elastic / elastic/integrations

[panw]: add other registered_doman, subdomain and top level domain when destination.domain is present

Open
#11,830 3 comments 2 reactions 0 assignees View on GitHub
Integration:panw Stalled Team:Security-Deployment and Devices
Dominant language
Handlebars
Stars
333
Forks
647
Avg merge
3d 4h
Merged PRs (30d)
209

Description

### Integration Name

Palo Alto Next-Gen Firewall [panw]

### Dataset Name

panw.*

### Integration Version

4.1.0

### Agent Version

4.1.0

### Agent Output Type

elasticsearch

### Elasticsearch Version

8.14.3

### OS Version and Architecture

RedHat 9

### Software/API Version

_No response_

### Error Message

it would be nice that when an url.domain, or destination.domain is present, that these field are also parsed. We can then avoid making wildcard searches.

destination.registered_domain
destination.subdomain
destination.top_level_domain

### Event Original

<14>Nov 22 11:44:08 AC-PA5250 1,2024/11/22 11:44:07,013101001308,THREAT,url,2561,2024/11/22 11:44:07,11.24.156.36,64.233.167.104,2.1.16.120,64.233.167.104,MyRuleName,localdomain\localuser,,google-base,vsys1,IngressZone,EgressZone,ae1.490,ae2.498,Panorama-Elastic,2024/11/22 11:44:07,33713037,1,52889,443,5800,443,0x40b400,tcp,alert,"www.google.com/",(9999),search-engines,informational,client-to-server,7406333526311476911,0x8000000000000000,10.0.0.0-10.255.255.255,United States,,,0,,,0,,,,,,,,0,0,0,0,0,Core,AC-PA5250,,,,,0,,0,,N/A,unknown,AppThreat-0-0,0x0,0,4294967295,," CAC,search-engines,low-risk",c6fc2c02-fa8b-4d78-82cf-d50a8a7b30d6,0,,,,,,,,,,,,,,,,,,,,,,,,,,,,,0,2024-11-22T11:44:07.984+01:00,,,,EgressZone-utility,general-EgressZone,browser-based,4,"used-by-malware,able-to-transfer-file,has-known-vulnerability,tunnel-other-application,pervasive-use",,google-base,no,no,_reportid

### What did you do?

search in data

### What did you see?

only destination.domain

### What did you expect to see?

url: www.google.com
destination.registered_domain: google.com
destination.subdomain: www
destination.top_level_domain: com

### Anything else?

_No response_

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.