[role="xpack"]

:modulename: panw
:has-dashboards: true

== Palo Alto Networks module

beta[]

This is a module for Palo Alto Networks PAN-OS firewall monitoring logs received
over Syslog or read from a file. It currently supports messages of Traffic and
Threat types.

include::../include/gs-link.asciidoc[]

[float]
=== Compatibility

This module has been tested with logs generated by devices running PAN-OS
versions 7.1 to 9.0 but limited compatibility is expected for earlier versions.

The {plugins}/ingest-geoip.html[ingest-geoip]
Elasticsearch plugin is required to run this module.

include::../include/configuring-intro.asciidoc[]

The module is by default configured to run via syslog on port 9001. However
it can also be configured to read logs from a file. See the following example.

["source","yaml",subs="attributes"]
-----
- module: panw
  panos:
    enabled: true
    var.paths: ["/var/log/pan-os.log"]
    var.input: "file"
-----

:fileset_ex: panos

include::../include/config-option-intro.asciidoc[]

[float]
==== `panos` fileset settings

Example config:

[source,yaml]
----
  panos:
    var.syslog_host: 0.0.0.0
    var.syslog_port: 514
----

include::../include/var-paths.asciidoc[]

*`var.syslog_host`*::

The interface to listen to UDP based syslog traffic. Defaults to `localhost`.
Set to `0.0.0.0` to bind to all available interfaces.

*`var.syslog_port`*::

The UDP port to listen for syslog traffic. Defaults to `9001`

NOTE: Ports below 1024 require {beatname_uc} to run as root.

include::../include/timezone-support.asciidoc[]

[float]
=== ECS field mappings

These are the PAN-OS to ECS field mappings as well as those fields still not
in ECS that are added under the `panw.panos` prefix:

.Traffic log mappings
[options="header"]
|==============
| PAN-OS Field | ECS Field | Non-standard field
| Receive Time | event.created |
| Serial Number | observer.serial_number |
| Type | event.category |
| Subtype | event.action |
| Generated Time | `@timestamp` |
| Source IP | client.ip source.ip |
| Destination IP | server.ip destination.ip |
| NAT Source IP |  | panw.panos.source.nat.ip
| NAT Destination IP |  | panw.panos.destination.nat.ip
| Rule Name |  | panw.panos.ruleset
| Source User | client.user.name source.user.name |
| Destination User | server.user.name destination.user.name |
| Application | network.application |
| Source Zone |  | panw.panos.source.zone
| Destination Zone |  | panw.panos.destination.zone
| Ingress Interface |  | panw.panos.source.interface
| Egress Interface |  | panw.panos.destination.interface
| Session ID |  | panw.panos.flow_id
| Source Port | client.port source.port |
| Destination Port | destination.port server.port |
| NAT Source Port |  | panw.panos.source.nat.port
| NAT Destination Port |  | panw.panos.destination.nat.port
| Flags | labels |
| Protocol | network.transport |
| Action | event.outcome |
| Bytes | network.bytes |
| Bytes Sent | client.bytes destination.bytes |
| Bytes Received | server.bytes source.bytes |
| Packets | network.packets |
| Start Time | event.start |
| Elapsed Time | event.duration |
| Category |  | panw.panos.url.category
| Sequence Number |  | panw.panos.sequence_number
| Packets Sent | server.packets destination.packets |
| Packets Received | client.packets source.packets |
| Device Name | observer.hostname |
|==============

.Threat logs mappings
[options="header"]
|==============
| PAN-OS Field | ECS Field | Non-standard field
| Receive Time | event.created |
| Serial Number | observer.serial_number |
| Type | event.category |
| Subtype | event.action |
| Generated Time | `@timestamp` |
| Source IP | client.ip source.ip |
| Destination IP | server.ip destination.ip |
| NAT Source IP |  | panw.panos.source.nat.ip
| NAT Destination IP |  | panw.panos.destination.nat.ip
| Rule Name |  | panw.panos.ruleset
| Source User | client.user.name source.user.name |
| Destination User | server.user.name destination.user.name |
| Application | network.application |
| Source Zone |  | panw.panos.source.zone
| Destination Zone |  | panw.panos.destination.zone
| Ingress Interface |  | panw.panos.source.interface
| Egress Interface |  | panw.panos.destination.interface
| Session ID |  | panw.panos.flow_id
| Source Port | client.port source.port |
| Destination Port | destination.port server.port |
| NAT Source Port |  | panw.panos.source.nat.port
| NAT Destination Port |  | panw.panos.destination.nat.port
| Flags | labels |
| Protocol | network.transport |
| Action | event.outcome |
| Miscellaneous | url.original | panw.panos.threat.resource
| Threat ID |  | panw.panos.threat.id
| Category |  | panw.panos.url.category
| Severity | log.level |
| Direction | network.direction |
| Source Location | source.geo.name |
| Destination Location | destination.geo.name |
| PCAP_id |  | panw.panos.network.pcap_id
| Filedigest |  | panw.panos.file.hash
| User Agent | user_agent.original |
| File Type | file.type |
| X-Forwarded-For | network.forwarded_ip |
| Referer | http.request.referer |
| Sender | source.user.email |
| Subject |  | panw.panos.subject
| Recipient | destination.user.email |
| Device Name | observer.hostname |
|==============

[float]
=== Example dashboard

This module comes with two sample dashboards:

[role="screenshot"]
image::./images/filebeat-panw-traffic.png[]

[role="screenshot"]
image::./images/filebeat-panw-threat.png[]

:has-dashboards!:

:fileset_ex!:

:modulename!:
