elastic / elastic/integrations
[panw]: Palo Alto config pipeline is parsing IP into the wrong field
- Dominant language
- Handlebars
- Stars
- 333
- Forks
- 647
- Avg merge
- 3d 4h
- Merged PRs (30d)
- 209
Description
### Integration Name
Palo Alto Next-Gen Firewall [panw]
### Dataset Name
panw.panos
### Integration Version
5.3.0
### Agent Version
none
### Agent Output Type
logstash
### Elasticsearch Version
8.17.3
### OS Version and Architecture
Redhat 8.10 x86_64
### Software/API Version
_No response_
### Error Message
The Palo Alto firewall integration's pipeline for config events (`config.yml`) is parsing the IP address into the wrong field.
As per the [vendor documentation](https://docs.paloaltonetworks.com/pan-os/11-0/pan-os-admin/monitoring/use-syslog-for-monitoring/syslog-field-descriptions/config-log-fields), config events can contain an IP which is the `Hostname or IP address of the client machine` .
The `config.yml` pipeline, (line 115 set processor) is parsing this IP into the `host.ip` fields which is incorrect, because as per the [ECS host.* fields](https://www.elastic.co/guide/en/ecs/1.12/ecs-host.html) will contain ` details about the host on which the event happened, or from which the measurement was taken. Host types include hardware, virtual machines, Docker containers, and Kubernetes nodes.`
The set processor should parse this ip into `client.ip` fireld for example, or `source.ip` - it's the IP of the client which initiated a config change.
### Event Original
_No response_
### What did you do?
Change the set processor to fix this:
- set:
field: client.ip
copy_from: panw.panos.host.ip
ignore_failure: true
### What did you see?
host.ip is not consistent with other events because in case of config events it will haver a client ip , not the ip of the device which generated the event
### What did you expect to see?
expected this IP to be parsed into client.ip
### Anything else?
_No response_
Contributor guide
Assessment
This issue has not been assessed yet.