input.yml

{{ if eq .input "syslog" }}

type: syslog
protocol.udp:
  host: "{{.syslog_host}}:{{.syslog_port}}"

{{ else if eq .input "file" }}

type: log
paths:
{{ range $i, $path := .paths }}
  - {{$path}}
{{ end }}
exclude_files: [".gz$"]

{{ end }}

tags: {{.tags | tojson}}
publisher_pipeline.disable_host: {{ inList .tags "forwarded" }}

fields_under_root: true
fields:
  observer:
    vendor: Palo Alto Networks
    product: PAN-OS
    type: firewall

processors:
  - add_locale: ~

  - decode_csv_fields:
      fields:
        message: csv

  - extract_array:
      field: csv
      overwrite_keys: true
      omit_empty: true
      mappings:
        _temp_.ietf_header: 0
        event.created: 1
        observer.serial_number: 2
        panw.panos.type: 3
        panw.panos.sub_type: 4
        _temp_.generated_time: 6

  - extract_array:
      when:
        equals:
          panw.panos.type: TRAFFIC
      field: csv
      overwrite_keys: true
      omit_empty: true
      fail_on_error: false
      mappings:
        client.ip: 7
        source.ip: 7
        source.address: 7
        server.ip: 8
        destination.ip: 8
        destination.address: 8
        source.nat.ip: 9
        client.nat.ip: 9
        destination.nat.ip: 10
        server.nat.ip: 10
        panw.panos.ruleset: 11
        client.user.name: 12
        source.user.name: 12
        server.user.name: 13
        destination.user.name: 13
        network.application: 14
        panw.panos.virtual_sys: 15
        panw.panos.source.zone: 16
        observer.ingress.zone: 16
        panw.panos.destination.zone: 17
        observer.egress.zone: 17
        panw.panos.source.interface: 18
        observer.ingress.interface.name: 18
        panw.panos.destination.interface: 19
        observer.egress.interface.name: 19
        panw.panos.flow_id: 22
        client.port: 24
        source.port: 24
        destination.port: 25
        server.port: 25
        source.nat.port: 26
        client.nat.port: 26
        destination.nat.port: 27
        server.nat.port: 27
        _temp_.labels: 28
        network.transport: 29
        panw.panos.action: 30
        network.bytes: 31
        client.bytes: 32
        source.bytes: 32
        server.bytes: 33
        destination.bytes: 33
        network.packets: 34
        event.start: 35
        event.duration: 36
        panw.panos.url.category: 37
        panw.panos.sequence_number: 39
        client.packets: 44
        source.packets: 44
        server.packets: 45
        destination.packets: 45
        panw.panos.endreason: 46
        observer.hostname: 52

  - extract_array:
      when:
       equals:
          panw.panos.type: THREAT
      field: csv
      omit_empty: true
      overwrite_keys: true
      fail_on_error: false
      mappings:
        client.ip: 7
        source.ip: 7
        source.address: 7
        server.ip: 8
        destination.ip: 8
        destination.address: 8
        source.nat.ip: 9
        client.nat.ip: 9
        destination.nat.ip: 10
        server.nat.ip: 10
        panw.panos.ruleset: 11
        client.user.name: 12
        source.user.name: 12
        server.user.name: 13
        destination.user.name: 13
        network.application: 14
        panw.panos.virtual_sys: 15
        panw.panos.source.zone: 16
        observer.ingress.zone: 16
        panw.panos.destination.zone: 17
        observer.egress.zone: 17
        panw.panos.source.interface: 18
        observer.ingress.interface.name: 18
        panw.panos.destination.interface: 19
        observer.egress.interface.name: 19
        panw.panos.flow_id: 22
        client.port: 24
        source.port: 24
        destination.port: 25
        server.port: 25
        source.nat.port: 26
        client.nat.port: 26
        destination.nat.port: 27
        server.nat.port: 27
        _temp_.labels: 28
        network.transport: 29
        panw.panos.action: 30
        panw.panos.threat.resource: 31
        url.original: 31
        panw.panos.threat.name: 32
        panw.panos.url.category: 33
        log.level: 34
        _temp_.direction: 35
        _temp_.srcloc: 38
        _temp_.dstloc: 39
        panw.panos.network.pcap_id: 42
        panw.panos.file.hash: 43
        user_agent.original: 46
        file.type: 47
        network.forwarded_ip: 48
        http.request.referer: 49
        source.user.email: 50
        panw.panos.subject: 51
        destination.user.email: 52
        observer.hostname: 59

  - extract_array:
      when:
       equals:
          panw.panos.type: GLOBALPROTECT
      field: csv
      omit_empty: true
      overwrite_keys: true
      fail_on_error: false
      mappings:
        panw.panos.virtual_sys: 7
        event.code: 8
        panw.panos.stage: 9
        panw.panos.auth_method: 10
        panw.panos.tunnel_type: 11
        _temp_.srcuser: 12
        _temp_.srcloc: 13
        host.name: 14
        source.nat.ip: 15
        client.nat.ip: 15
        _temp_.public_ipv6: 16
        host.ip: 17
        source.ip: 17
        client.ip: 17
        source.address: 17
        client.address: 17
        _temp_.private_ipv6: 18
        host.id: 19
        panw.panos.serial_number: 20
        panw.panos.client_ver: 21
        host.os.family: 22
        host.os.full: 23
        panw.panos.repeatcnt: 24
        event.reason: 25
        panw.panos.error: 26
        panw.panos.description: 27
        event.outcome: 28
        observer.geo.name: 29
        event.duration: 30
        panw.panos.connect_method: 31
        panw.panos.error_code: 32
        observer.hostname: 33
        panw.panos.sequence_number: 34
        panw.panos.actionflags: 35
        panw.panos.selection_type: 37
        panw.panos.response_time: 38
        panw.panos.priority: 39
        panw.panos.attempted_gateways: 40
        panw.panos.gateway: 41

  - extract_array:
      when:
       equals:
          panw.panos.type: USERID
      field: csv
      omit_empty: true
      overwrite_keys: true
      fail_on_error: false
      mappings:
        event.action: 4
        panw.panos.virtual_sys: 7
        client.ip: 8
        source.ip: 8
        source.address: 8
        _temp_.srcuser: 9
        panw.panos.datasourcename: 10
        event.code: 11
        panw.panos.repeatcnt: 12
        panw.panos.timeout: 13
        source.port: 14
        client.port: 14
        destination.port: 15
        server.port: 15
        panw.panos.datasource: 16
        panw.panos.datasourcetype: 17
        panw.panos.sequence_number: 18
        panw.panos.actionflags: 19
        panw.panos.device_group_hierarchy.level_1: 20
        panw.panos.device_group_hierarchy.level_2: 21
        panw.panos.device_group_hierarchy.level_3: 22
        panw.panos.device_group_hierarchy.level_4: 23
        panw.panos.vsys_name: 24
        observer.hostname: 25
        panw.panos.vsys_id: 26
        panw.panos.factortype: 27
        panw.panos.factorcompletiontime: 28
        panw.panos.factorno: 29
        panw.panos.ugflags: 30
        source.user.name: 31
        client.user.name: 31

  - extract_array:
      when:
        or:
          - equals:
              panw.panos.type: HIPMATCH
          - equals:
              panw.panos.type: HIP-MATCH
      field: csv
      omit_empty: true
      overwrite_keys: true
      fail_on_error: false
      mappings:
        _temp_.srcuser: 7
        panw.panos.virtual_sys: 8
        host.name: 9
        host.os.full: 10
        client.ip: 11
        source.ip: 11
        source.address: 11
        panw.panos.matchname: 12
        panw.panos.repeatcnt: 13
        panw.panos.matchtype: 14
        panw.panos.sequence_number: 17
        panw.panos.actionflags: 18
        panw.panos.device_group_hierarchy.level_1: 19
        panw.panos.device_group_hierarchy.level_2: 20
        panw.panos.device_group_hierarchy.level_3: 21
        panw.panos.device_group_hierarchy.level_4: 22
        panw.panos.vsys_name: 23
        observer.hostname: 24
        panw.panos.vsys_id: 25
        _temp_.source_ipv6: 26
        host.id: 27
        panw.panos.serial_number: 28
        host.mac: 29


  - drop_fields:
      fields:
        - csv

{{ if .external_zones }}
  - add_fields:
      target: _temp_
      fields:
        external_zones: {{ .external_zones | tojson }}
{{ end }}

{{ if .internal_zones }}
  - add_fields:
      target: _temp_
      fields:
        internal_zones: {{ .internal_zones | tojson }}
{{ end }}


  # Copy NAT data from ECS fields to the original non-ECS fields to retain
  # backward compatibility. This should be removed for 8.0.
  - convert:
      ignore_missing: true
      fields:
        - {from: source.nat.ip, to: panw.panos.source.nat.ip, type: ip}
        - {from: destination.nat.ip, to: panw.panos.destination.nat.ip, type: ip}
        - {from: source.nat.port, to: panw.panos.source.nat.port, type: long}
        - {from: destination.nat.port, to: panw.panos.destination.nat.port, type: long}
  - add_fields:
      target: ''
      fields:
        ecs.version: 1.12.0