Network Session ASIM parser for Palo Alto PanOS

Browse: 🏠 · Solutions · Connectors · Methods · Tables · Content · Parsers · ASIM Parsers · ASIM Products · Logic Apps · 📊

↑ Back to ASIM Index

---

Parser Information

Property	Value
Parser Name	ASimNetworkSessionPaloAltoCEF
Built-in Parser	_ASim_NetworkSession_PaloAltoCEF
Schema	NetworkSession
Schema Version	0.2.2
Parser Type	🔌 Source (product-specific)
Product	Palo Alto PanOS
Parser Version	0.7.1 (version history)
Last Updated	Feb 19, 2024
Unifying Parser	ASimNetworkSession
Source File	Parsers\ASimNetworkSession\Parsers\ASimNetworkSessionPaloAltoCEF.yaml

Description

This ASIM parser supports normalizing Palo Alto PanOS logs produced by the Microsoft Sentinel Palo Alto Networks connector to the ASIM Network Session normalized schema.

Source Tables

This parser reads from the following tables:

Table	Selection Criteria	Transformations	Ingestion API	Lake-Only
CommonSecurityLog	DeviceProduct == "PAN-OS" DeviceVendor == "Palo Alto Networks"	✓	✓	✓

Parameters

Name	Type	Default
disabled	bool	False

Associated Connectors

The following connectors provide data for this parser:

Connector	Solution
CefAma	Common Event Format
VirtualMetricDirectorProxy	VirtualMetric DataStream
VirtualMetricMSSentinelConnector	VirtualMetric DataStream
VirtualMetricMSSentinelDataLakeConnector	VirtualMetric DataStream

Solutions: Common Event Format, VirtualMetric DataStream

References

• ASIM Network Session Schema
• ASIM
• traffic log fields
• Palo Alto Common Event Format Integration Guide [pdf]

---

Browse: 🏠 · Solutions · Connectors · Methods · Tables · Content · Parsers · ASIM Parsers · ASIM Products · Logic Apps · 📊

↑ Back to ASIM Index