Enrich Palo Alto Security Events
Enriches Palo Alto Networks firewall security events with MITRE ATT&CK context based on log type, subtype, action, and threat category.
Included Processors
Parse JSON Body
Parses the JSON string body into a map for field access.
Enrich Valid Account Usage
Adds MITRE context for successful Palo Alto administrator logins.
Enrich Brute Force Authentication
Adds MITRE context for failed Palo Alto administrator login attempts.
Enrich VPN Brute Force
Adds MITRE context for failed GlobalProtect VPN authentication attempts.
Enrich VPN Access
Adds MITRE context for successful GlobalProtect VPN connections.
Enrich Defense Evasion Changes
Adds MITRE context for firewall configuration changes that may impair defenses.
Enrich C2 Communication
Adds MITRE context for detected command and control traffic.
Enrich Exploit Detection
Adds MITRE context for detected vulnerability exploitation attempts.
Enrich Malware Detection
Adds MITRE context for detected malware/virus.
Enrich WildFire Detection
Adds MITRE context for WildFire detected malware.
Enrich Phishing Detection
Adds MITRE context for blocked phishing URLs.
Enrich Drive-by Compromise
Adds MITRE context for blocked malware distribution URLs.
Enrich Ingress Tool Transfer
Adds MITRE context for blocked file transfers.
Enrich DNS Tunneling
Adds MITRE context for detected DNS-based exfiltration or C2.
Enrich Data Exfiltration
Adds MITRE context for data loss prevention alerts.
Enrich Network Scanning
Adds MITRE context for denied traffic that may indicate reconnaissance.
Delete Empty Values
Removes null and empty values after enrichment.