About pschoenegger-gm

Hi, how can we achieve creating additional fields for logs being processed in "CommonSecurityLog" (https://docs.microsoft.com/en-us/azure/azure-monitor/reference/tables/commonsecuritylog) when sending in logs using the described log connector from Azure Sentinel using Syslog? At the moment incoming data gets mapped to fields like "DeviceCustomString1" or "DeviceCustomString1Label" using CEF. Is it possible creating additional/custom fields in "CommonSecurityLog"?!   We try connecting Palo Alto Networks firewalling infrastructure to Azure Log Analytics / Sentinel exactly following the guide (Azure Sentinel workspaces > Azure Sentinel | Data connectors > Palo Alto Networks) in Sentinel but we see a lot of incoming data being mapped to fields like "DeviceCustomString1" which don't have a characteristic name. (e.g. "Session ID" -> "DeviceCustomString1", Rule Name -> "DeviceCustomString2"). The real field names get stored in the label fields like "DeviceCustomString2Label".   Many thanks and really appreciate your help on that!!   ... View more

Hi,   Any ideas on better controlling what gets transferred over a decrypted (by the Palo Alto's ssh decryption feature) SSH session.   I don't see an option blocking file up- or downloads via the fileblocking feature for SSH or an other corresponding protocol, nor is it possible creating a custom definition (for what's being transferred within SSH).   The Palo Alto is telling me that it has "Decrypted" the SSH session, but no way of controling protocols or files in there...   Probably some of you have had the same thing coming up and know a little more...   Thanks and best regards,   Peter ... View more