elastic / elastic/integrations

[panw]: Palo Alto config pipeline is parsing IP into the wrong field

Open
#14,269 2 comments 0 reactions 0 assignees View on GitHub
Integration:panw Stalled Team:Security-Deployment and Devices
Dominant language
Handlebars
Stars
333
Forks
647
Avg merge
3d 4h
Merged PRs (30d)
209

Description

### Integration Name

Palo Alto Next-Gen Firewall [panw]

### Dataset Name

panw.panos

### Integration Version

5.3.0

### Agent Version

none

### Agent Output Type

logstash

### Elasticsearch Version

8.17.3

### OS Version and Architecture

Redhat 8.10 x86_64

### Software/API Version

_No response_

### Error Message

The Palo Alto firewall integration's pipeline for config events (`config.yml`) is parsing the IP address into the wrong field.
As per the [vendor documentation](https://docs.paloaltonetworks.com/pan-os/11-0/pan-os-admin/monitoring/use-syslog-for-monitoring/syslog-field-descriptions/config-log-fields), config events can contain an IP which is the `Hostname or IP address of the client machine` .
The `config.yml` pipeline, (line 115 set processor) is parsing this IP into the `host.ip` fields which is incorrect, because as per the [ECS host.* fields](https://www.elastic.co/guide/en/ecs/1.12/ecs-host.html) will contain ` details about the host on which the event happened, or from which the measurement was taken. Host types include hardware, virtual machines, Docker containers, and Kubernetes nodes.`

The set processor should parse this ip into `client.ip` fireld for example, or `source.ip` - it's the IP of the client which initiated a config change.

### Event Original

_No response_

### What did you do?

Change the set processor to fix this:
- set:
field: client.ip
copy_from: panw.panos.host.ip
ignore_failure: true

### What did you see?

host.ip is not consistent with other events because in case of config events it will haver a client ip , not the ip of the device which generated the event

### What did you expect to see?

expected this IP to be parsed into client.ip

### Anything else?

_No response_

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.