Parse Palo Alto Syslog
Parsing of all Palo Alto Syslog types with removal of null values and options for filtering out of info level, internal, allowed and specific DNS logs while also removing the start of messages.
Included Processors
Add Fields - Processing Selection
Set the fields to true for processors to filter/reduce.
Parse with Regex - TCP
Removes syslog header for later CSV parsing.
Parse with Regex - SYSLOG
Parsing Syslog Logs.
Parse CSV - THREAT
Parsing Threat Logs.
Parse CSV - TRAFFIC
Parsing Traffic Logs.
Parse CSV - HIP-MATCH
Parsing HIP-Match Logs.
Parse CSV - AUDIT
Parsing Audit Logs.
Parse CSV - AUTHENTICATION
Parsing Authentication Logs.
Parse CSV - CONFIG
Parsing Config Logs.
Parse CSV - CORRELATION
Parsing Correlation Logs.
Parse CSV - DECRYPTION
Parsing Decryption Logs.
Parse CSV - GLOBALPROTECT
Parsing Global Protect Logs.
Parse CSV - GTP
Parsing GTP Logs.
Parse CSV - IPTAG
Parsing IPTAG Logs.
Parse CSV - SCTP
Parsing SCTP Logs.
Parse CSV - SYSTEM
Parsing System Logs.
Parse CSV - USERID
Parsing UserID Logs.
Filter by Condition - Informational
Filtering out Information level logs.
Filter by Condition - DNS
Filtering out by DNS.
Filter by Condition - Allowed Messages
Filtering out Allowed level logs.
Filter by Condition - Internal
Filtering out Internally generated logs.
Filter by Condition - Traffic Start
Filtering out Traffic Start Logs.
Copy Field - Original to body
Copying the original log to the body.