topic Re: Traps Hash correlation with syslog miner in General Topics

Traps Hash correlation with syslog miner

mr_best — Tue, 28 Mar 2017 21:00:36 GMT

Hi Luigi,

I have 2 issues that I believe you can address.

I am building out the syslog miner and got it working for NGFW traffic logs. I also enabled my Traps ESM to send syslog to Minemeld. I see there is a rulebase for parsing traffic and threat syslog, but I want to build a Traps miner. Is this supported? It would be great if I can send at least hashes to Minemeld to correlate with what AF sees.
Threat logs don’t seem to be working, no hits on the rules with type == ‘THREAT’ for PanOS 8.0 - this works on 7.1
- Is it a matter of adding "rule=TRAFFIC,TRAFFIC_FIELDS_8_0" to the /etc/rsyslog.d/palo_alto_networks.rb file?

Thanx

Re: Traps Hash correlation with syslog miner

lmori — Thu, 30 Mar 2017 12:24:45 GMT

Hi @mr_best,

1 - not yet, but we could add this. We just need to update the rulebase to support Traps syslog messages. I will investigate this - it's good use case

2 - is the problem with Threat logs or with Traffic logs in 8.0 ?

Thanks !
luigi

Re: Traps Hash correlation with syslog miner

mr_best — Tue, 11 Apr 2017 20:45:18 GMT

Perfect @lmori, let me know if you need anything.

For 8.0, it's the threat and URL logs. Traffic works fine

P.s. So originally I replied to the email which apparently didn't go anywhere.

Re: Traps Hash correlation with syslog miner

lmori — Thu, 27 Apr 2017 15:45:40 GMT

Hi @mr_best,

this should be supported in the next release of MM (0.9.38). Sorry for the delay.

luigi

Re: Traps Hash correlation with syslog miner

mr_best — Thu, 27 Apr 2017 15:50:32 GMT

@lmori Thanx!

Any more thought to the hash or traps logs to MM?

Re: Traps Hash correlation with syslog miner

lmori — Thu, 27 Apr 2017 15:52:26 GMT

That is definitely doable and a great idea, I will look into this and let you know.

Re: Traps Hash correlation with syslog miner

mr_best — Wed, 13 Dec 2017 06:28:40 GMT

hi @lmori Just circling back on this. Were you able to add/test this feature?