Parsing rule for tagging data from a specific broker-vm

[PA_nts]

Hi All,

has anyone done this to date yet?

I have a broker-vm deployed  in a specific region and want to tag any and all data from this broker-vm with a custom region tag.. 

anyone written a parsing rule for this as yet and willing to share?

thanks in adv

[PA_nts]

Hi All,

has anyone done this to date yet?

I have a broker-vm deployed  in a specific region and want to tag any and all data from this broker-vm with a custom region tag.. 

anyone written a parsing rule for this as yet and willing to share?

thanks in adv

[eluis]

Hi @PA_nts 

You can find the documentation on how to create parsing rules here
https://docs-cortex.paloaltonetworks.com/r/Cortex-XDR/Cortex-XDR-3.x-Documentation/What-are-Parsing-...

https://docs-cortex.paloaltonetworks.com/r/Cortex-XDR/Cortex-XDR-3.x-Documentation/What-are-Parsing-...

If you feel this has answered your query, please let us know by clicking like and on "mark this as a Solution". 

Thank you.

Luis 

[PA_nts]

Thanks Eluis.. 

but i have already gone though this documentation and not able to find what i am trying to do.. 

in short, i want to use the 'Collect' statement to manipulate the data before Ingest.. as I want to tag all data with one specific tag.

something like this:

[COLLECT:vendor = "*", product= "*", target_brokers= "Broker-VM1", no_hit=drop]
| tag add "test"

but it does not accept the tag function even though it shows it as an available option.

anyways.. have raised this with PAN also.. so hoping they can tell me how to.

thanks