elastic / elastic/integrations

[panw.panos]: Palo Alto globalprotect pipeline is parsing client details into the host.* fields

Open
#14,548 2 comments 0 reactions 0 assignees View on GitHub
breaking change Integration:panw Stalled Team:Security-Deployment and Devices
Dominant language
Handlebars
Stars
333
Forks
647
Avg merge
2d 18h
Merged PRs (30d)
182

Description

### Integration Name

Palo Alto Next-Gen Firewall [panw]

### Dataset Name

panw.panos

### Integration Version

5.3.1

### Agent Version

no agent

### Agent Output Type

logstash

### Elasticsearch Version

8.17.3

### OS Version and Architecture

Redhat 8.10 x86_64

### Software/API Version

_No response_

### Error Message

The Palo Alto panw.panos client details in Globalprotect events are parsed into the host.* fields, while per the manufacturer specs these are client related information.

[Lines 102-113](https://github.com/elastic/integrations/blob/main/packages/panw/data_stream/panos/elasticsearch/ingest_pipeline/globalprotect.yml#L102) from `globalprotect.yml`
```
- lowercase:
target_field: host.name
field: panw.panos.machine.name
if: ctx.panw?.panos?.machine?.name != null
- set:
field: host.os.family
copy_from: panw.panos.client.os
ignore_failure: true
- set:
field: host.os.full
copy_from: panw.panos.client.os_version
ignore_failure: true
```
and Line 59:
```
- set:
field: host.ip
value: '{{{source.ip}}}'
if: ctx.source?.ip != null
```

Per [the vendor documentation of the globalprotect](https://docs.paloaltonetworks.com/pan-os/10-2/pan-os-admin/monitoring/use-syslog-for-monitoring/syslog-field-descriptions/globalprotect-log-fields) events, these are client details thus these values should go to the client fields. Our users reported this problem.

| Field | Description |
| --- | --- |
|Machine Name (machinename) | The name of the user’s machine.
|Client OS (client_os)|The client device’s OS type (for example, Windows or Linux).|
|Client OS Version (client_os_ver)|The client device’s OS version.|

### Event Original

_No response_

### What did you do?

I changed the globalprotect pipeline to be aligned with the vendor documentation:

```
- lowercase:
target_field: client.name
field: panw.panos.machine.name
if: ctx.panw?.panos?.machine?.name != null
- set:
field: client.os.family
copy_from: panw.panos.client.os
ignore_failure: true
- set:
field: client.os.full
copy_from: panw.panos.client.os_version
ignore_failure: true
```

also at line 59 i deleted the host.ip value assignment
```
- set:
field: client.ip
value: '{{{source.ip}}}'
if: ctx.source?.ip != null
```

### What did you see?

Client details are in host.* fields.

### What did you expect to see?

I'm seeing, after the changes i've done, the client details in the client fields

### Anything else?

_No response_

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.