elastic / elastic/integrations
[panw]: add other registered_doman, subdomain and top level domain when destination.domain is present
- Dominant language
- Handlebars
- Stars
- 333
- Forks
- 647
- Avg merge
- 3d 4h
- Merged PRs (30d)
- 209
Description
### Integration Name
Palo Alto Next-Gen Firewall [panw]
### Dataset Name
panw.*
### Integration Version
4.1.0
### Agent Version
4.1.0
### Agent Output Type
elasticsearch
### Elasticsearch Version
8.14.3
### OS Version and Architecture
RedHat 9
### Software/API Version
_No response_
### Error Message
it would be nice that when an url.domain, or destination.domain is present, that these field are also parsed. We can then avoid making wildcard searches.
destination.registered_domain
destination.subdomain
destination.top_level_domain
### Event Original
<14>Nov 22 11:44:08 AC-PA5250 1,2024/11/22 11:44:07,013101001308,THREAT,url,2561,2024/11/22 11:44:07,11.24.156.36,64.233.167.104,2.1.16.120,64.233.167.104,MyRuleName,localdomain\localuser,,google-base,vsys1,IngressZone,EgressZone,ae1.490,ae2.498,Panorama-Elastic,2024/11/22 11:44:07,33713037,1,52889,443,5800,443,0x40b400,tcp,alert,"www.google.com/",(9999),search-engines,informational,client-to-server,7406333526311476911,0x8000000000000000,10.0.0.0-10.255.255.255,United States,,,0,,,0,,,,,,,,0,0,0,0,0,Core,AC-PA5250,,,,,0,,0,,N/A,unknown,AppThreat-0-0,0x0,0,4294967295,," CAC,search-engines,low-risk",c6fc2c02-fa8b-4d78-82cf-d50a8a7b30d6,0,,,,,,,,,,,,,,,,,,,,,,,,,,,,,0,2024-11-22T11:44:07.984+01:00,,,,EgressZone-utility,general-EgressZone,browser-based,4,"used-by-malware,able-to-transfer-file,has-known-vulnerability,tunnel-other-application,pervasive-use",,google-base,no,no,_reportid
### What did you do?
search in data
### What did you see?
only destination.domain
### What did you expect to see?
url: www.google.com
destination.registered_domain: google.com
destination.subdomain: www
destination.top_level_domain: com
### Anything else?
_No response_
Contributor guide
Assessment
This issue has not been assessed yet.