This repository was archived by the owner on Apr 25, 2025. It is now read-only.
Repository navigation
Expand file tree
/
Copy pathPalo_Alto_humio_parser
More file actions
94 lines (94 loc) · 10.3 KB
/
Copy pathPalo_Alto_humio_parser
File metadata and controls
94 lines (94 loc) · 10.3 KB
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
// ##Palo_Alto_Humio_Parser
// ## FU fields are "future use" according to PaloAlto
// CSV column names taken from https://docs.paloaltonetworks.com/pan-os/8-1/pan-os-admin/monitoring/use-syslog-for-monitoring/syslog-field-descriptions.html
// Globalprotect column names taken from https://docs.paloaltonetworks.com/pan-os/9-1/pan-os-admin/monitoring/use-syslog-for-monitoring/syslog-field-descriptions/globalprotect-log-fields/globalprotect-log-fields-for-pan-os-913-and-later-releases.html
/^(?<sysLogDateTime>\S+\s+\S+\s+\S+)\s+(?<domain>\S+)\s+(?<csv_data>.*)/
| parseCSV(csv_data, columns=[_fu1, ReceiveTime, SerialNumber, Type])
// Parse the remaining fields based on the Type
| case {
Type=TRAFFIC
| parseCSV(csv_data, columns=[
_fu1, ReceiveTime, SerialNumber, Type, Threat_ContentType, _fu2, GeneratedTime, SourceIP, DestinationIP, NATSourceIP, NATDestinationIP, RuleName, SourceUser, DestinationUser, Application, VirtualSystem, SourceZone, DestinationZone, InboundInterface, OutboundInterface, LogAction, _fu3, SessionID, RepeatCount, SourcePort, DestinationPort, NATSourcePort, NATDestinationPort, Flags, Protocol, Action, Bytes, BytesSent, BytesReceived, Packets, StartTime, ElapsedTime, Category, _fu4, SequenceNumber, ActionFlags, SourceLocation, DestinationLocation, _fu5, PacketsSent, PacketsReceived, SessionEndReason, DeviceGroupHierarchyLevel1, DeviceGroupHierarchyLevel2, DeviceGroupHierarchyLevel3, DeviceGroupHierarchyLevel4, VirtualSystemName, DeviceName, ActionSource, SourceVMUUID, DestinationVMUUID, TunnelID_IMSI, MonitorTag_IMEI, ParentSessionID, ParentStartTime, TunnelType, SCTPAssociationID, SCTPChunks, SCTPChunksSent, SCTPChunksReceived
])
| parseTimestamp(field="ReceiveTime", format="yyyy/MM/dd HH:mm:ss", timezone="UTC")
// | drop([_fu1, _fu2, _fu3, _fu4, _fu5])
;
Type=THREAT
| parseCSV(csv_data, columns=[
_fu1, ReceiveTime, SerialNumber, Type, Threat_ContentType, _fu2, GeneratedTime, SourceIP, DestinationIP, NATSourceIP, NATDestinationIP, RuleName, SourceUser, DestinationUser, Application, VirtualSystem, SourceZone, DestinationZone, InboundInterface, OutboundInterface, LogAction, _fu3, SessionID, RepeatCount, SourcePort, DestinationPort, NATSourcePort, NATDestinationPort, Flags, Protocol, Action, URL_Filename, ThreatID, Category, Severity, Direction, SequenceNumber, ActionFlags, SourceLocation, DestinationLocation, _fu4, ContentType, PCAP_ID, FileDigest, Cloud, URLIndex, UserAgent, FileType, "X-Forwarded-For", Referer, Sender, Subject, Recipient, ReportID, DeviceGroupHierarchyLevel1, DeviceGroupHierarchyLevel2, DeviceGroupHierarchyLevel3, DeviceGroupHierarchyLevel4, VirtualSystemName, DeviceName, _fu5, SourceVMUUID, DestinationVMUUID, HTTPMethod, TunnelID_IMSI, MonitorTag_IMEI, ParentSessionID, ParentStartTime, TunnelType, ThreatCategory, ContentVersion, _fu6, SCTPAssociationID, PayloadProtocolID, HTTPHeaders
])
| parseTimestamp(field="ReceiveTime", format="yyyy/MM/dd HH:mm:ss", timezone="UTC")
// | drop([_fu1, _fu2, _fu3, _fu4, _fu5, _fu6])
;
Type="HIP-MATCH"
| parseCSV(csv_data, columns=[
_fu1, ReceiveTime, SerialNumber, Type, Threat_ContentType, _fu2, GeneratedTime, SourceUser, VirtualSystem, Machinename, OS, SourceAddress, HIP, RepeatCount, HIPType, _fu3, _fu4, SequenceNumber, ActionFlags, DeviceGroupHierarchyLevel1, DeviceGroupHierarchyLevel2, DeviceGroupHierarchyLevel3, DeviceGroupHierarchyLevel4, VirtualSystemName, DeviceName, VirtualSystemID, IPv6SourceAddress, HostID
])
| parseTimestamp(field="ReceiveTime", format="yyyy/MM/dd HH:mm:ss", timezone="UTC")
// | drop([_fu1, _fu2, _fu3, _fu4])
;
Type="USERID"
| parseCSV(csv_data, columns=[
FUTURE_USER, ReceiveTime, SerialNumber, Type, Threat_ContentType, _fu1, GeneratedTime, VirtualSystem, SourceIP, User, DataSourceName, EventID, RepeatCount, TimeOutThreshold, SourcePort, DestinationPort, DataSource, DataSourceType, SequenceNumber, ActionFlags, DeviceGroupHierarchyLevel1, DeviceGroupHierarchyLevel2, DeviceGroupHierarchyLevel3, DeviceGroupHierarchyLevel4, VirtualSystemName, DeviceName, VirtualSystemID, FactorType, FactorCompletionTime, FactorNumber, _fu2, _fu3, UserGroupFlags, SourcebyUser
])
| parseTimestamp(field="ReceiveTime", format="yyyy/MM/dd HH:mm:ss", timezone="UTC")
// | drop([_fu1, _fu2, _fu3])
;
Type="START" OR Type="END"
| parseCSV(csv_data, columns=[
_fu1, ReceiveTime, SerialNumber, Type, Subtype, _fu2, GeneratedTime, SourceIP, DestinationIP, NATSourceIP, NATDestinationIP, RuleName, SourceUser, DestinationUser, Application, VirtualSystem, SourceZone, DestinationZone, InboundInterface, OutboundInterface, LogAction, _fu3, SessionID, RepeatCount, SourcePort, DestinationPort, NATSourcePort, NATDestinationPort, Flags, Protocol, Action, Severity, SequenceNumber, ActionFlags, SourceLocation, DestinationLocation, DeviceGroupHierarchyLevel1, DeviceGroupHierarchyLevel2, DeviceGroupHierarchyLevel3, DeviceGroupHierarchyLevel4, VirtualSystemName, DeviceName, TunnelID_IMSI, MonitorTag_IMEI, ParentSessionID, ParentStartTime, Tunnel, Bytes, BytesSent, BytesReceived, Packets, PacketsSent, PacketsReceived, MaximumEncapsulation, UnknownProtocol, StrictCheck, TunnelFragment, SessionsCreated, SessionsClosed, SessionEndReason, ActionSource, StartTime, ElapsedTime, TunnelInspectionRule
])
| parseTimestamp(field="ReceiveTime", format="yyyy/MM/dd HH:mm:ss", timezone="UTC")
// | drop([_fu1, _fu2, _fu3])
;
Type="SCTP"
| parseCSV(csv_data, columns=[
_fu1, ReceiveTime, SerialNumber, Type, _fu2, _fu3, GeneratedTime, SourceAddress, DestinationAddress, _fu4, _fu5, RuleName, _fu6, _fu7, _fu8, VirtualSystem, SourceZone, DestinationZone, InboundInterface, OutboundInterface, LogAction, _fu9, SessionID, RepeatCount, SourcePort, DestinationPort, _fu10, _fu11, _fu12, _fu13, IPProtocol, Action, DeviceGroupHierarchyLevel1, DeviceGroupHierarchyLevel2, DeviceGroupHierarchyLevel3, DeviceGroupHierarchyLevel4, VirtualSystemName, DeviceName, SequenceNumber, _fu14, SCTPAssociationID, PayloadProtocolID, Severity, SCTPChunkType, _fu15, SCTPVerificationTag1, SCTPVerificationTag2, SCTPCauseCode, DiameterAppID, DiameterCommandCode, DiameterAVPCode, SCTPStreamID, SCTPAssociationEndReason, OpCode, SCCPCallingPartySSN, SCCPCallingPartyGlobalTitle, SCTPFilter, SCTPChunks, SCTPChunksSent, SCTPChunksReceived, Packets, PacketsSent, PacketsReceived
])
| parseTimestamp(field="ReceiveTime", format="yyyy/MM/dd HH:mm:ss", timezone="UTC")
// | drop([_fu1, _fu2, _fu3, _fu4, _fu5, _fu6, _fu7, _fu8, _fu9, _fu10, _fu11, _fu12, _fu13, _fu14, _fu15])
;
Type="CONFIG"
| parseCSV(csv_data, columns=[
_fu1, ReceiveTime, SerialNumber, Type, Threat_ContentType, _fu2, GeneratedTime, Host, VirtualSystem, Command, Admin, Client, Result, ConfigurationPath, BeforeChangeDetail, AfterChangeDetail, SequenceNumber, ActionFlags, DeviceGroupHierarchyLevel1, DeviceGroupHierarchyLevel2, DeviceGroupHierarchyLevel3, DeviceGroupHierarchyLevel4, VirtualSystemName, DeviceName
])
| parseTimestamp(field="ReceiveTime", format="yyyy/MM/dd HH:mm:ss", timezone="UTC")
// | drop([_fu1, _fu2])
;
Type="AUTHENTICATION"
| parseCSV(csv_data, columns=[
_fu1, ReceiveTime, SerialNumber, Type, Threat_ContentType, _fu2, GeneratedTime, VirtualSystem, SourceIP, User, NormalizeUser, Object, AuthenticationPolicy, RepeatCount, AuthenticationID, Vendor, LogAction, ServerProfile, Description, ClientType, EventType, FactorNumber, SequenceNumber, ActionFlags, DeviceGroupHierarchy1, DeviceGroupHierarchy2, DeviceGroupHierarchy3, DeviceGroupHierarchy4, VirtualSystemName, DeviceName, VirtualSystemID, AuthenticationProtocol
])
| parseTimestamp(field="ReceiveTime", format="yyyy/MM/dd HH:mm:ss", timezone="UTC")
// | drop([_fu1, _fu2])
;
Type="SYSTEM"
| parseCSV(csv_data, columns=[
_fu1, ReceiveTime, SerialNumber, Type, Content_ThreatType, _fu2, GeneratedTime, VirtualSystem, EventID, Object, _fu3, _fu4, Module, Severity, Description, SequenceNumber, ActionFlags, DeviceGroupHierarchyLevel1, DeviceGroupHierarchyLevel2, DeviceGroupHierarchyLevel3, DeviceGroupHierarchyLevel4, VirtualSystemName, DeviceName
])
| parseTimestamp(field="ReceiveTime", format="yyyy/MM/dd HH:mm:ss", timezone="UTC")
// | drop([_fu1, _fu2, _fu3, _fu4])
;
Type="CORRELATION"
| parseCSV(csv_data, columns=[
_fu1, ReceiveTime, SerialNumber, Type, Content_ThreatType, _fu2, GeneratedTime, SourceAddress, SourceUser, VirtualSystem, Category, Severity, DeviceGroupHierarchyLevel1, DeviceGroupHierarchyLevel2, DeviceGroupHierarchyLevel3, DeviceGroupHierarchyLevel4, VirtualSystemName, DeviceName, VirtualSystemID, ObjectName, ObjectID, Evidence
])
| parseTimestamp(field="ReceiveTime", format="yyyy/MM/dd HH:mm:ss", timezone="UTC")
// | drop([_fu1, _fu2])
;
Type="GTP"
| parseCSV(csv_data, columns=[
_fu1, ReceiveTime, SerialNumber, Type, Threat_ContentType, _fu2, GeneratedTime, SourceAddress, DestinationAddress, _fu3, _fu4, RuleName, _fu5, _fu6, Application, VirtualSystem, SourceZone, DestinationZone, InboundInterface, OutboundInterface, LogAction, _fu7, SessionID, _fu8, SourcePort, DestinationPort, _fu9, _fu10, _fu11, Protocol, Action, GTPEventType, MSISDN, AccessPointName, RadioAccessTechnology, GTPMessageType, EndUserIPAddress, TunnelEndpointIdentifier1, TunnelEndpointIdentifier2, GTPInterface, GTPCause, Severity, ServingCountryMCC, ServingNetworkMNC, AreaCode, CellID, GTPEventCode, _fu12, _fu13, SourceLocation, DestinationLocation, _fu14, _fu15, _fu16, _fu17, _fu18, _fu19, _fu20, TunnelID_IMSI, MonitorTag_IMEI, _fu21, _fu22, _fu23, _fu24, _fu25, _fu26, _fu27, _fu28, _fu29, _fu30, _fu31, _fu32, _fu33, _fu34, _fu35, _fu36, StartTime, ElapsedTime, TunnelInspectionRule
])
| parseTimestamp(field="ReceiveTime", format="yyyy/MM/dd HH:mm:ss", timezone="UTC")
// | drop([_fu1, _fu2, _fu3, _fu4, _fu5, _fu6, _fu7, _fu8, _fu9, _fu10, _fu11, _fu12, _fu13, _fu14, _fu15, _fu16, _fu17, _fu18, _fu19, _fu20, _fu21, _fu22, _fu23, _fu24, _fu25, _fu26, _fu27, _fu28, _fu29, _fu30, _fu31, _fu32, _fu33, _fu34, _fu35, _fu36])
;
Type="GLOBALPROTECT"
| parseCSV(csv_data, columns=[
_fu1, ReceiveTime, SerialNumber, Type, Threat_ContentType, _fu2, GeneratedTime, VirtualSystem, EventID, Stage, AuthenticationMethod, TunnelType, SourceUser, SourceRegion, MachineName, PublicIP, PublicIPv6, PrivateIP, PrivateIPv6, HostID, UserSerialNumber, ClientVersion, ClientOS, ClientOSVersion, RepeatCount, Reason, Error, Description, Status, Location, LoginDuration, ConnectMethod, ErrorCode, Portal, SequenceNumber, ActionFlags
])
| parseTimestamp(field="ReceiveTime", format="yyyy/MM/dd HH:mm:ss", timezone="UTC")
// | drop([_fu1, _fu2])
;
* | _unsupported := "True"
}