Web Session ASIM parser for Palo Alto Cortex Data Lake
Browse: 🏠 · Solutions · Connectors · Methods · Tables · Content · Parsers · ASIM Parsers · ASIM Products · Logic Apps · 📊
Parser Information
| Property | Value |
|---|---|
| Parser Name | ASimWebSessionPaloAltoCortexDataLake |
| Built-in Parser | _ASim_WebSession_PaloAltoCortexDataLake |
| Schema | WebSession |
| Schema Version | 0.2.6 |
| Parser Type | 🔌 Source (product-specific) |
| Product | Palo Alto Cortex Data Lake |
| Parser Version | 0.1.1 (version history) |
| Last Updated | Jan 22 2024 |
| Unifying Parser | ASimWebSession |
| Source File | Parsers\ASimWebSession\Parsers\ASimWebSessionPaloAltoCortexDataLake.yaml |
Description
This ASIM parser supports normalizing Palo Alto Cortex Data Lake logs to the ASIM Web Session normalized schema. These events are captured through the Palo Alto Networks CDL data connector that ingests CDL logs into Microsoft Sentinel.
Source Tables
This parser reads from the following tables:
| Table | Selection Criteria | Transformations | Ingestion API | Lake-Only |
|---|---|---|---|---|
CommonSecurityLog |
DeviceEventClassID == "THREAT"DeviceProduct == "LF"DeviceVendor == "Palo Alto Networks" |
✓ | ✓ | ✓ |
Parameters
| Name | Type | Default |
|---|---|---|
disabled |
bool | False |
Associated Connectors
The following connectors provide data for this parser:
Solutions: Common Event Format, PaloAltoCDL (legacy connector), VirtualMetric DataStream
References
Browse: 🏠 · Solutions · Connectors · Methods · Tables · Content · Parsers · ASIM Parsers · ASIM Products · Logic Apps · 📊