Skip to content
This repository was archived by the owner on Dec 14, 2024. It is now read-only.

Integrate Cortex XDR incidents #166

Merged
merged 12 commits into from
May 8, 2021
Merged

Integrate Cortex XDR incidents #166

merged 12 commits into from
May 8, 2021

Conversation

paulmnguyen
Copy link
Contributor

@paulmnguyen paulmnguyen commented Mar 4, 2021 •
edited by btorresgil
Loading

Description

Support Cortex XDR Incidents in Palo Alto Networks Splunk App and Add-on.

This integration includes

  • Splunk modinput to pull incidents via XDR API. (This integration does not use syslog)
  • New 'Cortex XDR Incident' dashboard which replaces the previous 'All Incidents' dashboard.
  • Splunk Common Information Model (CIM) compliant field extractions
  • Splunk Enterprise Security (ES) notable events

Motivation and Context

Traps has become Cortex XDR, so we will retire Traps support in the Splunk App and Add-on and replace it with Cortex XDR support.

How Has This Been Tested?

Modular input tested with Cortex XDR API in Splunk 8.1.
Incidents and notable events tested in Splunk ES.

Types of changes

  • New feature - Cortex XDR support
  • Breaking change - removes Traps support

Checklist

  • I have updated the documentation accordingly.
  • I have read the CONTRIBUTING document.
  • I have added tests to cover my changes if appropriate.
  • All new and existing tests passed.

@paulmnguyen paulmnguyen added add-on Related to the Splunk Add-On app Related to the Splunk App (not the Add-on) labels Mar 4, 2021
@paulmnguyen paulmnguyen requested a review from btorresgil March 4, 2021 18:04
@paulmnguyen paulmnguyen self-assigned this Mar 4, 2021
@paulmnguyen paulmnguyen changed the title Feature/cortex xdr Integrate Cortex XDR incidents Mar 4, 2021
@btorresgil btorresgil mentioned this pull request Mar 15, 2021
Closed
paulmnguyen added 11 commits April 6, 2021 13:10
@paulmnguyen
feat(addon): Add Cortex XDR Support
9ea8dc8 
Add modular input for Cortex XDR Incidents
@paulmnguyen
feat(addon): Add Cortex XDR Modular Input
bb82048 
Add Cortex XDR incidents as events
@paulmnguyen
feat(app/addon): Integrate Cortex XDR into Splunk app and add-on
443db91 
Add Cortex XDR modinput and new Cortex XDR incidents dashboard
@paulmnguyen
feat(app/addon): Integrate Cortex XDR incidents to app and addon
9ebd14a
@paulmnguyen
feat(app/addon): Integrate Cortex XDR incidents to App and Addon
7e71ad2 
appinspect fix
@paulmnguyen
feat(app/addon): Integrate Cortex XDR incidents into Splunk App and A…
a1928e5 
…ddon
@paulmnguyen
feat(app/addon): Integrate Cortex XDR into app and addon
54f0b78
@paulmnguyen
feat(app/addon): Add Cortex XDR support to Splunk app and addon
d172fa5 
Change Cortex XDR variables to lowercase.
@paulmnguyen
feat(app/addon): Integrate Cortex XDR into Splunk App and Add-on
a4f4dd2 
Optimized Cortex XDR Dashboard.
@paulmnguyen
feat(app/addon): Integrate Cortex XDR with Splunk app and addon
a2e7cb7
@paulmnguyen
feat(app/addon): Integrate Cortex XDR with Splunk app and addon
603c689
@btorresgil btorresgil merged commit 8be8edb into develop May 8, 2021
@btorresgil btorresgil deleted the feature/cortex-xdr branch May 8, 2021 00:50
btorresgil pushed a commit that referenced this pull request May 8, 2021
@paulmnguyen @btorresgil
feat(app/addon): Add Cortex XDR incident support to App and Add-on
2148c20 
PR: #166 

BREAKING CHANGE: Replaces dashboards including Adversary Scoreboard and Incident Feed with new XDR Incidents dashboard.
btorresgil pushed a commit that referenced this pull request May 8, 2021
@paulmnguyen @btorresgil
feat(app/addon): Add Cortex XDR incident support to App and Add-on in…
3150694 
…cluding new XDR Incidents dashboard

PR: #166

BREAKING CHANGE: Replaces Adversary Scoreboard and Incident Feed dashboards with new XDR Incidents dashboard
github-actions bot pushed a commit that referenced this pull request May 14, 2021
@semantic-release-bot
chore(release): 7.0.0
7438d5f 
## [7.0.0](v6.6.1...v7.0.0) (2021-05-14)

### Features

* **addon:** PAN Quality Validation and Improvement
* **addon:** Significantly improve and modernize CIM compliance
* **app/addon:** Add Cortex XDR incident support to App and Add-on including new XDR Incidents dashboard - #166

### Bug Fixes

* **addon:** Fix error from Minemeld automatic lookup
* **addon:** Fix src_user field contained destination user - #186

### Performance Improvements

* **app:** Remove high cardinality fields from datamodel

### ⚠ MAJOR RELEASE CHANGES

This is a major release

Splunk dashboards and searches you have created might be
affected by these changes. Please be prepared to test and
adjust any dashboards not included with the App after upgrade.

* **addon:** pan_traffic_start logs no longer included in CIM
* **addon:** pan_traffic_end logs moved from Network Session to Network Traffic datamodel
* **addon:** pan_threat event type now includes wildfire and data logs
* **addon:** pan_file logs moved from Web to IDS datamodel
* **addon:** pan_virus logs moved from Malware to IDS datamodel
* **addon:** pan_wildfire logs moved from Malware to IDS datamodel
* **addon:** pan_email removed from Email datamodel
* **app:** Removes datamodel for GlobalProtect logs before PAN-OS 9.1
* **app/addon:** Removes Traps 4 support
* **app/addon:** Deprecates Traps 5 and Traps 6 support
* **app:** Removes support for legacy WildFire Report API
* **app/addon:** Requires Splunk 8.0 or higher
* **app/addon:** Replaces Adversary Scoreboard and Incident Feed dashboards with new XDR Incidents dashboard
github-actions bot pushed a commit to btorresgil/SplunkforPaloAltoNetworks that referenced this pull request Mar 7, 2022
@semantic-release-bot
chore(release): 5.0.0-beta.1
238b9d8 
## [5.0.0-beta.1](v4.2.2...v5.0.0-beta.1) (2022-03-07)

### Features

* **addon:** Add Decryption Log Support for PANOS 10  - PaloAltoNetworks#126
* **addon:** Cortex Data Lake HEC log support - PaloAltoNetworks#162 PaloAltoNetworks#176
* **addon:** PAN Quality Validation and Improvement
* **addon:** Significantly improve and modernize CIM compliance
* **app/addon:** Add Cortex XDR incident support to App and Add-on including new XDR Incidents dashboard - PaloAltoNetworks#166
* **app/addon:** Add IoT Security - PaloAltoNetworks#158
* **app/addon:** Feature/dynamic user groups - PaloAltoNetworks#150
* **app/addon:** Python 3 Support - PaloAltoNetworks#124
* **app/addon:** Support GlobalProtect log type in PANOS 9.1 - PaloAltoNetworks#118
* **app/addon:** Update pandevice to 0.14.0 - PaloAltoNetworks#145

### Bug Fixes

* **addon:** Add fields for GlobalProtect logs
* **addon:** Add fields for GlobalProtect logs
* **addon:** Add GlobalProtect SourceUserName - PaloAltoNetworks#209 PaloAltoNetworks#202
* **addon:** Add modinputs as tasks in app.manifest - PaloAltoNetworks#153
* **addon:** Add virus eventtype to malware CIM - PaloAltoNetworks#114 PaloAltoNetworks#138
* **addon:** Fix appserver/static files
* **addon:** Fix CDL logs contained string 'null' in 'user' field - PaloAltoNetworks#187
* **addon:** Fix error from Minemeld automatic lookup
* **addon:** Fix GlobalProtect logs dvc_name field
* **addon:** Fix GlobalProtect logs dvc_name field
* **addon:** Fix nav bar background color
* **addon:** Fix src_user field contained destination user - PaloAltoNetworks#186
* **addon:** Fix typo in transform.conf ([PaloAltoNetworks#227](https://github.com/btorresgil/SplunkforPaloAltoNetworks/issues/227))
* **addon:** Fix user showing as unknown from GlobalProtect logs.  - PaloAltoNetworks#217
* **addon:** Parse GP and Decryption logs w/ pan:firewall - PaloAltoNetworks#168
* **addon:** Parse GP and Decryption logs w/ pan:firewall - PaloAltoNetworks#168
* **addon:** Remove endpoint tags and eventtypes - PaloAltoNetworks#196
* **addon:** Remove port from `dest_name` field - PaloAltoNetworks#129 PaloAltoNetworks#128
* **addon:** Remove white space from GlobalProtect sourcetype - PaloAltoNetworks#131
* **addon:** Restore "unknown" string for empty 'user' field
* **app:** Fix error after upgrade to 7.0.0: "Unknown search command 'panwildfirereport'" - PaloAltoNetworks#189
* **app:** Fix IoT Security dashboard filter - PaloAltoNetworks#181
* **app:** Fix panContentPack error. Fixes bug [PaloAltoNetworks#222](https://github.com/btorresgil/SplunkforPaloAltoNetworks/issues/222) - PaloAltoNetworks#225
* **app:** Incident counters flash in Splunk 8.1 - PaloAltoNetworks#163
* **app:** Incident counters flash in Splunk 8.1 - PaloAltoNetworks#163
* **app:** Remove endpoint from Data Model Audit dashboard - PaloAltoNetworks#218
* **app/addon:** correct user-id tag_user / untag_user
* **app/addon:** Fix background color of logo - PaloAltoNetworks#141

### Performance Improvements

* **app:** Change simple XML to use JQuery 3.5 - PaloAltoNetworks#207
* **app:** Remove high cardinality fields from datamodel

### ⚠ MAJOR RELEASE CHANGES

This is a major release

Splunk dashboards and searches you have created might be
affected by these changes. Please be prepared to test and
adjust any dashboards not included with the App after upgrade.

* **addon:** pan_traffic_start logs no longer included in CIM
* **addon:** pan_traffic_end logs moved from Network Session to Network Traffic datamodel
* **addon:** pan_threat event type now includes wildfire and data logs
* **addon:** pan_file logs moved from Web to IDS datamodel
* **addon:** pan_virus logs moved from Malware to IDS datamodel
* **addon:** pan_wildfire logs moved from Malware to IDS datamodel
* **addon:** pan_email removed from Email datamodel
* **app:** Removes datamodel for GlobalProtect logs before PAN-OS 9.1
* **app/addon:** Removes Traps 4 support
* **app/addon:** Deprecates Traps 5 and Traps 6 support
* **app:** Removes support for legacy WildFire Report API
* **app/addon:** Requires Splunk 8.0 or higher
* **app/addon:** Replaces Adversary Scoreboard and Incident Feed dashboards with new XDR Incidents dashboard
Sign up for free to subscribe to this conversation on GitHub. Already have an account? Sign in.
Reviewers

@btorresgil btorresgil btorresgil approved these changes

Assignees

@paulmnguyen paulmnguyen

Labels
add-on Related to the Splunk Add-On app Related to the Splunk App (not the Add-on) enhancement
Projects
None yet
Milestone
No milestone
Development

Successfully merging this pull request may close these issues.
2 participants
@paulmnguyen @btorresgil