elastic / elastic/integrations

[Palo Alto Next-Gen Firewall]: logs-panw.panos-5.4.0 Ingest Pipeline references no integration pipelines.

Open
#16,563 3 comments 0 reactions 0 assignees View on GitHub
Integration:panw needs:triage Team:Integration-Experience
Dominant language
Handlebars
Stars
333
Forks
647
Avg merge
2d 17h
Merged PRs (30d)
225

Description

### Integration Name

Palo Alto Next-Gen Firewall [panw]

### Dataset Name

panw.panos

### Integration Version

5.4.0

### Agent Version

9.2.1

### Agent Output Type

elasticsearch

### Elasticsearch Version

9.2.1

### OS Version and Architecture

Windows Server 2019

### Software/API Version

_No response_

### Error Message

Integration point to the pipeline `logs-panw.panos-5.4.0`.

Pipeline configuration

```
[
{
"pipeline": {
"name": "global@custom",
"ignore_missing_pipeline": true,
"description": "[Fleet] Global pipeline for all data streams"
}
},
{
"pipeline": {
"name": "logs@custom",
"ignore_missing_pipeline": true,
"description": "[Fleet] Pipeline for all data streams of type `logs`"
}
},
{
"pipeline": {
"name": "logs-panw.integration@custom",
"ignore_missing_pipeline": true,
"description": "[Fleet] Pipeline for all data streams of type `logs` defined by the `panw` integration"
}
},
{
"pipeline": {
"name": "logs-panw.panos@custom",
"ignore_missing_pipeline": true,
"description": "[Fleet] Pipeline for the `panw.panos` dataset"
}
}
]
```

### Event Original

_No response_

### What did you do?

I installed a fresh copy of the Palo Alto Next-Gen Firewall v5.4.0 Integration.

### What did you see?

Collect logs via syslog over TCP:

Image

logs-panw.panos-5.4.0 pipeline config:

```
[
{
"pipeline": {
"name": "global@custom",
"ignore_missing_pipeline": true,
"description": "[Fleet] Global pipeline for all data streams"
}
},
{
"pipeline": {
"name": "logs@custom",
"ignore_missing_pipeline": true,
"description": "[Fleet] Pipeline for all data streams of type `logs`"
}
},
{
"pipeline": {
"name": "logs-panw.integration@custom",
"ignore_missing_pipeline": true,
"description": "[Fleet] Pipeline for all data streams of type `logs` defined by the `panw` integration"
}
},
{
"pipeline": {
"name": "logs-panw.panos@custom",
"ignore_missing_pipeline": true,
"description": "[Fleet] Pipeline for the `panw.panos` dataset"
}
}
]
```

### What did you expect to see?

The integration should make use of `logs-panw.panos-5.4.0-default` and reference all the other logs-panw.panos-* pipelines.

### Anything else?

Also, the name of the integration change from `Palo Alto Networks Logs` to
`Palo Alto Next-Gen Firewall`. This is likely unrelated to the issue, but an obsevation.

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.