - log.PanOSGPGatewayLocation + - log.PanOSGTPCause + - log.PanOSGTPEventCode + - log.PanOSGTPEventType + - log.PanOSGTPInterface + - log.PanOSGTPMsgType + - log.PanOSGateway + - log.PanOSGatewayPriority + - log.PanOSGatewaySelectionType + - log.PanOSGlobalProtectClientVersion + - log.PanOSHTTP2Con + - log.PanOSHTTPHeader + - log.PanOSHTTPUserAgent + - log.PanOSHostID + - log.PanOSIssuerCommonName + - log.PanOSIssuerNameLength + - log.PanOSLogTimeStamp + - log.PanOSLogTypeSeqNo + - log.PanOSLoginDuration + - log.PanOSMSISDN + - log.PanOSMonitorTag + - log.PanOSOpCode + - log.PanOSPPID + - log.PanOSPacketsReceived + - log.PanOSPacketsSent + - log.PanOSParentSessionID + - log.PanOSParentStartTime + - log.PanOSPayloadProtID + - log.PanOSPcapID + - log.PanOSPolicyAuditComment + - log.PanOSPolicyName + - log.PanOSPortal + - log.PanOSPrivateIPv4 + - log.PanOSPrivateIPv6 + - log.PanOSProxyType + - log.PanOSPublicIPv4 + - log.PanOSPublicIPv6 + - log.PanOSQuarantineReason + - log.PanOSRadioTech + - log.PanOSReferer + - log.PanOSRmtUserID + - log.PanOSRmtUserIP + - log.PanOSRootCNLength + - log.PanOSRootCommonName + - log.PanOSRootStatus + - log.PanOSRuleUUID + - log.PanOSSCCPCallingGT + - log.PanOSSCCPCallingPartySSN + - log.PanOSSCTPAssocEndReason + - log.PanOSSCTPAssocID + - log.PanOSSCTPCauseCode + - log.PanOSSCTPChunkRcv + - log.PanOSSCTPChunkSent + - log.PanOSSCTPChunks + - log.PanOSSCTPChunksRcv + - log.PanOSSCTPFilter + - log.PanOSSCTPStreamID + - log.PanOSSCTPVerTag1 + - log.PanOSSCTPVerTag2 + - log.PanOSSNILength + - log.PanOSSSLResponseTime + - log.PanOSSequenceNo + - log.PanOSServerNameIndication + - log.PanOSServingCntryMCC + - log.PanOSServingNetMNC + - log.PanOSSeverity + - log.PanOSSourceDeviceCategory + - log.PanOSSourceDeviceHost + - log.PanOSSourceDeviceMac + - log.PanOSSourceDeviceModel + - log.PanOSSourceDeviceOSFamily + - log.PanOSSourceDeviceOSVersion + - log.PanOSSourceDeviceProfile + - log.PanOSSourceDeviceVendor + - log.PanOSSourceDynamicAddressGroup + - log.PanOSSourceEDL + - log.PanOSSourceHostname + - log.PanOSSourceMac + - log.PanOSSourceRegion + - log.PanOSSourceUUID + - log.PanOSSourceUserName + - log.PanOSSrcUUID + - log.PanOSStage + - log.PanOSTLSAuth + - log.PanOSTLSEncryptionAlgorithm + - log.PanOSTLSKeyExchange + - log.PanOSTLSVersion + - log.PanOSTagName + - log.PanOSThreatCategory + - log.PanOSTimeGeneratedHighResolution + - log.PanOSTimeNotAfter + - log.PanOSTimeNotBefore + - log.PanOSTimeReceivedManagementPlane + - log.PanOSTimeout + - log.PanOSTrafficOriginRegion + - log.PanOSTrafficSessionID + - log.PanOSTunneInspectionRule + - log.PanOSTunnel + - log.PanOSTunnelEndptID1 + - log.PanOSTunnelEndptID2 + - log.PanOSTunnelFragment + - log.PanOSTunnelID + - log.PanOSTunnelInspectionRule + - log.PanOSTunnelType + - log.PanOSUGFlags + - log.PanOSURLCatList + - log.PanOSUserBySource + - log.PanOSVirtualSystem + - log.PanOSVsysName + - log.PanOSXForwarderfor + - log.PanOsVsysName + - log.PanPODName + - log.PanPODNamespace + - log.PanPartialHash + - log.PanPolicyID + - log.PanReasonFilteringAction + - log.PanSDWANCluster + - log.PanSDWANClustype + - log.PanSDWANDevice + - log.PanSDWANSite + - log.PanSrcDAG + - log.PanSrcDeviceCat + - log.PanSrcDeviceModel + - log.PanSrcDeviceOS + - log.PanSrcDeviceOSv + - log.PanSrcDeviceProf + - log.PanSrcDeviceVendor + - log.PanSrcEDL + - log.PanSrcHostname + - log.PanSrcMac + - log.PanTimeHighRes + - log.PanXFFIP + - log.SessionIDcn1 + - log.Typecs5 + - log.Typecs6 + - log.VendorflexString2 + - log.act + - log.actionflagsPanOSTimeGeneratedHighResolution + - log.actionflagsanOSTimeGeneratedHighResolution + - log.actionrequest + - log.admindestinationServiceName + - log.anOSTimeGeneratedHighResolution + - log.app + - log.c6a2 + - log.c6a2Label + - log.cat + - log.certSizePanOSCommonNameLength + - log.cfp1 + - log.cfp1Label + - log.cfp2 + - log.cfp2Label + - log.cfp3 + - log.cfp3Label + - log.cfp4 + - log.cfp4Label + - log.clientOsPanOSEndpointOSVersion + - log.cn1 + - log.cn1Label + - log.cn2 + - log.cn2Label + - log.cn3 + - log.cn3Label + - log.cn4 + - log.cn4Label + - log.cn5 + - log.cn5Label + - log.cn6 + - log.cn6Label + - log.cnPanOSIssuerCommonName + - log.cnt + - log.connectMethodPanOSConnectionErrorID + - log.cs1 + - log.cs1Label + - log.cs2 + - log.cs2Label + - log.cs3 + - log.cs3Label + - log.cs4 + - log.cs4Label + - log.cs5 + - log.cs5Label + - log.cs6 + - log.cs6Label + - log.datasourcenamePanOSDataSourceType + - log.destinationServiceName + - log.destinationTranslatedAddress + - log.destinationTranslatedPort + - log.detailPanOSFWDeviceGroup + - log.deviceExternalId + - log.deviceInboundInterface + - log.deviceOutboundInterface + - log.deviceNamePanOSActionFlags + - log.dgHierLevel1PanOSDGl2 + - log.dgHierLevel2PanOSDGl3 + - log.dgHierLevel3PanOSDGl4 + - log.dgHierLevel4PanOSVsysName + - log.directionPanOSActionFlags + - log.dpt + - log.dst + - log.dstCategoryPanOSDestinationDeviceProfile + - log.dstDagPanOSTimeGeneratedHighResolution + - log.dstEdlPanOSSourceDynamicAddressGroup + - log.dstHostPanOSDestinationDeviceMac + - log.dstMacPanContainerName + - log.dstModelPanOSDestinationDeviceVendor + - log.dstOsfamilyPanDstDeviceOSv + - log.dstOsfamilyPanOSDestinationDeviceOSVersion + - log.dstProfilePanDstDeviceModel + - log.dstUuidPanOSTunnelID + - log.duid + - log.duser + - log.dvchost + - log.end + - log.errIndexPanOSRootStatus + - log.externalId + - log.fileHash + - log.fileId + - log.filePath + - log.fileType + - log.flags + - log.flexNumber1 + - log.flexNumber1Label + - log.flexNumber2 + - log.flexNumber2Label + - log.flexString1 + - log.flexString1Label + - log.flexString2 + - log.flexString2Label + - log.fname + - log.hostidPanOSDeviceSN + - log.hostidPanOSEndpointSerialNumber + - log.http2ConnectionPanDynamicUsrgrp + - log.httpHeadersPanOSRuleUUID + - log.httpHeadersPanOSURLCatList + - log.in + - log.justificationPanASServiceType + - log.macPanOSTimeGeneratedHighResolution + - log.monitortagPanOSParentSessionID + - log.msg + - log.natsportdestinationTranslatedPort + - log.natsrcdestinationTranslatedAddress + - log.notbeforePanOSTimeNotAfter + - log.oldFileId + - log.out + - log.panASServiceDiff + - log.panASServiceType + - log.panContainerName + - log.panDomainEDL + - log.panDstDAG + - log.panDstDeviceCat + - log.panDstDeviceModel + - log.panDstDeviceOS + - log.panDstDeviceOSv + - log.panDstDeviceProf + - log.panDstDeviceVendor + - log.panDstEDL + - log.panDstHostname + - log.panDstMac + - log.panDynamicUsrgrp + - log.panEPSerial + - log.panGPHostID + - log.panHASessionOwner + - log.panJustification + - log.panLinkChange + - log.panLinkDetail + - log.panOSAPName + - log.panOSActionFlags + - log.panOSAreaCode + - log.panOSAssocID + - log.panOSAttemptedGateways + - log.panOSAuthMethod + - log.panOSCellID + - log.panOSCertificateFlags + - log.panOSCertificateSerial + - log.panOSCertificateSize + - log.panOSCertificateVersion + - log.panOSChainStatus + - log.panOSChunkType + - log.panOSClientToFirewall + - log.panOSCommonName + - log.panOSCommonNameLength + - log.panOSConfigVersion + - log.panOSConnectionError + - log.panOSConnectionErrorID + - log.panOSConnectionMethod + - log.panOSContainerID + - log.panOSContainerName + - log.panOSContainerNameSpace + - log.panOSContentVer + - log.panOSCountOfRepeats + - log.panOSDGl1 + - log.panOSDGl2 + - log.panOSDGl3 + - log.panOSDGl4 + - log.panOSDataSourceName + - log.panOSDataSourceSubType + - log.panOSDataSourceType + - log.panOSDesc + - log.panOSDescription + - log.panOSDestinationDeviceCategory + - log.panOSDestinationDeviceHost + - log.panOSDestinationDeviceMac + - log.panOSDestinationDeviceModel + - log.panOSDestinationDeviceOSFamily + - log.panOSDestinationDeviceOSVersion + - log.panOSDestinationDeviceProfile + - log.panOSDestinationDeviceVendor + - log.panOSDestinationDynamicAddressGroup + - log.panOSDestinationEDL + - log.panOSDestinationUUID + - log.panOSDeviceSN + - log.panOSDiameterAVPCode + - log.panOSDiameterApp + - log.panOSDiameterCmdCode + - log.panOSDstUUID + - log.panOSEllipticCurve + - log.panOSEndUserIP + - log.panOSEndpointDeviceName + - log.panOSEndpointMac + - log.panOSEndpointOSType + - log.panOSEndpointOSVersion + - log.panOSEndpointSerialNumber + - log.panOSErrorIndex + - log.panOSErrorMessage + - log.panOSEventID + - log.panOSEventStatus + - log.panOSFWDeviceGroup + - log.panOSFingerprint + - log.panOSFirewallToServer + - log.panOSGPGatewayLocation + - log.panOSGTPCause + - log.panOSGTPEventCode + - log.panOSGTPEventType + - log.panOSGTPInterface + - log.panOSGTPMsgType + - log.panOSGateway + - log.panOSGatewayPriority + - log.panOSGatewaySelectionType + - log.panOSGlobalProtectClientVersion + - log.panOSHTTP2Con + - log.panOSHTTPHeader + - log.panOSHTTPUserAgent + - log.panOSHostID + - log.panOSIssuerCommonName + - log.panOSIssuerNameLength + - log.panOSLogTimeStamp + - log.panOSLogTypeSeqNo + - log.panOSLoginDuration + - log.panOSMSISDN + - log.panOSMonitorTag + - log.panOSOpCode + - log.panOSPPID + - log.panOSPacketsReceived + - log.panOSPacketsSent + - log.panOSParentSessionID + - log.panOSParentStartTime + - log.panOSPayloadProtID + - log.panOSPcapID + - log.panOSPolicyAuditComment + - log.panOSPolicyName + - log.panOSPortal + - log.panOSPrivateIPv4 + - log.panOSPrivateIPv6 + - log.panOSProxyType + - log.panOSPublicIPv4 + - log.panOSPublicIPv6 + - log.panOSQuarantineReason + - log.panOSRadioTech + - log.panOSReferer + - log.panOSRmtUserID + - log.panOSRmtUserIP + - log.panOSRootCNLength + - log.panOSRootCommonName + - log.panOSRootStatus + - log.panOSRuleUUID + - log.panOSSCCPCallingGT + - log.panOSSCCPCallingPartySSN + - log.panOSSCTPAssocEndReason + - log.panOSSCTPAssocID + - log.panOSSCTPCauseCode + - log.panOSSCTPChunkRcv + - log.panOSSCTPChunkSent + - log.panOSSCTPChunks + - log.panOSSCTPChunksRcv + - log.panOSSCTPFilter + - log.panOSSCTPStreamID + - log.panOSSCTPVerTag1 + - log.panOSSCTPVerTag2 + - log.panOSSNILength + - log.panOSSSLResponseTime + - log.panOSSequenceNo + - log.panOSServerNameIndication + - log.panOSServingCntryMCC + - log.panOSServingNetMNC + - log.panOSSeverity + - log.panOSSourceDeviceCategory + - log.panOSSourceDeviceHost + - log.panOSSourceDeviceMac + - log.panOSSourceDeviceModel + - log.panOSSourceDeviceOSFamily + - log.panOSSourceDeviceOSVersion + - log.panOSSourceDeviceProfile + - log.panOSSourceDeviceVendor + - log.panOSSourceDynamicAddressGroup + - log.panOSSourceEDL + - log.panOSSourceHostname + - log.panOSSourceMac + - log.panOSSourceRegion + - log.panOSSourceUUID + - log.panOSSourceUserName + - log.panOSSrcUUID + - log.panOSStage + - log.panOSTLSAuth + - log.panOSTLSEncryptionAlgorithm + - log.panOSTLSKeyExchange + - log.panOSTLSVersion + - log.panOSTagName + - log.panOSThreatCategory + - log.panOSTimeGeneratedHighResolution + - log.panOSTimeNotAfter + - log.panOSTimeNotBefore + - log.panOSTimeReceivedManagementPlane + - log.panOSTimeout + - log.panOSTrafficOriginRegion + - log.panOSTrafficSessionID + - log.panOSTunneInspectionRule + - log.panOSTunnel + - log.panOSTunnelEndptID1 + - log.panOSTunnelEndptID2 + - log.panOSTunnelFragment + - log.panOSTunnelID + - log.panOSTunnelInspectionRule + - log.panOSTunnelType + - log.panOSUGFlags + - log.panOSURLCatList + - log.panOSUserBySource + - log.panOSVirtualSystem + - log.panOSVsysName + - log.panOSXForwarderfor + - log.panPODName + - log.panPODNamespace + - log.panPartialHash + - log.panPolicyID + - log.panReasonFilteringAction + - log.panSDWANCluster + - log.panSDWANClustype + - log.panSDWANDevice + - log.panSDWANSite + - log.panSrcDAG + - log.panSrcDeviceCat + - log.panSrcDeviceModel + - log.panSrcDeviceOS + - log.panSrcDeviceOSv + - log.panSrcDeviceProf + - log.panSrcDeviceVendor + - log.panSrcEDL + - log.panSrcHostname + - log.panSrcMac + - log.panTimeHighRes + - log.panXFFIP + - log.parentSessionIdPanOSParentStartTime + - log.partialHashPanTimeHighRes + - log.pcapIdfileHash + - log.pcapIdrequestMethod + - log.podNamePanSrcEDL + - log.podNamespacePanOSContainerName + - log.ppidPanOSHTTPHeader + - log.priorityPanOSAttemptedGateways + - log.proto + - log.proxyTypePanOSCertificateSerial + - log.publicIpPanOSPublicIPv6 + - log.reason + - log.reasonPanOSConnectionError + - log.receiveTimePanOSDeviceSN + - log.receiveTimedeviceExternalId + - log.reportidPanOSDGl1 + - log.request + - log.requestClientApplication + - log.requestContext + - log.requestMethod + - log.rootcnLenPanOSSNILength + - log.rt + - log.ruleUuidPanOSClientToFirewall + - log.ruleUuidPanOSTimeGeneratedHighResolution + - log.rulesuser + - log.selectionTypePanOSSSLResponseTime + - log.seqnoPanOSActionFlags + - log.serialPanOSLogTimeStamp + - log.serialnumberPanDomainEDL + - log.severity + - log.shost + - log.sniLenPanOSErrorMessage + - log.sourceTranslatedAddress + - log.sourceTranslatedPort + - log.spt + - log.src + - log.srcCategoryPanOSSourceDeviceProfile + - log.srcCategoryPanSrcDeviceProf + - log.srcHostPanOSSourceDeviceMac + - log.srcHostPanSrcMac + - log.srcMacPanOSTrafficOriginRegion + - log.srcModelPanOSSourceDeviceVendor + - log.srcModelPanSrcDeviceVendor + - log.srcOsfamilyPanOSSourceDeviceOSVersion + - log.srcOsversionPanSrcHostname + - log.srcUuidPanOSDstUUID + - log.srcVendorPanSrcDeviceOS + - log.srccnt + - log.srcdst + - log.srcuserPanOSSourceRegion + - log.stagePanOSAuthMethod + - log.start + - log.statusPanOSGPGatewayLocation + - log.suid + - log.suser + - log.tagNamePanOSEventID + - log.thrCategoryPanOSContentVer + - log.tlsAuthPanOSPolicyName + - log.tlsVersionPanOSTLSKeyExchange + - log.todeviceInboundInterface + - log.tunnelPanOSThreatCategory + - log.ugflagsPanOSUserBySource + - log.urlCategoryListPanOSHTTP2Con + - log.userexternalId + - log.xffPanOSReferer + - log.xffIpPanSrcDeviceCat where: oneOf("log.paFormat", ["CEF", "LEEF-legacy"]) - csv: source: log.paPayload @@ -6330,6 +5728,114 @@ pipeline: - log.dstDag - log.sessionOwner - log.highResTimestamp + where: 'equals("log.paFormat", "CSV") && regexMatch("log.paPayload", "^[^,]*,[^,]*,[^,]*,TRAFFIC,")' + - csv: + source: log.paPayload + separator: ',' + headers: + - log.futureUse + - log.receiveTime + - log.serial + - log.paType + - log.paSubtype + - log.futureUse + - log.timeGenerated + - log.src + - log.dst + - log.natsrc + - log.natdst + - log.rule + - log.srcuser + - log.dstuser + - log.app + - log.vsys + - log.from + - log.to + - log.inboundIf + - log.outboundIf + - log.logset + - log.futureUse + - log.sessionid + - log.repeatcnt + - log.spt + - log.dpt + - log.natspt + - log.natdpt + - log.flags + - log.proto + - log.act + - log.bytes + - log.bytesSent + - log.bytesReceived + - log.packets + - log.start + - log.elapsed + - log.category + - log.futureUse + - log.seqno + - log.actionflags + - log.srcloc + - log.dstloc + - log.futureUse + - log.pktsSent + - log.pktsReceived + - log.sessionEndReason + - log.dgHierLevel1 + - log.dgHierLevel2 + - log.dgHierLevel3 + - log.dgHierLevel4 + - log.vsysName + - log.deviceName + - log.actionSource + - log.srcUuid + - log.dstUuid + - log.tunnelidImsi + - log.monitortagImei + - log.parentSessionId + - log.parentStartTime + - log.tunnel + - log.assocId + - log.chunks + - log.chunksSent + - log.chunksReceived + - log.ruleUuid + - log.http2Connection + - log.linkChangeCount + - log.policyId + - log.linkSwitches + - log.sdwanCluster + - log.sdwanDeviceType + - log.sdwanClusterType + - log.sdwanSite + - log.dynusergroupName + - log.xffIp + - log.srcCategory + - log.srcProfile + - log.srcModel + - log.srcVendor + - log.srcOsfamily + - log.srcOsversion + - log.srcHost + - log.srcMac + - log.dstCategory + - log.dstProfile + - log.dstModel + - log.dstVendor + - log.dstOsfamily + - log.dstOsversion + - log.dstHost + - log.dstMac + - log.containerId + - log.podNamespace + - log.podName + - log.srcEdl + - log.dstEdl + - log.hostid + - log.serialnumber + - log.srcDag + - log.dstDag + - log.sessionOwner + - log.highResTimestamp - log.nsdsaiSst - log.nsdsaiSd - log.subcategoryOfApp @@ -6357,7 +5863,7 @@ pipeline: - log.tcpZeroWindowCntS2c - log.srcAdvDevid - log.dstAdvDevid - where: equals("log.paFormat", "CSV") && regexMatch("log.paPayload", "^[^,]*,[^,]*,[^,]*,TRAFFIC,") + where: 'equals("log.paFormat", "CSV") && regexMatch("log.paPayload", "^[^,]*,[^,]*,[^,]*,TRAFFIC,") && regexMatch("log.paPayload", "^(?:(?:\"(?:[^\"]|\"\")*\"|[^,\"]*),){129}")' - csv: source: log.paPayload separator: ',' @@ -6468,25 +5974,7 @@ pipeline: - log.domainEdl - log.srcDag - log.dstDag - - log.partialHash - - log.highResTimestamp - - log.reason - - log.justification - - log.nssaiSst - - log.subcategoryOfApp - - log.categoryOfApp - - log.technologyOfApp - - log.riskOfApp - - log.characteristicOfApp - - log.containerOfApp - - log.tunneledApp - - log.isSaasOfApp - - log.sanctionedStateOfApp - - log.cloudReportid - - log.flowType - - log.clusterName - where: equals("log.paFormat", "CSV") && regexMatch("log.paPayload", "^[^,]*,[^,]*,[^,]*,THREAT,") && !regexMatch("log.paPayload", - "^[^,]*,[^,]*,[^,]*,THREAT,(?:url|data|dlp|dlp-non-file|file),") + where: 'equals("log.paFormat", "CSV") && regexMatch("log.paPayload", "^[^,]*,[^,]*,[^,]*,THREAT,") && !regexMatch("log.paPayload", "^[^,]*,[^,]*,[^,]*,THREAT,(?:url|data|dlp|dlp-non-file|file),")' - csv: source: log.paPayload separator: ',' @@ -6612,9 +6100,9 @@ pipeline: - log.isSaasOfApp - log.sanctionedStateOfApp - log.cloudReportid - - log.clusterName - log.flowType - where: equals("log.paFormat", "CSV") && regexMatch("log.paPayload", "^[^,]*,[^,]*,[^,]*,THREAT,(?:data|dlp|dlp-non-file|file),") + - log.clusterName + where: 'equals("log.paFormat", "CSV") && regexMatch("log.paPayload", "^[^,]*,[^,]*,[^,]*,THREAT,") && !regexMatch("log.paPayload", "^[^,]*,[^,]*,[^,]*,THREAT,(?:url|data|dlp|dlp-non-file|file),") && regexMatch("log.paPayload", "^(?:(?:\"(?:[^\"]|\"\")*\"|[^,\"]*),){122}")' - csv: source: log.paPayload separator: ',' @@ -6694,17 +6182,495 @@ pipeline: - log.assocId - log.ppid - log.httpHeaders - - log.paURLTail0 - - log.paURLTail1 - - log.paURLTail2 - - log.paURLTail3 - - log.paURLTail4 - - log.paURLTail5 - - log.paURLTail6 - - log.paURLTail7 - - log.paURLTail8 - - log.paURLTail9 - - log.paURLTail10 + - log.urlCategoryList + - log.ruleUuid + - log.http2Connection + - log.dynusergroupName + - log.xffIp + - log.srcCategory + - log.srcProfile + - log.srcModel + - log.srcVendor + - log.srcOsfamily + - log.srcOsversion + - log.srcHost + - log.srcMac + - log.dstCategory + - log.dstProfile + - log.dstModel + - log.dstVendor + - log.dstOsfamily + - log.dstOsversion + - log.dstHost + - log.dstMac + - log.containerId + - log.podNamespace + - log.podName + - log.srcEdl + - log.dstEdl + - log.hostid + - log.serialnumber + - log.domainEdl + - log.srcDag + - log.dstDag + where: 'equals("log.paFormat", "CSV") && regexMatch("log.paPayload", "^[^,]*,[^,]*,[^,]*,THREAT,(?:data|dlp|dlp-non-file|file),")' + - csv: + source: log.paPayload + separator: ',' + headers: + - log.futureUse + - log.receiveTime + - log.serial + - log.paType + - log.paSubtype + - log.futureUse + - log.timeGenerated + - log.src + - log.dst + - log.natsrc + - log.natdst + - log.rule + - log.srcuser + - log.dstuser + - log.app + - log.vsys + - log.from + - log.to + - log.inboundIf + - log.outboundIf + - log.logset + - log.futureUse + - log.sessionid + - log.repeatcnt + - log.spt + - log.dpt + - log.natspt + - log.natdpt + - log.flags + - log.proto + - log.act + - log.misc + - log.paThreatid + - log.category + - log.severityLabel + - log.direction + - log.seqno + - log.actionflags + - log.srcloc + - log.dstloc + - log.futureUse + - log.contenttype + - log.pcapId + - log.filedigest + - log.cloud + - log.urlIdx + - log.userAgent + - log.filetype + - log.xff + - log.referer + - log.sender + - log.subject + - log.recipient + - log.reportid + - log.dgHierLevel1 + - log.dgHierLevel2 + - log.dgHierLevel3 + - log.dgHierLevel4 + - log.vsysName + - log.deviceName + - log.futureUse + - log.srcUuid + - log.dstUuid + - log.httpMethod + - log.tunnelidImsi + - log.monitortagImei + - log.parentSessionId + - log.parentStartTime + - log.tunnel + - log.thrCategory + - log.contentver + - log.futureUse + - log.assocId + - log.ppid + - log.httpHeaders + - log.urlCategoryList + - log.ruleUuid + - log.http2Connection + - log.dynusergroupName + - log.xffIp + - log.srcCategory + - log.srcProfile + - log.srcModel + - log.srcVendor + - log.srcOsfamily + - log.srcOsversion + - log.srcHost + - log.srcMac + - log.dstCategory + - log.dstProfile + - log.dstModel + - log.dstVendor + - log.dstOsfamily + - log.dstOsversion + - log.dstHost + - log.dstMac + - log.containerId + - log.podNamespace + - log.podName + - log.srcEdl + - log.dstEdl + - log.hostid + - log.serialnumber + - log.domainEdl + - log.srcDag + - log.dstDag + - log.partialHash + - log.highResTimestamp + - log.reason + - log.justification + - log.nssaiSst + - log.subcategoryOfApp + - log.categoryOfApp + - log.technologyOfApp + - log.riskOfApp + - log.characteristicOfApp + - log.containerOfApp + - log.tunneledApp + - log.isSaasOfApp + - log.sanctionedStateOfApp + - log.cloudReportid + - log.clusterName + - log.flowType + where: 'equals("log.paFormat", "CSV") && regexMatch("log.paPayload", "^[^,]*,[^,]*,[^,]*,THREAT,(?:data|dlp|dlp-non-file|file),") && regexMatch("log.paPayload", "^(?:(?:\"(?:[^\"]|\"\")*\"|[^,\"]*),){122}")' + - csv: + source: log.paPayload + separator: ',' + headers: + - log.futureUse + - log.receiveTime + - log.serial + - log.paType + - log.paSubtype + - log.futureUse + - log.timeGenerated + - log.src + - log.dst + - log.natsrc + - log.natdst + - log.rule + - log.srcuser + - log.dstuser + - log.app + - log.vsys + - log.from + - log.to + - log.inboundIf + - log.outboundIf + - log.logset + - log.futureUse + - log.sessionid + - log.repeatcnt + - log.spt + - log.dpt + - log.natspt + - log.natdpt + - log.flags + - log.proto + - log.act + - log.misc + - log.paThreatid + - log.category + - log.severityLabel + - log.direction + - log.seqno + - log.actionflags + - log.srcloc + - log.dstloc + - log.futureUse + - log.contenttype + - log.pcapId + - log.filedigest + - log.cloud + - log.urlIdx + - log.userAgent + - log.filetype + - log.xff + - log.referer + - log.sender + - log.subject + - log.recipient + - log.reportid + - log.dgHierLevel1 + - log.dgHierLevel2 + - log.dgHierLevel3 + - log.dgHierLevel4 + - log.vsysName + - log.deviceName + - log.futureUse + - log.srcUuid + - log.dstUuid + - log.httpMethod + - log.tunnelidImsi + - log.monitortagImei + - log.parentSessionId + - log.parentStartTime + - log.tunnel + - log.thrCategory + - log.contentver + - log.futureUse + - log.assocId + - log.ppid + - log.httpHeaders + - log.paURLTail0 + - log.paURLTail1 + - log.paURLTail2 + - log.paURLTail3 + - log.paURLTail4 + - log.paURLTail5 + - log.paURLTail6 + - log.paURLTail7 + - log.paURLTail8 + - log.paURLTail9 + - log.paURLTail10 + - log.paURLTail11 + - log.paURLTail12 + - log.paURLTail13 + - log.paURLTail14 + - log.paURLTail15 + - log.paURLTail16 + - log.paURLTail17 + - log.paURLTail18 + - log.paURLTail19 + - log.paURLTail20 + - log.paURLTail21 + - log.paURLTail22 + - log.paURLTail23 + - log.paURLTail24 + - log.paURLTail25 + - log.paURLTail26 + - log.paURLTail27 + - log.paURLTail28 + - log.paURLTail29 + - log.paURLTail30 + where: 'equals("log.paFormat", "CSV") && regexMatch("log.paPayload", "^[^,]*,[^,]*,[^,]*,THREAT,url,")' + - csv: + source: log.paPayload + separator: ',' + headers: + - log.futureUse + - log.receiveTime + - log.serial + - log.paType + - log.paSubtype + - log.futureUse + - log.timeGenerated + - log.src + - log.dst + - log.natsrc + - log.natdst + - log.rule + - log.srcuser + - log.dstuser + - log.app + - log.vsys + - log.from + - log.to + - log.inboundIf + - log.outboundIf + - log.logset + - log.futureUse + - log.sessionid + - log.repeatcnt + - log.spt + - log.dpt + - log.natspt + - log.natdpt + - log.flags + - log.proto + - log.act + - log.misc + - log.paThreatid + - log.category + - log.severityLabel + - log.direction + - log.seqno + - log.actionflags + - log.srcloc + - log.dstloc + - log.futureUse + - log.contenttype + - log.pcapId + - log.filedigest + - log.cloud + - log.urlIdx + - log.userAgent + - log.filetype + - log.xff + - log.referer + - log.sender + - log.subject + - log.recipient + - log.reportid + - log.dgHierLevel1 + - log.dgHierLevel2 + - log.dgHierLevel3 + - log.dgHierLevel4 + - log.vsysName + - log.deviceName + - log.futureUse + - log.srcUuid + - log.dstUuid + - log.httpMethod + - log.tunnelidImsi + - log.monitortagImei + - log.parentSessionId + - log.parentStartTime + - log.tunnel + - log.thrCategory + - log.contentver + - log.futureUse + - log.assocId + - log.ppid + - log.httpHeaders + - log.paURLTail0 + - log.paURLTail1 + - log.paURLTail2 + - log.paURLTail3 + - log.paURLTail4 + - log.paURLTail5 + - log.paURLTail6 + - log.paURLTail7 + - log.paURLTail8 + - log.paURLTail9 + - log.paURLTail10 + - log.paURLTail11 + - log.paURLTail12 + - log.paURLTail13 + - log.paURLTail14 + - log.paURLTail15 + - log.paURLTail16 + - log.paURLTail17 + - log.paURLTail18 + - log.paURLTail19 + - log.paURLTail20 + - log.paURLTail21 + - log.paURLTail22 + - log.paURLTail23 + - log.paURLTail24 + - log.paURLTail25 + - log.paURLTail26 + - log.paURLTail27 + - log.paURLTail28 + - log.paURLTail29 + - log.paURLTail30 + - log.paURLTail31 + - log.paURLTail32 + - log.paURLTail33 + - log.paURLTail34 + - log.paURLTail35 + - log.paURLTail36 + - log.paURLTail37 + - log.paURLTail38 + - log.paURLTail39 + - log.paURLTail40 + - log.paURLTail41 + - log.paURLTail42 + - log.paURLTail43 + - log.paURLTail44 + - log.paURLTail45 + - log.paURLTail46 + - log.paURLTail47 + where: 'equals("log.paFormat", "CSV") && regexMatch("log.paPayload", "^[^,]*,[^,]*,[^,]*,THREAT,url,") && regexMatch("log.paPayload", "^(?:(?:\"(?:[^\"]|\"\")*\"|[^,\"]*),){122}")' + - csv: + source: log.paPayload + separator: ',' + headers: + - log.futureUse + - log.receiveTime + - log.serial + - log.paType + - log.paSubtype + - log.futureUse + - log.timeGenerated + - log.src + - log.dst + - log.natsrc + - log.natdst + - log.rule + - log.srcuser + - log.dstuser + - log.app + - log.vsys + - log.from + - log.to + - log.inboundIf + - log.outboundIf + - log.logset + - log.futureUse + - log.sessionid + - log.repeatcnt + - log.spt + - log.dpt + - log.natspt + - log.natdpt + - log.flags + - log.proto + - log.act + - log.misc + - log.paThreatid + - log.category + - log.severityLabel + - log.direction + - log.seqno + - log.actionflags + - log.srcloc + - log.dstloc + - log.futureUse + - log.contenttype + - log.pcapId + - log.filedigest + - log.cloud + - log.urlIdx + - log.userAgent + - log.filetype + - log.xff + - log.referer + - log.sender + - log.subject + - log.recipient + - log.reportid + - log.dgHierLevel1 + - log.dgHierLevel2 + - log.dgHierLevel3 + - log.dgHierLevel4 + - log.vsysName + - log.deviceName + - log.futureUse + - log.srcUuid + - log.dstUuid + - log.httpMethod + - log.tunnelidImsi + - log.monitortagImei + - log.parentSessionId + - log.parentStartTime + - log.tunnel + - log.thrCategory + - log.contentver + - log.futureUse + - log.assocId + - log.ppid + - log.httpHeaders + - log.paURLTail0 + - log.paURLTail1 + - log.paURLTail2 + - log.paURLTail3 + - log.paURLTail4 + - log.paURLTail5 + - log.paURLTail6 + - log.paURLTail7 + - log.paURLTail8 + - log.paURLTail9 + - log.paURLTail10 - log.paURLTail11 - log.paURLTail12 - log.paURLTail13 @@ -6744,7 +6710,42 @@ pipeline: - log.paURLTail47 - log.paURLTail48 - log.paURLTail49 - where: equals("log.paFormat", "CSV") && regexMatch("log.paPayload", "^[^,]*,[^,]*,[^,]*,THREAT,url,") + where: 'equals("log.paFormat", "CSV") && regexMatch("log.paPayload", "^[^,]*,[^,]*,[^,]*,THREAT,url,") && regexMatch("log.paPayload", "^(?:(?:\"(?:[^\"]|\"\")*\"|[^,\"]*),){124}")' + - csv: + source: log.paPayload + separator: ',' + headers: + - log.futureUse + - log.receiveTime + - log.serial + - log.paType + - log.paSubtype + - log.futureUse + - log.timeGenerated + - log.srcuser + - log.vsys + - log.machinename + - log.os + - log.src + - log.matchname + - log.repeatcnt + - log.matchtype + - log.futureUse + - log.futureUse + - log.seqno + - log.actionflags + - log.dgHierLevel1 + - log.dgHierLevel2 + - log.dgHierLevel3 + - log.dgHierLevel4 + - log.vsysName + - log.deviceName + - log.vsysId + - log.srcipv6 + - log.hostid + - log.serialnumber + - log.mac + where: 'equals("log.paFormat", "CSV") && regexMatch("log.paPayload", "^[^,]*,[^,]*,[^,]*,HIP-MATCH,")' - csv: source: log.paPayload separator: ',' @@ -6781,7 +6782,41 @@ pipeline: - log.mac - log.highResTimestamp - log.clusterName - where: equals("log.paFormat", "CSV") && regexMatch("log.paPayload", "^[^,]*,[^,]*,[^,]*,HIP-MATCH,") + where: 'equals("log.paFormat", "CSV") && regexMatch("log.paPayload", "^[^,]*,[^,]*,[^,]*,HIP-MATCH,") && regexMatch("log.paPayload", "^(?:(?:\"(?:[^\"]|\"\")*\"|[^,\"]*),){31}")' + - csv: + source: log.paPayload + separator: ',' + headers: + - log.futureUse + - log.receiveTime + - log.serial + - log.paType + - log.paSubtype + - log.futureUse + - log.timeGenerated + - log.vsys + - log.eventid + - log.stage + - log.authMethod + - log.tunnelType + - log.srcuser + - log.srcregion + - log.machinename + - log.publicIp + - log.publicIpv6 + - log.privateIp + - log.privateIpv6 + - log.hostid + - log.serialnumber + - log.clientVer + - log.clientOs + - log.clientOsVer + - log.repeatcnt + - log.reason + - log.error + - log.opaque + - log.status + where: 'equals("log.paFormat", "CSV") && regexMatch("log.paPayload", "^[^,]*,[^,]*,[^,]*,GLOBALPROTECT,")' - csv: source: log.paPayload separator: ',' @@ -6836,7 +6871,23 @@ pipeline: - log.deviceName - log.vsysId - log.clusterName - where: equals("log.paFormat", "CSV") && regexMatch("log.paPayload", "^[^,]*,[^,]*,[^,]*,GLOBALPROTECT,") + where: 'equals("log.paFormat", "CSV") && regexMatch("log.paPayload", "^[^,]*,[^,]*,[^,]*,GLOBALPROTECT,") && regexMatch("log.paPayload", "^(?:(?:\"(?:[^\"]|\"\")*\"|[^,\"]*),){49}")' + - csv: + source: log.paPayload + separator: ',' + headers: + - log.futureUse + - log.receiveTime + - log.serial + - log.paType + - log.paSubtype + - log.futureUse + - log.timeGenerated + - log.vsys + - log.src + - log.tagName + - log.eventid + where: 'equals("log.paFormat", "CSV") && regexMatch("log.paPayload", "^[^,]*,[^,]*,[^,]*,IPTAG,")' - csv: source: log.paPayload separator: ',' @@ -6868,7 +6919,46 @@ pipeline: - log.vsysId - log.highResTimestamp - log.clusterName - where: equals("log.paFormat", "CSV") && regexMatch("log.paPayload", "^[^,]*,[^,]*,[^,]*,IPTAG,") + where: 'equals("log.paFormat", "CSV") && regexMatch("log.paPayload", "^[^,]*,[^,]*,[^,]*,IPTAG,") && regexMatch("log.paPayload", "^(?:(?:\"(?:[^\"]|\"\")*\"|[^,\"]*),){26}")' + - csv: + source: log.paPayload + separator: ',' + headers: + - log.futureUse + - log.receiveTime + - log.serial + - log.paType + - log.paSubtype + - log.futureUse + - log.timeGenerated + - log.vsys + - log.src + - log.user + - log.datasourcename + - log.eventid + - log.repeatcnt + - log.timeout + - log.beginport + - log.endport + - log.datasource + - log.datasourceType + - log.seqno + - log.actionflags + - log.dgHierLevel1 + - log.dgHierLevel2 + - log.dgHierLevel3 + - log.dgHierLevel4 + - log.vsysName + - log.deviceName + - log.vsysId + - log.factortype + - log.factorcompletiontime + - log.factorno + - log.ugflags + - log.userbysource + - log.tagName + - log.highResTimestamp + where: 'equals("log.paFormat", "CSV") && regexMatch("log.paPayload", "^[^,]*,[^,]*,[^,]*,USERID,")' - csv: source: log.paPayload separator: ',' @@ -6910,7 +7000,43 @@ pipeline: - log.originDataSource - log.futureUse - log.clusterName - where: equals("log.paFormat", "CSV") && regexMatch("log.paPayload", "^[^,]*,[^,]*,[^,]*,USERID,") + where: 'equals("log.paFormat", "CSV") && regexMatch("log.paPayload", "^[^,]*,[^,]*,[^,]*,USERID,") && regexMatch("log.paPayload", "^(?:(?:\"(?:[^\"]|\"\")*\"|[^,\"]*),){36}")' + - csv: + source: log.paPayload + separator: ',' + headers: + - log.futureUse + - log.receiveTime + - log.serial + - log.paType + - log.paSubtype + - log.configVer + - log.timeGenerated + - log.src + - log.dst + - log.natsrc + - log.natdst + - log.rule + - log.srcuser + - log.dstuser + - log.app + - log.vsys + - log.from + - log.to + - log.inboundIf + - log.outboundIf + - log.logset + - log.timeReceived + - log.sessionid + - log.repeatcnt + - log.spt + - log.dpt + - log.natspt + - log.natdpt + - log.flags + - log.proto + - log.act + where: 'equals("log.paFormat", "CSV") && regexMatch("log.paPayload", "^[^,]*,[^,]*,[^,]*,DECRYPTION,")' - csv: source: log.paPayload separator: ',' @@ -7022,7 +7148,62 @@ pipeline: - log.isSaasOfApp - log.sanctionedStateOfApp - log.clusterName - where: equals("log.paFormat", "CSV") && regexMatch("log.paPayload", "^[^,]*,[^,]*,[^,]*,DECRYPTION,") + where: 'equals("log.paFormat", "CSV") && regexMatch("log.paPayload", "^[^,]*,[^,]*,[^,]*,DECRYPTION,") && regexMatch("log.paPayload", "^(?:(?:\"(?:[^\"]|\"\")*\"|[^,\"]*),){106}")' + - csv: + source: log.paPayload + separator: ',' + headers: + - log.futureUse + - log.receiveTime + - log.serial + - log.paType + - log.paSubtype + - log.futureUse + - log.timeGenerated + - log.src + - log.dst + - log.natsrc + - log.natdst + - log.rule + - log.srcuser + - log.dstuser + - log.app + - log.vsys + - log.from + - log.to + - log.inboundIf + - log.outboundIf + - log.logset + - log.futureUse + - log.sessionid + - log.repeatcnt + - log.spt + - log.dpt + - log.natspt + - log.natdpt + - log.flags + - log.proto + - log.act + - log.severityLabel + - log.seqno + - log.actionflags + - log.srcloc + - log.dstloc + - log.dgHierLevel1 + - log.dgHierLevel2 + - log.dgHierLevel3 + - log.dgHierLevel4 + - log.vsysName + - log.deviceName + - log.tunnelid + - log.monitortag + - log.parentSessionId + - log.parentStartTime + - log.tunnel + - log.bytes + - log.bytesSent + - log.bytesReceived + where: 'equals("log.paFormat", "CSV") && regexMatch("log.paPayload", "^[^,]*,[^,]*,[^,]*,(?:TUNNEL|START|END),")' - csv: source: log.paPayload separator: ',' @@ -7111,7 +7292,44 @@ pipeline: - log.isSaasOfApp - log.sanctionedStateOfApp - log.clusterName - where: equals("log.paFormat", "CSV") && regexMatch("log.paPayload", "^[^,]*,[^,]*,[^,]*,(?:TUNNEL|START|END),") + where: 'equals("log.paFormat", "CSV") && regexMatch("log.paPayload", "^[^,]*,[^,]*,[^,]*,(?:TUNNEL|START|END),") && regexMatch("log.paPayload", "^(?:(?:\"(?:[^\"]|\"\")*\"|[^,\"]*),){83}")' + - csv: + source: log.paPayload + separator: ',' + headers: + - log.futureUse + - log.receiveTime + - log.serial + - log.paType + - log.futureUse + - log.futureUse + - log.timeGenerated + - log.src + - log.dst + - log.futureUse + - log.futureUse + - log.rule + - log.futureUse + - log.futureUse + - log.futureUse + - log.vsys + - log.from + - log.to + - log.inboundIf + - log.outboundIf + - log.logset + - log.futureUse + - log.sessionid + - log.repeatcnt + - log.spt + - log.dpt + - log.futureUse + - log.futureUse + - log.futureUse + - log.futureUse + - log.proto + - log.act + where: 'equals("log.paFormat", "CSV") && regexMatch("log.paPayload", "^[^,]*,[^,]*,[^,]*,SCTP,")' - csv: source: log.paPayload separator: ',' @@ -7181,7 +7399,38 @@ pipeline: - log.pktsReceived - log.ruleUuid - log.highResTimestamp - where: equals("log.paFormat", "CSV") && regexMatch("log.paPayload", "^[^,]*,[^,]*,[^,]*,SCTP,") + where: 'equals("log.paFormat", "CSV") && regexMatch("log.paPayload", "^[^,]*,[^,]*,[^,]*,SCTP,") && regexMatch("log.paPayload", "^(?:(?:\"(?:[^\"]|\"\")*\"|[^,\"]*),){64}")' + - csv: + source: log.paPayload + separator: ',' + headers: + - log.futureUse + - log.receiveTime + - log.serial + - log.paType + - log.paSubtype + - log.futureUse + - log.timeGenerated + - log.host + - log.vsys + - log.cmd + - log.admin + - log.client + - log.result + - log.path + - log.paConfigTail0 + - log.paConfigTail1 + - log.paConfigTail2 + - log.paConfigTail3 + - log.paConfigTail4 + - log.paConfigTail5 + - log.paConfigTail6 + - log.paConfigTail7 + - log.paConfigTail8 + - log.paConfigTail9 + - log.paConfigTail10 + - log.paConfigTail11 + where: 'equals("log.paFormat", "CSV") && regexMatch("log.paPayload", "^[^,]*,[^,]*,[^,]*,CONFIG,")' - csv: source: log.paPayload separator: ',' @@ -7214,7 +7463,58 @@ pipeline: - log.paConfigTail11 - log.paConfigTail12 - log.paConfigTail13 - where: equals("log.paFormat", "CSV") && regexMatch("log.paPayload", "^[^,]*,[^,]*,[^,]*,CONFIG,") + where: 'equals("log.paFormat", "CSV") && regexMatch("log.paPayload", "^[^,]*,[^,]*,[^,]*,CONFIG,") && regexMatch("log.paPayload", "^(?:(?:\"(?:[^\"]|\"\")*\"|[^,\"]*),){27}")' + - csv: + source: log.paPayload + separator: ',' + headers: + - log.futureUse + - log.receiveTime + - log.serial + - log.paType + - log.paSubtype + - log.futureUse + - log.timeGenerated + - log.vsys + - log.src + - log.user + - log.normalizeUser + - log.object + - log.authpolicy + - log.repeatcnt + - log.authid + - log.vendor + - log.logset + - log.serverprofile + - log.desc + - log.clienttype + - log.event + - log.factorno + - log.seqno + - log.actionflags + - log.dgHierLevel1 + - log.dgHierLevel2 + - log.dgHierLevel3 + - log.dgHierLevel4 + - log.vsysName + - log.deviceName + - log.vsysId + - log.authproto + - log.ruleUuid + - log.highResTimestamp + - log.srcCategory + - log.srcProfile + - log.srcModel + - log.srcVendor + - log.srcOsfamily + - log.srcOsversion + - log.srcHost + - log.srcMac + - log.region + - log.futureUse + - log.userAgent + - log.sessionid + where: 'equals("log.paFormat", "CSV") && regexMatch("log.paPayload", "^[^,]*,[^,]*,[^,]*,AUTHENTICATION,")' - csv: source: log.paPayload separator: ',' @@ -7266,7 +7566,7 @@ pipeline: - log.userAgent - log.sessionid - log.clusterName - where: equals("log.paFormat", "CSV") && regexMatch("log.paPayload", "^[^,]*,[^,]*,[^,]*,AUTHENTICATION,") + where: 'equals("log.paFormat", "CSV") && regexMatch("log.paPayload", "^[^,]*,[^,]*,[^,]*,AUTHENTICATION,") && regexMatch("log.paPayload", "^(?:(?:\"(?:[^\"]|\"\")*\"|[^,\"]*),){46}")' - csv: source: log.paPayload separator: ',' @@ -7297,7 +7597,24 @@ pipeline: - log.futureUse - log.futureUse - log.highResTimestamp - where: equals("log.paFormat", "CSV") && regexMatch("log.paPayload", "^[^,]*,[^,]*,[^,]*,SYSTEM,") + where: 'equals("log.paFormat", "CSV") && regexMatch("log.paPayload", "^[^,]*,[^,]*,[^,]*,SYSTEM,")' + - csv: + source: log.paPayload + separator: ',' + headers: + - log.futureUse + - log.receiveTime + - log.serial + - log.paType + - log.paSubtype + - log.futureUse + - log.timeGenerated + - log.src + - log.srcuser + - log.vsys + - log.category + - log.severityLabel + where: 'equals("log.paFormat", "CSV") && regexMatch("log.paPayload", "^[^,]*,[^,]*,[^,]*,CORRELATION,")' - csv: source: log.paPayload separator: ',' @@ -7324,7 +7641,44 @@ pipeline: - log.objectname - log.objectId - log.evidence - where: equals("log.paFormat", "CSV") && regexMatch("log.paPayload", "^[^,]*,[^,]*,[^,]*,CORRELATION,") + where: 'equals("log.paFormat", "CSV") && regexMatch("log.paPayload", "^[^,]*,[^,]*,[^,]*,CORRELATION,") && regexMatch("log.paPayload", "^(?:(?:\"(?:[^\"]|\"\")*\"|[^,\"]*),){21}")' + - csv: + source: log.paPayload + separator: ',' + headers: + - log.futureUse + - log.receiveTime + - log.serial + - log.paType + - log.paSubtype + - log.futureUse + - log.timeGenerated + - log.src + - log.dst + - log.futureUse + - log.futureUse + - log.rule + - log.futureUse + - log.futureUse + - log.app + - log.vsys + - log.from + - log.to + - log.inboundIf + - log.outboundIf + - log.logset + - log.futureUse + - log.sessionid + - log.futureUse + - log.spt + - log.dpt + - log.futureUse + - log.futureUse + - log.futureUse + - log.proto + - log.act + - log.eventType + where: 'equals("log.paFormat", "CSV") && regexMatch("log.paPayload", "^[^,]*,[^,]*,[^,]*,GTP,")' - csv: source: log.paPayload separator: ',' @@ -7423,7 +7777,7 @@ pipeline: - log.containerOfApp - log.saasOfApp - log.sanctionedStateOfApp - where: equals("log.paFormat", "CSV") && regexMatch("log.paPayload", "^[^,]*,[^,]*,[^,]*,GTP,") + where: 'equals("log.paFormat", "CSV") && regexMatch("log.paPayload", "^[^,]*,[^,]*,[^,]*,GTP,") && regexMatch("log.paPayload", "^(?:(?:\"(?:[^\"]|\"\")*\"|[^,\"]*),){93}")' - csv: source: log.paPayload separator: ',' @@ -7553,8 +7907,7 @@ pipeline: - log.cloudReportid - log.clusterName - log.flowType - where: equals("log.paFormat", "CSV") && equals("log.paType", "THREAT") && equals("log.paSubtype", "url") - && regexMatch("log.paURLTail1", "^[1-5][0-9]{2}$") && regexMatch("log.paURLTail34", "^\\d{4}-\\d{2}-\\d{2}T\\d{2}:\\d{2}:\\d{2}(?:\\.\\d+)?(?:Z|[+-]\\d{2}:\\d{2})$") + where: 'equals("log.paFormat", "CSV") && equals("log.paType", "THREAT") && equals("log.paSubtype", "url") && regexMatch("log.paURLTail1", "^[1-5][0-9]{2}$") && regexMatch("log.paURLTail34", "^\\d{4}-\\d{2}-\\d{2}T\\d{2}:\\d{2}:\\d{2}(?:\\.\\d+)?(?:Z|[+-]\\d{2}:\\d{2})$")' - csv: source: log.paPayload separator: ',' @@ -7682,10 +8035,7 @@ pipeline: - log.cloudReportid - log.paURLLegacyTail1 - log.paURLLegacyTail2 - where: equals("log.paFormat", "CSV") && equals("log.paType", "THREAT") && equals("log.paSubtype", "url") - && !(equals("log.paFormat", "CSV") && equals("log.paType", "THREAT") && equals("log.paSubtype", "url") - && regexMatch("log.paURLTail1", "^[1-5][0-9]{2}$") && regexMatch("log.paURLTail34", "^\\d{4}-\\d{2}-\\d{2}T\\d{2}:\\d{2}:\\d{2}(?:\\.\\d+)?(?:Z|[+-]\\d{2}:\\d{2})$")) - && regexMatch("log.paURLTail32", "^\\d{4}-\\d{2}-\\d{2}T\\d{2}:\\d{2}:\\d{2}(?:\\.\\d+)?(?:Z|[+-]\\d{2}:\\d{2})$") + where: 'equals("log.paFormat", "CSV") && equals("log.paType", "THREAT") && equals("log.paSubtype", "url") && !(equals("log.paFormat", "CSV") && equals("log.paType", "THREAT") && equals("log.paSubtype", "url") && regexMatch("log.paURLTail1", "^[1-5][0-9]{2}$") && regexMatch("log.paURLTail34", "^\\d{4}-\\d{2}-\\d{2}T\\d{2}:\\d{2}:\\d{2}(?:\\.\\d+)?(?:Z|[+-]\\d{2}:\\d{2})$")) && regexMatch("log.paURLTail32", "^\\d{4}-\\d{2}-\\d{2}T\\d{2}:\\d{2}:\\d{2}(?:\\.\\d+)?(?:Z|[+-]\\d{2}:\\d{2})$")' - add: function: string params: @@ -7734,8 +8084,7 @@ pipeline: - log.comment - log.futureUse - log.highResTimestamp - where: equals("log.paFormat", "CSV") && equals("log.paType", "CONFIG") && regexMatch("log.paConfigTail13", - "^\\d{4}-\\d{2}-\\d{2}T\\d{2}:\\d{2}:\\d{2}(?:\\.\\d+)?(?:Z|[+-]\\d{2}:\\d{2})$") + where: 'equals("log.paFormat", "CSV") && equals("log.paType", "CONFIG") && regexMatch("log.paConfigTail13", "^\\d{4}-\\d{2}-\\d{2}T\\d{2}:\\d{2}:\\d{2}(?:\\.\\d+)?(?:Z|[+-]\\d{2}:\\d{2})$")' - csv: source: log.paPayload separator: ',' @@ -7766,9 +8115,7 @@ pipeline: - log.comment - log.futureUse - log.highResTimestamp - where: equals("log.paFormat", "CSV") && equals("log.paType", "CONFIG") && !(equals("log.paFormat", "CSV") - && equals("log.paType", "CONFIG") && regexMatch("log.paConfigTail13", "^\\d{4}-\\d{2}-\\d{2}T\\d{2}:\\d{2}:\\d{2}(?:\\.\\d+)?(?:Z|[+-]\\d{2}:\\d{2})$")) - && regexMatch("log.paConfigTail11", "^\\d{4}-\\d{2}-\\d{2}T\\d{2}:\\d{2}:\\d{2}(?:\\.\\d+)?(?:Z|[+-]\\d{2}:\\d{2})$") + where: 'equals("log.paFormat", "CSV") && equals("log.paType", "CONFIG") && !(equals("log.paFormat", "CSV") && equals("log.paType", "CONFIG") && regexMatch("log.paConfigTail13", "^\\d{4}-\\d{2}-\\d{2}T\\d{2}:\\d{2}:\\d{2}(?:\\.\\d+)?(?:Z|[+-]\\d{2}:\\d{2})$")) && regexMatch("log.paConfigTail11", "^\\d{4}-\\d{2}-\\d{2}T\\d{2}:\\d{2}:\\d{2}(?:\\.\\d+)?(?:Z|[+-]\\d{2}:\\d{2})$")' - add: function: string params: @@ -8408,7 +8755,7 @@ pipeline: - fieldName: log.paAuthMiddle pattern: '''\. .*? From: ' - fieldName: log.paAuthIP - pattern: '[0-9A-Fa-f:.]+' + pattern: '[0-9A-Fa-f:.]*[0-9A-Fa-f:]' - fieldName: log.paAuthSuffix pattern: \.$ where: equals("log.paType", "SYSTEM") && oneOf("log.eventid", ["auth-fail", "auth-success"]) diff --git a/plugins/alerts/paloalto_contract_test.go b/plugins/alerts/paloalto_contract_test.go index a88ce4dee..9e7427d6e 100644 --- a/plugins/alerts/paloalto_contract_test.go +++ b/plugins/alerts/paloalto_contract_test.go @@ -1,26 +1,32 @@ package main -// Offline Palo Alto extraction model, not the closed EventProcessor. -// Explicit YAML grok/CSV/rename/cast/trim/add/delete operations are -// modeled. Every field name a step writes is cleaned like the EventProcessor -// parser plugins clean it. CEL, Event serialization, placeholder expansion, -// query creation and history thresholds use SDK v1.1.33. External geolocation -// is not executed. +// Offline Palo Alto extraction model, not the EventProcessor itself. The grok, +// csv, add, cast, delete and trim steps copy the behaviour of the parser plugins +// of EventProcessor 8a3ade72bd9d12db21f6b273200588fb49540f14, including their +// failures: grok matches each pattern on its own at the start of the remaining +// text and writes nothing unless every pattern matched; csv fails when a line has +// fewer columns than the step has headers. As in the engine, a failed step or +// where clause records an error on the event and the pipeline continues without +// that step's output. Every field name a step writes is cleaned like the plugins +// clean it. CEL, Event serialization, placeholder expansion, query creation and +// history thresholds use the linked SDK. External geolocation is not executed. import ( "bytes" "encoding/csv" "encoding/json" + "errors" "fmt" - "io" "net" "os" "path/filepath" "reflect" "regexp" + "strconv" "strings" "testing" "text/template" "time" + "unicode/utf8" "github.com/threatwinds/go-sdk/plugins" "github.com/threatwinds/go-sdk/utils" @@ -99,37 +105,145 @@ func paloaltoConfig(t *testing.T) *plugins.Config { } return c } -func paloaltoRegex(t *testing.T, g *plugins.Grok, cfg *plugins.Config) *regexp.Regexp { - t.Helper() - var pattern strings.Builder - for i, p := range g.Patterns { - if p.FieldName != "" { - fmt.Fprintf(&pattern, "(?P%s)", i, p.Pattern) - } else { - pattern.WriteString("(?:" + p.Pattern + ")") + +// paloaltoCompile compiles one pattern the way the SDK RegexpCache does: "{{...}}" +// templates are expanded from the configured shared patterns, then the pattern is +// compiled unanchored. +func paloaltoCompile(cfg *plugins.Config, pattern string) (*regexp.Regexp, error) { + for i := 0; i < 10 && strings.Contains(pattern, "{{") && len(cfg.Patterns) > 0; i++ { + tmpl, err := template.New("pattern").Parse(pattern) + if err != nil { + break + } + var b bytes.Buffer + if err = tmpl.Execute(&b, cfg.Patterns); err != nil || b.String() == pattern { + break } + pattern = b.String() } - pats := map[string]string{"greedy": ".*", "data": ".*?", "word": "[A-Za-z0-9_-]+", "space": "\\s+"} - for k, v := range cfg.Patterns { - pats[k] = v + return regexp.Compile(pattern) +} + +// paloaltoText renders a draft value as gjson's Result.String() does for the plugins. +func paloaltoText(v any) string { + switch x := v.(type) { + case nil: + return "" + case string: + return x + default: + b, _ := json.Marshal(x) + return string(b) } - tmpl, e := template.New("grok").Option("missingkey=error").Parse(pattern.String()) - if e != nil { - t.Fatal(e) +} + +type paloaltoWrite struct { + name string + value any +} + +// paloaltoGrok follows the grok plugin: before each pattern the remaining text is +// trimmed; the pattern's leftmost match must be non-empty and must start the +// remaining text; the trimmed match is kept and removed from the text. Nothing is +// written unless every pattern matched. +func paloaltoGrok(cfg *plugins.Config, g *plugins.Grok, draft map[string]any) ([]paloaltoWrite, error) { + src := g.Source + if src == "" { + src = "raw" } - var b bytes.Buffer - if e = tmpl.Execute(&b, pats); e != nil { - t.Fatal(e) + v, ok := paloaltoGet(draft, src) + if !ok { + return nil, nil } - r, e := regexp.Compile(b.String()) - if e != nil { - t.Fatal(e) + text := paloaltoText(v) + var out []paloaltoWrite + matched := 0 + for _, p := range g.Patterns { + text = strings.TrimSpace(text) + if utf8.RuneCountInString(text) == 0 { + break + } + r, err := paloaltoCompile(cfg, p.Pattern) + if err != nil { + return nil, fmt.Errorf("failed to compile regexp: %w", err) + } + match := r.FindString(text) + if match == "" || !strings.HasPrefix(text, match) { + break + } + name := p.FieldName + utils.SanitizeField(&name) + if err = utils.ValidateReservedField(name, true); err != nil { + return nil, err + } + matched++ + if name != "" { + out = append(out, paloaltoWrite{name, strings.TrimSpace(match)}) + } + text = strings.TrimPrefix(text, match) + } + if matched != len(g.Patterns) { + return nil, nil + } + return out, nil +} + +// paloaltoCSV follows the csv plugin: the source is read with Go's csv reader +// (strict quotes), and a record with fewer columns than there are headers fails +// the whole step, which then writes nothing. Values are trimmed. +func paloaltoCSV(c *plugins.Csv, draft map[string]any) ([]paloaltoWrite, error) { + text := "" + if v, ok := paloaltoGet(draft, c.Source); ok { + text = paloaltoText(v) + } + reader := csv.NewReader(strings.NewReader(text)) + separator := c.Separator + if utf8.RuneCountInString(separator) > 1 { + return nil, errors.New("separator should be a single character") + } + if separator == "" { + separator = "," } - return r + for _, r := range separator { + reader.Comma = r + break + } + records, err := reader.ReadAll() + if err != nil { + return nil, fmt.Errorf("failed to parse log: %w", err) + } + var out []paloaltoWrite + for _, record := range records { + for i, header := range c.Headers { + if i >= len(record) { + return nil, errors.New("column index out of range, number of headers should match the number of resulting columns") + } + utils.SanitizeField(&header) + if header == "" { + continue + } + if err = utils.ValidateReservedField(header, false); err != nil { + return nil, err + } + out = append(out, paloaltoWrite{header, strings.TrimSpace(record[i])}) + } + } + return out, nil } func paloaltoParse(t *testing.T, cfg *plugins.Config, raw string, dataSource string, cache *plugins.CELCache) string { t.Helper() draft := map[string]any{"raw": raw, "dataType": "firewall-paloalto", "dataSource": dataSource, "log": map[string]any{}} + var stepErrors []string + // A failed step records its error and the pipeline continues without its output. + apply := func(kind string, writes []paloaltoWrite, err error) { + if err != nil { + stepErrors = append(stepErrors, fmt.Sprintf("failed to parse log during pipeline execution (%s): %v", kind, err)) + return + } + for _, w := range writes { + paloaltoPut(draft, w.name, w.value, false) + } + } for _, stage := range cfg.Pipeline { matched := false for _, dataType := range stage.DataTypes { @@ -155,9 +269,11 @@ func paloaltoParse(t *testing.T, cfg *plugins.Config, raw string, dataSource str if err != nil { t.Fatal(err) } - match, e := cache.Eval(w, string(snapshot)) + text := string(snapshot) + match, e := cache.Evaluate(&text, w) if e != nil { - t.Fatal(e) + stepErrors = append(stepErrors, "failed to evaluate where clause using CEL: "+e.Error()) + continue } if !match { continue @@ -165,57 +281,11 @@ func paloaltoParse(t *testing.T, cfg *plugins.Config, raw string, dataSource str } switch kind { case "grok": - g := s.Grok - src := g.Source - if src == "" { - src = "raw" - } - v, ok := paloaltoGet(draft, src) - if !ok { - continue - } - str, ok := v.(string) - if !ok { - t.Fatalf("non-string grok source %s", src) - } - r := paloaltoRegex(t, g, cfg) - m := r.FindStringSubmatch(str) - if m == nil { - continue - } - for i, p := range g.Patterns { - if p.FieldName == "" { - continue - } - // A name made only of removed characters is not stored. - if name := paloaltoWriteName(t, p.FieldName, true); name != "" { - paloaltoPut(draft, name, m[r.SubexpIndex(fmt.Sprintf("f%d", i))], false) - } - } + writes, err := paloaltoGrok(cfg, s.Grok, draft) + apply(kind, writes, err) case "csv": - v, ok := paloaltoGet(draft, s.Csv.Source) - if !ok { - continue - } - reader := csv.NewReader(strings.NewReader(fmt.Sprint(v))) - reader.FieldsPerRecord = -1 - reader.Comma = []rune(s.Csv.Separator)[0] - record, err := reader.Read() - if err != nil { - t.Fatalf("CSV: %v", err) - } - if _, err = reader.Read(); err != io.EOF { - t.Fatalf("multiple CSV records: %v", err) - } - for i, field := range s.Csv.Headers { - if i >= len(record) { - continue - } - // The CSV plugin skips a header that cleans to nothing. - if name := paloaltoWriteName(t, field, true); name != "" { - paloaltoPut(draft, name, record[i], false) - } - } + writes, err := paloaltoCSV(s.Csv, draft) + apply(kind, writes, err) case "rename": for _, p := range s.Rename.From { if v, ok := paloaltoGet(draft, p); ok { @@ -225,28 +295,43 @@ func paloaltoParse(t *testing.T, cfg *plugins.Config, raw string, dataSource str } } case "trim": + // The trim plugin skips absent or empty values, trims spaces and stores text. for _, p := range s.Trim.Fields { - if v, ok := paloaltoGet(draft, p); ok { - str, ok := v.(string) - if !ok { + v, ok := paloaltoGet(draft, p) + if !ok || paloaltoText(v) == "" { + continue + } + str := strings.TrimSpace(paloaltoText(v)) + switch s.Trim.Function { + case "prefix": + str = strings.TrimPrefix(str, s.Trim.Substring) + case "suffix": + str = strings.TrimSuffix(str, s.Trim.Substring) + case "substring": + str = strings.ReplaceAll(str, s.Trim.Substring, "") + case "regex": + r, err := paloaltoCompile(cfg, s.Trim.Substring) + if err != nil { + t.Fatalf("trim regex %s: %v", s.Trim.Substring, err) + } + found := r.FindAllString(str, -1) + if len(found) == 0 { continue } - switch s.Trim.Function { - case "prefix": - str = strings.TrimPrefix(str, s.Trim.Substring) - case "suffix": - str = strings.TrimSuffix(str, s.Trim.Substring) - default: - t.Fatalf("unsupported trim %s", s.Trim.Function) + for _, m := range found { + str = strings.ReplaceAll(str, m, "") } - paloaltoPut(draft, p, str, false) + default: + t.Fatalf("unsupported trim %s", s.Trim.Function) } + paloaltoPut(draft, p, strings.TrimSpace(str), false) } case "add": if s.Add.Function != "string" { t.Fatalf("unsupported add function %s", s.Add.Function) } - paloaltoPut(draft, paloaltoWriteName(t, s.Add.Params["key"].GetStringValue(), false), s.Add.Params["value"].AsInterface(), false) + // The add plugin writes the parameter's string value. + paloaltoPut(draft, paloaltoWriteName(t, s.Add.Params["key"].GetStringValue(), false), s.Add.Params["value"].GetStringValue(), false) case "delete": for _, p := range s.Delete.Fields { paloaltoPut(draft, p, nil, true) @@ -334,6 +419,9 @@ func paloaltoParse(t *testing.T, cfg *plugins.Config, raw string, dataSource str } } } + if len(stepErrors) > 0 { + draft["errors"] = stepErrors + } b, e := json.Marshal(draft) if e != nil { t.Fatal(e) @@ -416,6 +504,9 @@ func paloaltoCheck(t *testing.T, fixtures []paloaltoFixture) { for _, f := range fixtures { t.Run(f.Name, func(t *testing.T) { out := paloaltoParse(t, cfg, f.Raw, f.DataSource, cache) + if errs := gjson.Get(out, "errors"); errs.Exists() { + t.Errorf("parser errors: %s", errs.Raw) + } for field, want := range f.Expected { got := gjson.Get(out, field) if !got.Exists() || !reflect.DeepEqual(got.Value(), want) { @@ -506,3 +597,79 @@ func TestPaloAltoPrivateContracts(t *testing.T) { } paloaltoCheck(t, f) } + +// The model must fail where the parser plugins fail, or it hides real-engine defects. +func TestPaloAltoModelFollowsPlugins(t *testing.T) { + short := &plugins.Csv{Source: "log.line", Separator: ",", Headers: []string{"log.a", "log.b", "log.c"}} + for line, want := range map[string]int{"1,2": -1, "1,2,3": 3, `"1,5",2,3`: 3, "1,2,3,4": 3} { + writes, err := paloaltoCSV(short, map[string]any{"log": map[string]any{"line": line}}) + if (want < 0) != (err != nil) || (want >= 0 && len(writes) != want) { + t.Errorf("csv %q: %d writes, error %v; want %d", line, len(writes), err, want) + } + } + cfg := &plugins.Config{} + for _, tc := range []struct { + text string + patterns []string + writes int + }{ + {"x1", []string{"^x", "[0-9]+"}, 2}, + {"xz", []string{"^x", "y*"}, 0}, // a pattern that matches only empty text fails the step + {"1.2.", []string{"[0-9.]+", "\\.$"}, 0}, // the first pattern swallows the final period + {"1.2.", []string{"[0-9.]*[0-9]", "\\.$"}, 2}, + {"a b", []string{"b"}, 0}, // a match must start the remaining text + } { + g := &plugins.Grok{Source: "log.line"} + for i, p := range tc.patterns { + g.Patterns = append(g.Patterns, &plugins.Pattern{FieldName: "log.f" + strconv.Itoa(i), Pattern: p}) + } + writes, err := paloaltoGrok(cfg, g, map[string]any{"log": map[string]any{"line": tc.text}}) + if err != nil || len(writes) != tc.writes { + t.Errorf("grok %q %q: %d writes, error %v; want %d", tc.text, tc.patterns, len(writes), err, tc.writes) + } + } +} + +// Each longer CSV tier must run only when the line has that many columns, counted as the +// csv plugin counts them, quoted commas included; otherwise the plugin fails the step. +func TestPaloAltoCSVTierCondition(t *testing.T) { + cache := plugins.NewCELCache("paloalto-tiers") + count := regexp.MustCompile(`regexMatch\("log\.paPayload", "\^\(\?:\(\?:.*\{([0-9]+)\}"\)`) + tiers := 0 + for _, s := range paloaltoConfig(t).Pipeline[0].Steps { + if s.Csv == nil { + continue + } + m := count.FindStringSubmatch(s.Csv.Where) + if m == nil { + continue + } + need, _ := strconv.Atoi(m[1]) + need++ + if need != len(s.Csv.Headers) { + t.Errorf("tier needs %d columns but has %d headers: %s", need, len(s.Csv.Headers), s.Csv.Where) + } + tiers++ + for _, have := range []int{need - 1, need, need + 1} { + cols := make([]string, have) + for i := range cols { + cols[i] = []string{"1", `"a, b"`, "", `"say ""x"", y"`}[i%4] + } + doc, err := json.Marshal(map[string]any{"log": map[string]any{"paPayload": strings.Join(cols, ",")}}) + if err != nil { + t.Fatal(err) + } + text := string(doc) + got, err := cache.Evaluate(&text, m[0]) + if err != nil { + t.Fatal(err) + } + if got != (have >= need) { + t.Errorf("%d columns, tier of %d: condition %v", have, need, got) + } + } + } + if tiers < 15 { + t.Fatalf("only %d conditioned CSV tiers found", tiers) + } +} From f880e6f6552926c577971ec51bc440d706eb4b2e Mon Sep 17 00:00:00 2001 From: Ricardo Valdes Date: Thu, 24 Sep 2026 18:08:34 -0400 Subject: [PATCH 7/9] docs(paloalto): record the real-engine defects and their correction Explain what failed on EventProcessor 8a3ade7, why the offline model hid it, what changed in filter 3.1.1 and the model, and what now passes: 122 of 122 committed lines and 34 of 34 real records with every expected field, the 38 expected rule matches, and the full plugins/alerts suite (48 pass, 12 skip, 0 fail). Co-Authored-By: Claude Opus 5.5 --- filters/audits/paloalto.md | 96 +++++++++++++++++++++++++++++--------- 1 file changed, 73 insertions(+), 23 deletions(-) diff --git a/filters/audits/paloalto.md b/filters/audits/paloalto.md index e95d1ef0e..8051195e3 100644 --- a/filters/audits/paloalto.md +++ b/filters/audits/paloalto.md @@ -99,21 +99,71 @@ What changed in the SDK, and what it means here: filter reads a text field written by `grok` or `csv`, so no result changes. `plugins.proto`, `plugins/cel.go` and `plugins/rules.go` are identical in v1.1.33 and v1.1.36. -- The only file changed for the new SDK is a test comment that still said the sanitizer - removes underscores. - -| Check on the latest versions | Result | +- For the new SDK itself only a test comment had to change; it still said the sanitizer + removes underscores. Running the real engine then showed the defects below. + +## Real-engine correction (filter 3.1.1) + +The first re-validation ran the committed lines through the real EventProcessor `8a3ade7` +parser plugins, not only through the Go model. Most of them did not parse, although the Go +suite passed. The same happens on the older engine `497bf53`, so the SDK update did not cause +it. Four defects were in the filter: + +- **CSV layouts.** Each layout lists every column of the current PAN-OS documentation (for + example 130 for TRAFFIC). The `csv` plugin fails the whole step when a line has fewer + columns than the step has headers, and then writes nothing. Older firmware sends shorter + lines, and so did 75 of the 122 committed lines, so those events kept only the envelope. +- **CEF and LEEF extensions.** Each of the 613 extension steps read the value with a lazy + pattern and checked the boundary (` next=` or the end) with a separate pattern. The `grok` + plugin matches each pattern on its own, so the value pattern matched empty text, which the + plugin treats as no match. No extension value was stored; 20 CEF lines lacked fields. +- **SYSTEM authentication.** The address pattern also took the sentence's final period, so + the closing `\.$` pattern had no text left and the step wrote nothing. User and address + were never set. On the 34 real records, the 9 real failed logins did not match the + authentication rule (0 of 9) and the 3 successes lacked user and address. +- **Lines without ``.** The step for lines without a syslog header starts with an + optional `` pattern. On a line without `` it matched empty text, so such lines + were never parsed. + +The Go model hid all four: it joined each `grok` step's patterns into one expression, which +can backtrack across patterns, and let `csv` skip missing columns. + +What changed: + +- The filter (3.1.1) applies each CSV layout in tiers. The first tier covers the shortest line + this filter accepts for the type; each longer tier, up to the full documented layout, runs + only when the line has at least that many columns, counted as the `csv` plugin counts them + (quoted commas included). Tiers: TRAFFIC 103/130, THREAT and Data Filtering 106/123, URL + 106/123/125, HIP-MATCH 30/32, GLOBALPROTECT 29/50, IPTAG 11/27, USERID 34/37, DECRYPTION + 31/107, TUNNEL/START/END 50/84, SCTP 32/65, CONFIG 26/28, AUTHENTICATION 46/47, SYSTEM 26, + CORRELATION 12/22, GTP 32/94. The real SYSTEM records have the documented 26 columns. +- Each CEF/LEEF extension step reads the value together with its boundary, and one `trim` + step then removes the trailing ` next=`. +- The authentication address pattern ends at the last address character. +- Lines without `` get their own one-pattern step. +- The Go model now follows the plugins of `8a3ade7`: `grok` matches each pattern on its own at + the start of the remaining text and writes nothing unless all match; `csv` fails on a short + line; a failed step or condition is recorded on the event, as the engine does. Against the + previous filter it fails 104 of the 122 committed lines and 12 of the 34 real records. For + all 122 lines, and for both the previous and the corrected filter, its events equal the real + engine's field for field (numbers aside, which the test writes as protojson text). + `TestPaloAltoModelFollowsPlugins` and `TestPaloAltoCSVTierCondition` pin this down. + +No fixture or expectation changed. + +| Check on the latest versions, corrected filter | Result | |---|---| -| Full `plugins/alerts` suite, go-sdk v1.1.36 | 46 tests pass, 12 skip, none fail. The skipped tests need private evidence (the 11 of other technologies and this draft's private records). | -| The 34 private records, same suite | 34 of 34 pass once their expected field names are written as the camelCase names this draft now uses; the private expectation file predates that rename. With them the suite gives 47 passes, 11 skips and no failures (2,418 passing results with subtests). | -| The 122 committed fabricated lines through the EventProcessor `8a3ade7` playground, with the filter and the eleven rules as committed | 122 events, but 75 carry the `csv` plugin error `number of headers should match the number of resulting columns`: all 28 TRAFFIC and 36 THREAT lines and 11 lines of other CSV types. The real plugin stops the pipeline when a line has fewer columns than the layout's headers (the TRAFFIC layout lists 130; the TRAFFIC line has 102), so those events keep only the envelope fields. The offline model skips missing columns instead. Of the 47 lines without errors, 16 carry every expected field and 31 do not (20 CEF, 8 SYSTEM and 3 others); for example, SYSTEM authentication lines lack `origin.ip` and `origin.user`, because the real `grok` plugin matches each pattern from the start of the remaining text, while the model searches the whole text with one expression. The same 120 lines present in an earlier run on EventProcessor `497bf53` gave identical events, so the SDK change did not cause this. | -| go-sdk v1.1.36 rule replay over those playground events | 2 of the 38 expected rule matches. On every event that carries its expected fields, each rule gives exactly its expected result and history placeholders resolve; the misses all come from the missing fields. | - -So the committed Go suite passes, but the real parser plugins do not yet produce what it -expects for most native CSV lines, most CEF lines and part of the SYSTEM lines. This is -not a v1.1.36 change and is left to a separate correction of the CSV layouts, the SYSTEM -authentication extraction and the offline model; the rules cannot be relied on for native -CSV traffic until then. +| Full `plugins/alerts` suite, go-sdk v1.1.36 | 48 tests pass, 12 skip, none fail (2,385 passing results with subtests). With the 34 private records: 49 pass, 11 skip, none fail (2,420). The skipped tests need private evidence. | +| The 122 committed lines through the EventProcessor `8a3ade7` playground, filter and eleven rules as committed | 122 events, no parser error, every expected field and every required absence on all 122. Before the correction: 75 events with the `csv` error and only 16 complete. | +| go-sdk v1.1.36 rule replay over those events | Exactly the 38 expected rule matches, no other match, every history placeholder resolved. Before: 2 of 38. | +| The 34 private real records through the same playground | 34 events, no parser error, every expected field on all 34. The authentication rule matches exactly the 9 real failed logins; the 3 successes, 10 other SYSTEM records and 12 Cortex records stay negative. Before: 22 of 34 complete, 0 of 9 matched. | + +The playground has no OpenSearch, so history searches cannot complete there. The two history +rules that match five or more lines (repeated authentication failures, repeated risky URL +categories) therefore raise a `Circuit Breaker` alert in these runs, because each failed search +counts as a rule error; this says nothing about the rules. Their history queries are covered by +the SDK history tests against loopback mocks. The rules without a history search raised 16 local +alerts, each on a line that expects it. ## Validation and rollout limits @@ -134,23 +184,23 @@ the deployed filter contains the corresponding two empty steps. The sampled reco indexed, but lack the expected normalized event fields. This establishes actual runtime errors and missing mappings, not wholesale configuration rejection or event loss. -Private raw replay verifies independently derived SYSTEM columns, explicit authentication -user/address extraction, severity and time. Nine authentication failures match the revised -authentication predicate; successes and other sampled classes remain negative. Documented +Private raw replay, in the Go model and in the real `8a3ade7` playground, verifies +independently derived SYSTEM columns, explicit authentication user/address extraction, severity +and time. Nine authentication failures match the revised authentication predicate; successes +and other sampled classes remain negative. Documented traffic/threat/CONFIG CSV and CEF layouts are checked against the cited contracts and fabricated regressions, not those SYSTEM samples. The legacy LEEF-labelled dialect has compatibility tests only; neither it nor standard LEEF has vendor-semantic validation here. Ambiguous CEF counters/severity remain unpromoted. -Raw extraction in the Go suite uses an explicitly declared offline YAML/Go CSV model. It is not -execution of the EventProcessor, geolocation service or live alert creation; the playground run -above shows where it and the real parser plugins differ. Native replay and deployment +Raw extraction in the Go suite uses an offline model of the EventProcessor `8a3ade7` parser +plugins; it gives the same events as the real playground for all 122 committed lines. It does +not run the geolocation service or create alerts. Native replay and deployment identity evidence are maintained separately; no customer records or identifying metadata are committed. No production alert-volume result is asserted. -Before rollout, correct the parser differences described above, exercise the parser with the -actual appliance export profiles, measure throughput, and verify the resulting indexed fields -and alerts. In particular: +Before rollout, exercise the parser with the actual appliance export profiles, measure +throughput, and verify the resulting indexed fields and alerts. In particular: - Palo Alto publishes no supported CEF guidance after PAN-OS 10.0. Its guide gives a numeric 0–10 importance scale but no exact mapping to PAN-OS textual severity bins. Numeric-only CEF From bcbf62e34c9c69fd0e3fa4f15fab0e56c2103228 Mon Sep 17 00:00:00 2001 From: Ricardo Valdes Date: Thu, 24 Sep 2026 20:16:06 -0400 Subject: [PATCH 8/9] fix(paloalto): read empty CEF header values on the real engine The EventProcessor 8a3ade7 grok plugin trims the remaining text before each pattern and counts an empty match as no match, and then the whole step writes nothing. In the CEF/LEEF header step, the sender software version and the signature ('(?:\\.|[^|\\])*') and the severity ('[^|]*') match empty text when that header value is empty. Such a line lost its type, its extension text and every field taken from them. Each of the three values is now read together with the '|' that ends it, and one trim step removes that '|'. The separator fields this replaces (log.paSep1, log.paSep2 and log.paSep4) are no longer written or listed in the final cleanup. An empty value is stored as empty text, as the csv plugin stores empty columns; the later steps that read the signature already skip "", "-" and "N/A". Filter version 3.1.2. Three fixtures copy cef-system-auth with one empty header value each and expect its user, address, result and rule match. TestPaloAltoGrokPatternsNeverMatchEmpty tries every pattern alone on texts that start with each printable character. Both fail on 3.1.1 and pass on 3.1.2. Co-Authored-By: Claude Opus 5.5 --- filters/paloalto/pa_firewall.yml | 25 ++++---- plugins/alerts/paloalto_contract_test.go | 35 +++++++++++ plugins/alerts/testdata/paloalto_raw.json | 77 +++++++++++++++++++++++ 3 files changed, 124 insertions(+), 13 deletions(-) diff --git a/filters/paloalto/pa_firewall.yml b/filters/paloalto/pa_firewall.yml index 686c9999b..37b2333e0 100644 --- a/filters/paloalto/pa_firewall.yml +++ b/filters/paloalto/pa_firewall.yml @@ -1,4 +1,4 @@ -# Palo Alto Firewall, version 3.1.1 +# Palo Alto Firewall, version 3.1.2 # Palo Alto PAN-OS CSV and documented PAN-OS 10.0 CEF templates. # Checked with the public EventProcessor 8a3ade7 parser plugins; exercise real export profiles before rollout. # The prior seven-field LEEF-labelled compatibility dialect is retained. @@ -81,24 +81,26 @@ pipeline: - fieldName: log.paCefPrefix pattern: ^(?:CEF|LEEF):[0-9]+\|Palo Alto Networks\|PAN-OS\| - fieldName: log.paSenderSwVersion - pattern: (?:\\.|[^|\\])* - - fieldName: log.paSep1 - pattern: \| + pattern: (?:\\.|[^|\\])*\| - fieldName: log.paCefSignature - pattern: (?:\\.|[^|\\])* - - fieldName: log.paSep2 - pattern: \| + pattern: (?:\\.|[^|\\])*\| - fieldName: log.paType pattern: '[A-Z][A-Z0-9-]*' - fieldName: log.paSep3 pattern: \| - fieldName: log.severityLabel - pattern: '[^|]*' - - fieldName: log.paSep4 - pattern: \| + pattern: '[^|]*\|' - fieldName: log.paCefExtensions pattern: .*$ where: oneOf("log.paFormat", ["CEF", "LEEF-legacy"]) + - trim: + function: suffix + substring: '|' + fields: + - log.paSenderSwVersion + - log.paCefSignature + - log.severityLabel + where: oneOf("log.paFormat", ["CEF", "LEEF-legacy"]) - grok: source: log.paCefExtensions patterns: @@ -9276,10 +9278,7 @@ pipeline: - log.paEnvelope - log.paPayload - log.paCefPrefix - - log.paSep1 - - log.paSep2 - log.paSep3 - - log.paSep4 - log.paCefExtensions - log.paIgnored - log.paSuffix diff --git a/plugins/alerts/paloalto_contract_test.go b/plugins/alerts/paloalto_contract_test.go index 9e7427d6e..10bcf4a16 100644 --- a/plugins/alerts/paloalto_contract_test.go +++ b/plugins/alerts/paloalto_contract_test.go @@ -630,6 +630,41 @@ func TestPaloAltoModelFollowsPlugins(t *testing.T) { } } +// The grok plugin trims the remaining text before each pattern and treats an empty match as no +// match, which drops the whole step. So no pattern may prefer empty text at the start of a +// non-empty text: each pattern is tried alone on texts that start with every printable ASCII +// character and with one non-ASCII letter. +func TestPaloAltoGrokPatternsNeverMatchEmpty(t *testing.T) { + cfg := paloaltoConfig(t) + probes := []string{"é x"} + for c := '!'; c <= '~'; c++ { + probes = append(probes, string(c)+" x") + } + checked := 0 + for i, s := range cfg.Pipeline[0].Steps { + if s.Grok == nil { + continue + } + for j, p := range s.Grok.Patterns { + re, err := paloaltoCompile(cfg, p.Pattern) + if err != nil { + t.Fatalf("step %d pattern %d: %v", i, j, err) + } + checked++ + for _, probe := range probes { + if loc := re.FindStringIndex(probe); loc != nil && loc[1] == 0 { + t.Errorf("step %d pattern %d (%s) %q matches empty text at the start of %q", + i, j, p.FieldName, p.Pattern, probe) + break + } + } + } + } + if checked == 0 { + t.Fatal("no grok pattern checked") + } +} + // Each longer CSV tier must run only when the line has that many columns, counted as the // csv plugin counts them, quoted commas included; otherwise the plugin fails the step. func TestPaloAltoCSVTierCondition(t *testing.T) { diff --git a/plugins/alerts/testdata/paloalto_raw.json b/plugins/alerts/testdata/paloalto_raw.json index 046a93a2e..adbb9e642 100644 --- a/plugins/alerts/testdata/paloalto_raw.json +++ b/plugins/alerts/testdata/paloalto_raw.json @@ -1338,6 +1338,83 @@ ] } }, + { + "name": "cef-header-empty-version", + "dataSource": "synthetic-collector", + "raw": "<14>Sep 17 12:00:00 synthetic-fw CEF:0|Palo Alto Networks|PAN-OS||auth|SYSTEM|3|deviceExternalId=SYNTH-FW cs3Label=Virtual System cs3=vsys1 cat=auth-fail msg=failed authentication for user 'testuser'. Reason: invalid. From: 192.0.2.25. dvchost=synthetic-fw", + "expected": { + "origin.ip": "192.0.2.25", + "origin.user": "testuser", + "target.host": "synthetic-fw", + "actionResult": "failure", + "log.paType": "SYSTEM", + "log.paSenderSwVersion": "", + "log.paSubtype": "auth", + "log.severityLabel": "3" + }, + "matches": [ + "panos_admin_brute_force" + ], + "absent": [], + "alertSides": { + "panos_admin_brute_force": [ + "192.0.2.25", + "" + ] + } + }, + { + "name": "cef-header-empty-signature", + "dataSource": "synthetic-collector", + "raw": "<14>Sep 17 12:00:00 synthetic-fw CEF:0|Palo Alto Networks|PAN-OS|10.0||SYSTEM|3|deviceExternalId=SYNTH-FW cs3Label=Virtual System cs3=vsys1 cat=auth-fail msg=failed authentication for user 'testuser'. Reason: invalid. From: 192.0.2.25. dvchost=synthetic-fw", + "expected": { + "origin.ip": "192.0.2.25", + "origin.user": "testuser", + "target.host": "synthetic-fw", + "actionResult": "failure", + "log.paType": "SYSTEM", + "log.paSenderSwVersion": "10.0", + "log.paCefSignature": "", + "log.severityLabel": "3" + }, + "matches": [ + "panos_admin_brute_force" + ], + "absent": [ + "log.paSubtype" + ], + "alertSides": { + "panos_admin_brute_force": [ + "192.0.2.25", + "" + ] + } + }, + { + "name": "cef-header-empty-severity", + "dataSource": "synthetic-collector", + "raw": "<14>Sep 17 12:00:00 synthetic-fw CEF:0|Palo Alto Networks|PAN-OS|10.0|auth|SYSTEM||deviceExternalId=SYNTH-FW cs3Label=Virtual System cs3=vsys1 cat=auth-fail msg=failed authentication for user 'testuser'. Reason: invalid. From: 192.0.2.25. dvchost=synthetic-fw", + "expected": { + "origin.ip": "192.0.2.25", + "origin.user": "testuser", + "target.host": "synthetic-fw", + "actionResult": "failure", + "log.paType": "SYSTEM", + "log.paSenderSwVersion": "10.0", + "log.paSubtype": "auth", + "log.severityLabel": "" + }, + "matches": [ + "panos_admin_brute_force" + ], + "absent": [], + "alertSides": { + "panos_admin_brute_force": [ + "192.0.2.25", + "" + ] + } + }, { "name": "cef-config-admin-is-origin", "dataSource": "synthetic-collector", From fa26ce20f10103f58c0c1e5a53e3b61d7a224036 Mon Sep 17 00:00:00 2001 From: Ricardo Valdes Date: Thu, 24 Sep 2026 20:16:06 -0400 Subject: [PATCH 9/9] docs(paloalto): record the empty CEF header fix Adds the filter 3.1.2 section: the three header patterns, the fix, and the checks on EventProcessor 8a3ade7. The 125 committed lines parse with every expected field, the go-sdk v1.1.36 rule replay finds exactly the 41 expected matches, the 34 private records give the same events as with 3.1.1, the Go model equals the engine on all 125 lines, and the suite has 49 passing and 12 skipped tests (50 and 11 with the private records). The current fixture counts are updated. Co-Authored-By: Claude Opus 5.5 --- filters/audits/paloalto.md | 42 ++++++++++++++++++++++++++++++++++++-- 1 file changed, 40 insertions(+), 2 deletions(-) diff --git a/filters/audits/paloalto.md b/filters/audits/paloalto.md index 8051195e3..04325a96d 100644 --- a/filters/audits/paloalto.md +++ b/filters/audits/paloalto.md @@ -165,9 +165,47 @@ counts as a rule error; this says nothing about the rules. Their history queries the SDK history tests against loopback mocks. The rules without a history search raised 16 local alerts, each on a line that expects it. +## Empty CEF header values (filter 3.1.2) + +A later check tried every `grok` pattern of the filter on its own, the way the `8a3ade7` +plugin runs it: the text that is left is trimmed before each pattern, an empty match counts as +no match, and then the step writes nothing. Three patterns of the CEF/LEEF header step could +match empty text: the sender software version and the signature (`(?:\\.|[^|\\])*`) and the +severity (`[^|]*`). When one of these header values was empty, for example `|PAN-OS||auth|`, +the header step failed, so the event lost its type, its extension text and every field taken +from them. + +What changed: + +- Each of the three values is read together with the `|` that ends it, and one `trim` step + removes that `|`. The separator fields this replaces (`log.paSep1`, `log.paSep2` and + `log.paSep4`) are no longer written, and the final cleanup no longer lists them. +- An empty header value is stored as empty text, as the `csv` plugin already stores empty + columns. The later steps that read the signature already skip `""`, `-` and `N/A`, so an + empty signature sets no `log.paSubtype`. +- Three fixtures copy `cef-system-auth` with one empty header value each + (`cef-header-empty-version`, `cef-header-empty-signature`, `cef-header-empty-severity`) and + expect its user, address, result and authentication rule match. +- `TestPaloAltoGrokPatternsNeverMatchEmpty` tries every pattern alone on texts that start with + each printable character, and fails when one matches empty text at the start. + +The other patterns that can match empty text never do so at the start of a non-empty text: the +613 extension value patterns end at ` next=` or at the end of the text, and the header's last +pattern, `.*$`, takes the rest of the line. They are unchanged. + +| Check, filter 3.1.2 | Result | +|---|---| +| The three new lines, a TRAFFIC line with an empty signature and two unchanged controls, EventProcessor `8a3ade7`, filters 3.1.1 and 3.1.2 | With 3.1.1 the four lines with an empty header value kept only the envelope, without an error. With 3.1.2 each has every field of its unchanged control except the empty value. The controls are identical under both filters. | +| Full `plugins/alerts` suite, go-sdk v1.1.36 | 49 tests pass, 12 skip, none fail (2,389 passing results with subtests). With the 34 private records: 50 pass, 11 skip, none fail (2,424). | +| The 125 committed lines through the `8a3ade7` playground, filter and eleven rules as committed | 125 events, no parser error, every expected field and every required absence on all 125. The same 16 local alerts and the same two history rules' Circuit Breaker alerts as before. A first run wrote the same events and alerts but did not shut down and was stopped after 10 minutes; a second run finished normally with identical events. | +| go-sdk v1.1.36 rule replay over those events | Exactly the 41 expected rule matches (the 38 before and the three new lines), no other match, every history placeholder resolved. | +| The 34 private real records through the same playground | 34 events, no parser error, every expected field, each event identical to the filter 3.1.1 run. The authentication rule matches exactly the 9 real failed logins. | +| Go model against the playground | Identical events for all 125 committed lines (fields, types and errors). | +| The new checks on filter 3.1.1 | `TestPaloAltoGrokPatternsNeverMatchEmpty` names the three header patterns, and `TestPaloAltoRawContracts` fails on the three new lines. Both pass on 3.1.2. | + ## Validation and rollout limits -The committed suite has **122 fabricated raw fixtures**, positive/negative assertions for all +The committed suite has **125 fabricated raw fixtures**, positive/negative assertions for all **eleven rules**, strict final Event decoding, independent alert-side expectations, and **five real SDK history-request tests** against loopback mocks. History tests cover below/at threshold, expiration, irrelevant/unmarked events, wrong identities and unresolved required placeholders. @@ -194,7 +232,7 @@ only; neither it nor standard LEEF has vendor-semantic validation here. Ambiguou counters/severity remain unpromoted. Raw extraction in the Go suite uses an offline model of the EventProcessor `8a3ade7` parser -plugins; it gives the same events as the real playground for all 122 committed lines. It does +plugins; it gives the same events as the real playground for all 125 committed lines. It does not run the geolocation service or create alerts. Native replay and deployment identity evidence are maintained separately; no customer records or identifying metadata are committed. No production alert-volume result is asserted.