{
  "name": "panw",
  "title": "Palo Alto Next-Gen Firewall",
  "version": "5.3.0",
  "release": "ga",
  "description": "Collect logs from Palo Alto next-gen firewalls with Elastic Agent.",
  "type": "integration",
  "download": "/epr/panw/panw-5.3.0.zip",
  "path": "/package/panw/5.3.0",
  "icons": [
    {
      "src": "/img/logo-integrations-paloalto-networks.svg",
      "path": "/package/panw/5.3.0/img/logo-integrations-paloalto-networks.svg",
      "title": "Palo Alto Networks",
      "size": "216x216",
      "type": "image/svg+xml"
    }
  ],
  "conditions": {
    "kibana": {
      "version": "^8.11.0 || ^9.0.0"
    }
  },
  "owner": {
    "type": "elastic",
    "github": "elastic/sec-deployment-and-devices"
  },
  "categories": [
    "security",
    "network"
  ],
  "signature_path": "/epr/panw/panw-5.3.0.zip.sig",
  "format_version": "3.0.3",
  "readme": "/package/panw/5.3.0/docs/README.md",
  "license": "basic",
  "screenshots": [
    {
      "src": "/img/panw-traffic.png",
      "path": "/package/panw/5.3.0/img/panw-traffic.png",
      "title": "Traffic Dashboard",
      "size": "2546x2888",
      "type": "image/png"
    },
    {
      "src": "/img/panw-threat.png",
      "path": "/package/panw/5.3.0/img/panw-threat.png",
      "title": "Threat Dashboard",
      "size": "2546x2496",
      "type": "image/png"
    }
  ],
  "assets": [
    "/package/panw/5.3.0/LICENSE.txt",
    "/package/panw/5.3.0/changelog.yml",
    "/package/panw/5.3.0/manifest.yml",
    "/package/panw/5.3.0/validation.yml",
    "/package/panw/5.3.0/docs/README.md",
    "/package/panw/5.3.0/img/logo-integrations-paloalto-networks.svg",
    "/package/panw/5.3.0/img/panw-threat.png",
    "/package/panw/5.3.0/img/panw-traffic.png",
    "/package/panw/5.3.0/kibana/tags.yml",
    "/package/panw/5.3.0/data_stream/panos/manifest.yml",
    "/package/panw/5.3.0/data_stream/panos/sample_event.json",
    "/package/panw/5.3.0/kibana/dashboard/panw-0c0fa830-dca5-11ec-8b8b-1fae02ab6a5e.json",
    "/package/panw/5.3.0/kibana/dashboard/panw-42d2b320-dcec-11ec-8b8b-1fae02ab6a5e.json",
    "/package/panw/5.3.0/kibana/dashboard/panw-4782db40-dccc-11ec-8b8b-1fae02ab6a5e.json",
    "/package/panw/5.3.0/kibana/dashboard/panw-772964e0-7591-11e9-aacf-79a3704914a0.json",
    "/package/panw/5.3.0/kibana/dashboard/panw-a663eea0-dd72-11ec-8b8b-1fae02ab6a5e.json",
    "/package/panw/5.3.0/kibana/dashboard/panw-a8dc42e0-dcc8-11ec-8b8b-1fae02ab6a5e.json",
    "/package/panw/5.3.0/kibana/dashboard/panw-b1a9f7a0-dcaa-11ec-8b8b-1fae02ab6a5e.json",
    "/package/panw/5.3.0/kibana/dashboard/panw-d3e36450-dce1-11ec-8b8b-1fae02ab6a5e.json",
    "/package/panw/5.3.0/kibana/dashboard/panw-e40ba240-7572-11e9-976e-65a8f47cc4c1.json",
    "/package/panw/5.3.0/kibana/dashboard/panw-f84a1440-dcf7-11ec-8b8b-1fae02ab6a5e.json",
    "/package/panw/5.3.0/kibana/search/panw-0ffe1200-ddb9-11ec-8e76-9b3b99f98cd4.json",
    "/package/panw/5.3.0/kibana/search/panw-1d9d5060-ddb9-11ec-8e76-9b3b99f98cd4.json",
    "/package/panw/5.3.0/kibana/search/panw-24a5cf50-ddb8-11ec-8e76-9b3b99f98cd4.json",
    "/package/panw/5.3.0/kibana/search/panw-290685e0-7569-11e9-976e-65a8f47cc4c1.json",
    "/package/panw/5.3.0/kibana/search/panw-37acbca0-ddb1-11ec-8e76-9b3b99f98cd4.json",
    "/package/panw/5.3.0/kibana/search/panw-3cea1360-7569-11e9-976e-65a8f47cc4c1.json",
    "/package/panw/5.3.0/kibana/search/panw-6d0ea500-ddb8-11ec-8e76-9b3b99f98cd4.json",
    "/package/panw/5.3.0/kibana/search/panw-79d117f0-ddb8-11ec-8e76-9b3b99f98cd4.json",
    "/package/panw/5.3.0/kibana/search/panw-89e2f970-ddb7-11ec-8e76-9b3b99f98cd4.json",
    "/package/panw/5.3.0/kibana/search/panw-8dc6b590-ddb2-11ec-8e76-9b3b99f98cd4.json",
    "/package/panw/5.3.0/kibana/search/panw-92083d90-ddb7-11ec-8e76-9b3b99f98cd4.json",
    "/package/panw/5.3.0/kibana/search/panw-9df5cdf0-ddaf-11ec-8e76-9b3b99f98cd4.json",
    "/package/panw/5.3.0/kibana/search/panw-a93a1c80-dcd7-11ec-8b8b-1fae02ab6a5e.json",
    "/package/panw/5.3.0/kibana/search/panw-c53134a0-ddb8-11ec-8e76-9b3b99f98cd4.json",
    "/package/panw/5.3.0/kibana/search/panw-cfbe1f60-ddb7-11ec-8e76-9b3b99f98cd4.json",
    "/package/panw/5.3.0/kibana/search/panw-d01e7260-ddb8-11ec-8e76-9b3b99f98cd4.json",
    "/package/panw/5.3.0/data_stream/panos/fields/agent.yml",
    "/package/panw/5.3.0/data_stream/panos/fields/base-fields.yml",
    "/package/panw/5.3.0/data_stream/panos/fields/beats.yml",
    "/package/panw/5.3.0/data_stream/panos/fields/ecs.yml",
    "/package/panw/5.3.0/data_stream/panos/fields/fields.yml",
    "/package/panw/5.3.0/data_stream/panos/agent/stream/logfile.yml.hbs",
    "/package/panw/5.3.0/data_stream/panos/agent/stream/tcp.yml.hbs",
    "/package/panw/5.3.0/data_stream/panos/agent/stream/udp.yml.hbs",
    "/package/panw/5.3.0/data_stream/panos/elasticsearch/ingest_pipeline/audit.yml",
    "/package/panw/5.3.0/data_stream/panos/elasticsearch/ingest_pipeline/authentication.yml",
    "/package/panw/5.3.0/data_stream/panos/elasticsearch/ingest_pipeline/config.yml",
    "/package/panw/5.3.0/data_stream/panos/elasticsearch/ingest_pipeline/correlated_event.yml",
    "/package/panw/5.3.0/data_stream/panos/elasticsearch/ingest_pipeline/decryption.yml",
    "/package/panw/5.3.0/data_stream/panos/elasticsearch/ingest_pipeline/default.yml",
    "/package/panw/5.3.0/data_stream/panos/elasticsearch/ingest_pipeline/globalprotect.yml",
    "/package/panw/5.3.0/data_stream/panos/elasticsearch/ingest_pipeline/gtp.yml",
    "/package/panw/5.3.0/data_stream/panos/elasticsearch/ingest_pipeline/hipmatch.yml",
    "/package/panw/5.3.0/data_stream/panos/elasticsearch/ingest_pipeline/ip_tag.yml",
    "/package/panw/5.3.0/data_stream/panos/elasticsearch/ingest_pipeline/sctp.yml",
    "/package/panw/5.3.0/data_stream/panos/elasticsearch/ingest_pipeline/system.yml",
    "/package/panw/5.3.0/data_stream/panos/elasticsearch/ingest_pipeline/threat.yml",
    "/package/panw/5.3.0/data_stream/panos/elasticsearch/ingest_pipeline/traffic.yml",
    "/package/panw/5.3.0/data_stream/panos/elasticsearch/ingest_pipeline/tunnel_inspection.yml",
    "/package/panw/5.3.0/data_stream/panos/elasticsearch/ingest_pipeline/userid.yml"
  ],
  "policy_templates": [
    {
      "name": "panw",
      "title": "Palo Alto Networks PAN-OS firewall logs",
      "description": "Collect logs from Palo Alto Networks PAN-OS firewall.",
      "inputs": [
        {
          "type": "tcp",
          "title": "Collect logs via syslog over TCP",
          "description": "Collecting firewall logs from PAN-OS instances (input: tcp)."
        },
        {
          "type": "udp",
          "title": "Collect logs via syslog over UDP",
          "description": "Collecting firewall logs from PAN-OS instances (input: udp)."
        },
        {
          "type": "logfile",
          "vars": [
            {
              "name": "paths",
              "type": "text",
              "title": "Paths",
              "multi": true,
              "required": true,
              "show_user": true,
              "default": [
                "/var/log/pan-os.log"
              ]
            }
          ],
          "title": "Collect logs via log file",
          "description": "Collecting logs via log file."
        }
      ],
      "multiple": true
    }
  ],
  "data_streams": [
    {
      "type": "logs",
      "dataset": "panw.panos",
      "title": "Palo Alto Networks PAN-OS firewall logs",
      "release": "ga",
      "ingest_pipeline": "default",
      "streams": [
        {
          "input": "tcp",
          "vars": [
            {
              "name": "syslog_host",
              "type": "text",
              "title": "Syslog Host",
              "multi": false,
              "required": true,
              "show_user": true,
              "default": "localhost"
            },
            {
              "name": "syslog_port",
              "type": "integer",
              "title": "Syslog Port",
              "multi": false,
              "required": true,
              "show_user": true,
              "default": 9001
            },
            {
              "name": "tags",
              "type": "text",
              "title": "Tags",
              "multi": true,
              "required": true,
              "show_user": false,
              "default": [
                "panw-panos",
                "forwarded"
              ]
            },
            {
              "name": "internal_zones",
              "type": "text",
              "title": "Internal Zones",
              "multi": true,
              "required": false,
              "show_user": false,
              "default": [
                "trust"
              ]
            },
            {
              "name": "external_zones",
              "type": "text",
              "title": "External Zones",
              "multi": true,
              "required": false,
              "show_user": false,
              "default": [
                "untrust"
              ]
            },
            {
              "name": "preserve_original_event",
              "type": "bool",
              "title": "Preserve original event",
              "description": "Preserves a raw copy of the original event, added to the field `event.original`.",
              "multi": false,
              "required": true,
              "show_user": true,
              "default": false
            },
            {
              "name": "preserve_duplicate_custom_fields",
              "type": "bool",
              "title": "Preserve duplicate custom fields",
              "description": "Preserve custom fields for all ECS mappings.",
              "multi": false,
              "required": true,
              "show_user": true,
              "default": false
            },
            {
              "name": "tz_offset",
              "type": "text",
              "title": "Time Zone Offset",
              "description": "By default, datetimes in the logs without a time zone will be interpreted as relative to the time zone configured in the host where the agent is running. If ingesting logs from a different time zone, use this field to set the time zone offset so that datetimes are correctly parsed. Acceptable time zone formats are: local time (Local), a canonical ID (e.g. \"Europe/Amsterdam\"), abbreviated (e.g. \"EST\") or an HH:mm differential (e.g. \"-05:00\") from UTC.",
              "multi": false,
              "required": true,
              "show_user": true,
              "default": "Local"
            },
            {
              "name": "processors",
              "type": "yaml",
              "title": "Processors",
              "description": "Processors are used to reduce the number of fields in the exported event or to enhance the event with metadata. This executes in the agent before the logs are parsed. See [Processors](https://www.elastic.co/guide/en/beats/filebeat/current/filtering-and-enhancing-data.html) for details.",
              "multi": false,
              "required": false,
              "show_user": false
            },
            {
              "name": "ssl",
              "type": "yaml",
              "title": "SSL Configuration",
              "description": "SSL configuration options. See [documentation](https://www.elastic.co/guide/en/beats/filebeat/current/configuration-ssl.html#ssl-common-config) for details.",
              "multi": false,
              "required": false,
              "show_user": false,
              "default": "#certificate: \"/etc/server/cert.pem\"\n#key: \"/etc/server/key.pem\"\n"
            },
            {
              "name": "tcp_options",
              "type": "yaml",
              "title": "Custom TCP Options",
              "description": "Specify custom configuration options for the TCP input. See [TCP](https://www.elastic.co/guide/en/beats/filebeat/current/filebeat-input-tcp.html) for details.",
              "multi": false,
              "required": false,
              "show_user": false,
              "default": "max_message_size: 50KiB\nframing: rfc6587\n#max_connections: 1\n"
            }
          ],
          "template_path": "tcp.yml.hbs",
          "title": "Collect logs via syslog over TCP",
          "description": "Collecting firewall logs from PAN-OS instances (input: tcp).",
          "enabled": true,
          "ingestion_method": "Network Protocol"
        },
        {
          "input": "udp",
          "vars": [
            {
              "name": "syslog_host",
              "type": "text",
              "title": "Syslog Host",
              "multi": false,
              "required": true,
              "show_user": true,
              "default": "localhost"
            },
            {
              "name": "syslog_port",
              "type": "integer",
              "title": "Syslog Port",
              "multi": false,
              "required": true,
              "show_user": true,
              "default": 9001
            },
            {
              "name": "tags",
              "type": "text",
              "title": "Tags",
              "multi": true,
              "required": true,
              "show_user": false,
              "default": [
                "panw-panos",
                "forwarded"
              ]
            },
            {
              "name": "internal_zones",
              "type": "text",
              "title": "Internal Zones",
              "multi": true,
              "required": false,
              "show_user": false,
              "default": [
                "trust"
              ]
            },
            {
              "name": "external_zones",
              "type": "text",
              "title": "External Zones",
              "multi": true,
              "required": false,
              "show_user": false,
              "default": [
                "untrust"
              ]
            },
            {
              "name": "preserve_original_event",
              "type": "bool",
              "title": "Preserve original event",
              "description": "Preserves a raw copy of the original event, added to the field `event.original`.",
              "multi": false,
              "required": true,
              "show_user": true,
              "default": false
            },
            {
              "name": "preserve_duplicate_custom_fields",
              "type": "bool",
              "title": "Preserve duplicate custom fields",
              "description": "Preserve custom fields for all ECS mappings.",
              "multi": false,
              "required": true,
              "show_user": true,
              "default": false
            },
            {
              "name": "tz_offset",
              "type": "text",
              "title": "Time Zone Offset",
              "description": "By default, datetimes in the logs without a time zone will be interpreted as relative to the time zone configured in the host where the agent is running. If ingesting logs from a different time zone, use this field to set the time zone offset so that datetimes are correctly parsed. Acceptable time zone formats are: local time (Local), a canonical ID (e.g. \"Europe/Amsterdam\"), abbreviated (e.g. \"EST\") or an HH:mm differential (e.g. \"-05:00\") from UTC.",
              "multi": false,
              "required": true,
              "show_user": true,
              "default": "Local"
            },
            {
              "name": "processors",
              "type": "yaml",
              "title": "Processors",
              "description": "Processors are used to reduce the number of fields in the exported event or to enhance the event with metadata. This executes in the agent before the logs are parsed. See [Processors](https://www.elastic.co/guide/en/beats/filebeat/current/filtering-and-enhancing-data.html) for details.",
              "multi": false,
              "required": false,
              "show_user": false
            },
            {
              "name": "udp_options",
              "type": "yaml",
              "title": "Custom UDP Options",
              "description": "Specify custom configuration options for the UDP input.",
              "multi": false,
              "required": false,
              "show_user": false,
              "default": "max_message_size: 50KiB\n#timeout: 300s\n"
            }
          ],
          "template_path": "udp.yml.hbs",
          "title": "Collect logs via syslog over UDP",
          "description": "Collecting firewall logs from PAN-OS instances (input: udp).",
          "enabled": true,
          "ingestion_method": "Network Protocol"
        },
        {
          "input": "logfile",
          "vars": [
            {
              "name": "tz_offset",
              "type": "text",
              "title": "Time Zone Offset",
              "description": "By default, datetimes in the logs without a time zone will be interpreted as relative to the time zone configured in the host where the agent is running. If ingesting logs from a different time zone, use this field to set the time zone offset so that datetimes are correctly parsed. Acceptable time zone formats are: local time (Local), a canonical ID (e.g. \"Europe/Amsterdam\"), abbreviated (e.g. \"EST\") or an HH:mm differential (e.g. \"-05:00\") from UTC.",
              "multi": false,
              "required": true,
              "show_user": true,
              "default": "local"
            },
            {
              "name": "tags",
              "type": "text",
              "title": "Tags",
              "multi": true,
              "required": true,
              "show_user": false,
              "default": [
                "panw-panos",
                "forwarded"
              ]
            },
            {
              "name": "internal_zones",
              "type": "text",
              "title": "Internal Zones",
              "multi": true,
              "required": false,
              "show_user": false,
              "default": [
                "trust"
              ]
            },
            {
              "name": "external_zones",
              "type": "text",
              "title": "External Zones",
              "multi": true,
              "required": false,
              "show_user": false,
              "default": [
                "untrust"
              ]
            },
            {
              "name": "preserve_original_event",
              "type": "bool",
              "title": "Preserve original event",
              "description": "Preserves a raw copy of the original event, added to the field `event.original`.",
              "multi": false,
              "required": true,
              "show_user": true,
              "default": false
            },
            {
              "name": "preserve_duplicate_custom_fields",
              "type": "bool",
              "title": "Preserve duplicate custom fields",
              "description": "Preserve custom fields for all ECS mappings.",
              "multi": false,
              "required": true,
              "show_user": true,
              "default": false
            },
            {
              "name": "processors",
              "type": "yaml",
              "title": "Processors",
              "description": "Processors are used to reduce the number of fields in the exported event or to enhance the event with metadata. This executes in the agent before the logs are parsed. See [Processors](https://www.elastic.co/guide/en/beats/filebeat/current/filtering-and-enhancing-data.html) for details.",
              "multi": false,
              "required": false,
              "show_user": false
            }
          ],
          "template_path": "logfile.yml.hbs",
          "title": "Log files",
          "description": "Collect logs via log file",
          "enabled": true,
          "ingestion_method": "File"
        }
      ],
      "package": "panw",
      "path": "panos"
    }
  ]
}