Traps Hash correlation with syslog miner

[mr_best]

Hi Luigi, 

I have 2 issues that I believe you can address.

1. I am building out the syslog miner and got it working for NGFW traffic logs. I also enabled my Traps ESM to send syslog to Minemeld. I see there is a rulebase for parsing traffic and threat syslog, but I want to build a Traps miner. Is this supported?  It would be great if I can send at least hashes to Minemeld to correlate with what AF sees.
2. Threat logs don’t seem to be working, no hits on the rules with type == ‘THREAT’ for PanOS 8.0 - this works on 7.1
   • Is it a matter of adding "rule=TRAFFIC,TRAFFIC_FIELDS_8_0" to the /etc/rsyslog.d/palo_alto_networks.rb file?

Thanx

[lmori · Accepted solution]

Hi @mr_best,

this should be supported in the next release of MM (0.9.38). Sorry for the delay.

luigi

[lmori]

Hi @mr_best,

1 - not yet, but we could add this. We just need to update the rulebase to support Traps syslog messages. I will investigate this - it's good use case

2 - is the problem with Threat logs or with Traffic logs in 8.0 ?

Thanks !
luigi

[mr_best]

Perfect @lmori, let me know if you need anything.

For 8.0, it's the threat and URL logs. Traffic works fine

P.s. So originally I replied to the email which apparently didn't go anywhere.

[lmori · Accepted solution]

Hi @mr_best,

this should be supported in the next release of MM (0.9.38). Sorry for the delay.

luigi

[mr_best]

@lmori Thanx! 

Any more thought to the hash or traps logs to MM?

[lmori]

That is definitely doable and a great idea, I will look into this and let you know.

[mr_best]

hi @lmori Just circling back on this. Were you able to add/test this feature?