ThreatID and CVE

[amansour]

Hi Out there. For users of SIEM, some have Vulnerability scanners, anti-virus and other tools reporting CVE through syslog.   In most cases the logs from PAN have threatID, other than the special Splunk integration does anyone know of a way to get the annotatations/descriptions into the log and/or publish the CVE against it, I do see it referenced inside the threat database, but not in the logs.

[mikand · Accepted solution]

According to the syslog integration guide there is no such variable available that would inform through syslog which CVE was matched in the THREAT log.

So I would suggest you to contact your SE and file this as a feature request.