=0;i--){_2f[i].style.display="none";for(var x in _2f[i]){if(typeof _2f[i][x]=="function"){_2f[i][x]=function(){};}}}};if(deconcept.SWFObject.doPrepUnload){if(!deconcept.unloadSet){deconcept.SWFObjectUtil.prepUnload=function(){__flash_unloadHandler=function(){};__flash_savedUnloadHandler=function(){};window.attachEvent("onunload",deconcept.SWFObjectUtil.cleanupSWFs);};window.attachEvent("onbeforeunload",deconcept.SWFObjectUtil.prepUnload);deconcept.unloadSet=true;}}if(!document.getElementById&&document.all){document.getElementById=function(id){return document.all[id];};}var getQueryParamValue=deconcept.util.getRequestParameter;var FlashObject=deconcept.SWFObject;var SWFObject=deconcept.SWFObject;
diff --git a/appserver/static/appLogo.png b/appserver/static/appLogo.png
deleted file mode 100755
index 141382be..00000000
Binary files a/appserver/static/appLogo.png and /dev/null differ
diff --git a/appserver/static/appicon.png b/appserver/static/appicon.png
index 7f4aef33..f1b1a3b9 100644
Binary files a/appserver/static/appicon.png and b/appserver/static/appicon.png differ
diff --git a/appserver/static/dashboard.css b/appserver/static/dashboard.css
new file mode 100644
index 00000000..06eb7af5
--- /dev/null
+++ b/appserver/static/dashboard.css
@@ -0,0 +1,77 @@
+
+/* Set background */
+.main-section-body {
+ background-color:#dbe6e9;
+ background-image:-webkit-gradient(linear, 0 0, 0 100%, from(#e2e9eb), color-stop(400px, #dbe6e9), to(#dbe6e9));
+ background-image:-webkit-linear-gradient(#e2e9eb, #dbe6e9 400px, #dbe6e9);
+ background-image:-moz-linear-gradient(top, #e2e9eb, #dbe6e9 400px, #dbe6e9);
+ background-image:-o-linear-gradient(#e2e9eb, #dbe6e9 400px, #dbe6e9);
+ background-image:linear-gradient(#e2e9eb, #dbe6e9 400px, #dbe6e9);
+ filter:progid:DXImageTransform.Microsoft.gradient(startColorstr='#ffe2e9eb', endColorstr='#ffdbe6e9', GradientType=0);
+}
+
+/* Make the forms look like they are in a panel */
+/*.fieldset {
+ border-radius: 4px;
+ border: 1px solid #cccccc;
+ background: white;
+ margin: 0 0px 10px 0;
+ box-shadow: 0px 1px 1px rgba(0, 0, 0, 0.08);
+ position: relative;
+ padding: 12px 15px 0px 15px;
+}
+
+.fieldset .hide-label {
+}
+*/
+
+/* Shrink the form text inputs*/
+input, textarea, .uneditable-input {
+ width: 120px;
+}
+
+/* Make the Search button on each dashboard blue instead of green */
+
+.btn-primary {
+ background-color: #5c9732;
+ background-image: -moz-linear-gradient(top, #0087df, #004f82);
+ background-image: -webkit-gradient(linear, 0 0, 0 100%, from(#0087df), to(#004f82));
+ background-image: -webkit-linear-gradient(top, #0087df, #004f82);
+ background-image: -o-linear-gradient(top, #0087df, #004f82);
+ background-image: linear-gradient(to bottom, #0087df, #004f82);
+ background-repeat: repeat-x;
+ filter: progid:DXImageTransform.Microsoft.gradient(startColorstr='#ff0087df', endColorstr='#ff004f82', GradientType=0);
+ background-color: #0087df;
+ border: 1px solid #143ab1;
+ border-bottom-color: #0048c9;
+ border-top-color: #004f82;
+ color: #ffffff;
+ text-shadow: 0 -1px 0 rgba(51, 51, 51, 0.7);
+ -webkit-box-shadow: 0px 1px 1px rgba(0, 0, 0, 0.08);
+ -moz-box-shadow: 0px 1px 1px rgba(0, 0, 0, 0.08);
+ box-shadow: 0px 1px 1px rgba(0, 0, 0, 0.08);
+}
+
+.btn-primary:hover {
+ background-color: #7db44d;
+ background-image: -moz-linear-gradient(top, #6ac1fa, #007fd1);
+ background-image: -webkit-gradient(linear, 0 0, 0 100%, from(#6ac1fa), to(#007fd1));
+ background-image: -webkit-linear-gradient(top, #6ac1fa, #007fd1);
+ background-image: -o-linear-gradient(top, #6ac1fa, #007fd1);
+ background-image: linear-gradient(to bottom, #6ac1fa, #007fd1);
+ background-repeat: repeat-x;
+ filter: progid:DXImageTransform.Microsoft.gradient(startColorstr='#ff6ac1fa', endColorstr='#ff007fd1', GradientType=0);
+ background-color: #389ddf;
+ border-color: #0c89db;
+ border-bottom-color: #006eb4;
+ border-top-color: #3f99d3;
+ background-position: 0 0;
+}
+
+.btn-primary:active, .btn-primary.active {
+ background-color: #016baf 9;
+}
+.btn-primary:hover, .btn-primary:focus, .btn-primary:active, .btn-primary.active, .btn-primary.disabled, .btn-primary[disabled] {
+ color: #ffffff;
+ background-color: #016baf;
+}
diff --git a/appserver/static/export_button.html b/appserver/static/export_button.html
deleted file mode 100755
index b182ca82..00000000
--- a/appserver/static/export_button.html
+++ /dev/null
@@ -1,30 +0,0 @@
-<%namespace name="helpers" file="//module/_helpers.html" />
-
-
-
-
-
- Export
-
-<%helpers:export className="exportResultsForm" />
\ No newline at end of file
diff --git a/appserver/static/faq.html b/appserver/static/faq.html
deleted file mode 100644
index 05222ecd..00000000
--- a/appserver/static/faq.html
+++ /dev/null
@@ -1,49 +0,0 @@
-
-
-
- Frequently Asked Questions
-
-Question: I am using windows. When i installed the app manually, nothing happens. Or splunk crashes on restart
-
-Answer: Ensure that the user Splunk is running as, has read write access to the $SPLUNK_HOME/etc/apps/SplunkforPaloAltoNetworks directory
-
-Question: Why are some fields labeled as Future_Use ?
-
-Answer: Field extractions for PANOS logs are based on the published Palo Alto spec for syslog forwarding. However, the spec has reserved fields called, Future_Use.
-
-Question: Can I modify the field extractions ?
-
-Answer: Yes. To do this modify the app's transforms.conf file:
-
- 1. Verify the correct field names in your PAN device's logs. If you don't have a raw copy of the logs you can check by using the command "show logs " from the CLI.
-
-NOTE: The log name should be threat,traffic,config, or system.
-
-
2. Copy transforms.conf from "$SPLUNK_HOME/etc/apps/SplunkforPaloAltoNetworks/default" to "$SPLUNK_HOME/etc/apps/SplunkforPaloAltoNetworks/local".
-
-NOTE: If you modify the version in default, it will be overwritten during the next upgrade of the app
-
-3. Modify the stanza relating to your log (extract_threat, extract_traffic, extract_config, or extract_system) and replace the default field name with the correct one from your PANOS log.
-
-4. Save the file. Run the following command from the Search Bar in Splunk:
-
-
|extract reload=true 5. Run a search on your corrected PANOS log to verify correct field name selection.
-
-
diff --git a/appserver/static/pan_overview.css b/appserver/static/pan_overview.css
deleted file mode 100755
index 31078377..00000000
--- a/appserver/static/pan_overview.css
+++ /dev/null
@@ -1,783 +0,0 @@
-/* How to use this file
-
-Any values in application.css will override those from the default.css file. This file allows you to customize the look of your Splunk App. It does not let you change the overall layout. For the most part, use this to change background colors, buttons, navigation, menus, etc. You can change the color of the histogram bars, but the palette for other chart colors is not exposed to CSS yet.
-
-A note on images:
-Alpha channel PNG files are used for a variety of transparency effects (gradient, glass, shadows, etc.) These images will not work on IE6, so you should either provide an alternate image or override the image by using the "underscore" hack, i.e. _background-image:none. To ensure that IE6 does not render alpha channel PNG files, make sure that the override comes after the declaration that contains your PNG. Any image that starts with "overlay" is an alpha channel graphic. As well, the logo images that are PNG format are also alpha channel so you can use on whatever background you like. GIF formats are available and are set as transparent against black and white only.
-
-A note on background positioning:
-We use image sprites (splIcons.gif and arrows.png) for most of the icons and arrows that appear in the UI. Background-position is used to set different colors. By default, this sprite has black, white, grey, green, and blue versions of arrows. If you want to change these colors, edit the local version of this file (inside this directory). Otherwise, you can choose a different color by adjusting the the background position on the selected element. See the arrows section for details.
-
-If there are elements you wish to style that are not included in this file, we strongly recommend that you use a tool like Firebg, which will help you isolate elements and see which style sheets are taking precedence. Trust us, wecould not have created these without Firebug!
-*/
-
-
-/* Basic Typography
----------------------------------*/
-body, td {
- font-family:Arial,Helvetica,sans-serif;
- font-size:11px;
- color: #fff;
-}
-
-input, textarea, select {
- font-family:Arial,Helvetica,sans-serif;
- font-size:12px;
- color: #333;
-}
-
-/* monospaced font */
-.splFont-mono {
- font-family: Consolas,Monaco,Courier New,monospace;
-}
-
-/* font colors not covered by above */
-h2,h4 {
-color:#000;
-}
-. .default .event {
-color:#333333;
-}
-
-.EventsViewer .default .fields .v {
-color:#999999;
-}
-
-.fieldValuePopup table td, .fieldValuePopup table th {
-color: #ccc;
-}
-
-
-/* App header elements
----------------------------------*/
-
-/* Application logo
-
-height and width should be the same as your image. make sure to include some top and buttom margin in the padding.
-
-Black logo, green >
- background-image: url(appLogo_black.png);
-Black logo, black >
- background-image: url(appLogo_allblack.png);
-White logo, green >
- background-image: url(appLogo_white.png);
-White logo, white >
- background-image: url(appLogo_allwhite.png);
-
-For IE6, use the following images. Note that if you make a background color other than black or white (or close to it) you will need to redo the transparent GIF matte.
-White logo, green > for IE6, transparent against black
- background-image: url(appLogo_white.gif);
-Black logo, green > for IE6, transparent against white
- background-image: url(appLogo_black.gif);
-*/
-
-.appLogo {
- height: 43px;
- width: 486px;
- background-image: url(appLogo.png);
- _background-image: url(appLogo.gif); /* for IE6 */
- background-repeat: no-repeat;
-}
-
-/* the name of your app. line height can be adjusted to fix alignment issues w/ the logo. color is the color of the text. if your logo has the name in it, then you can set this to "display:none; */
-
-.appHeaderWrapper h1 {
- color: #c8da4a;
- line-height: 43px;
- display:none;
-}
-
-
-/* background-color and/or image of your app */
-.appHeaderWrapper {
-background: none none;
-
- /* background-color: #002563;*/
- background-image: none;
- background-repeat: repeat-x;
- background-position: top left;
- border-bottom-style: solid;
- border-bottom-width: 0px;
-}
-
-.appHeader { background: #FFF; }
-
-.navigationHeader { background: #004f82; }
-
-
-
-/* color of top-right text */
-.appHeaderWrapper {
- color: #BBB;
-}
-/* color of top-right links */
-.appHeaderWrapper a {
- color:#000;
-}
-
-/* app menu arrows; see arrows section, below, for more info */
-
-.appHeaderWrapper .splIcon-triangle-3-s {
- background-position: -27px -367px;
-}
-
-
-/* loader background */
-#loading {
- background-color: #6694c7;
-}
-
-
-/* link colors
----------------------------------*/
-a, .EventsViewer .default .showinline {
- color: #004f82;
-}
-
-a.disabled {
- color: ;
-}
-
-/* neutral link colors */
-div.FlashTimeline a,
-div.FlashTimeline a:visited,
-.JobStatus a,
-.LinkSwitcher ul li.selected a {
- color: #004f82;
-}
-
-
-/* nav bar and aux links
----------------------------------*/
-
-/*
-set an overlay effect for your navbar or leave blank for default
-background-image: url(overlay_glass_28.png);
-background-image: url(overlay_gloss_28.png);
-background-image: url(overlay_gradient_28.png);
-background-image: url(overlay_reversegradient_28.png);
-background-image: url(overlay_reversegradient_light_28.png);
-background-image: url(overlay_reversegradientridge_28.png);
-background-image: url(overlay_softgradient_28.png);
-background-image: url(overlay_white_28.png);
-background-image: url(overlay_whiteridge_28.png);
-*/
-
-.splHeader-navigation {
- background-image: url(overlay_gloss_28.png);
- background-repeat: repeat-x;
- _background-image: none;
-}
-
-/*--- some space to the right of the nav items ---*/
-ul.appBarNav li {
- margin-right: 5px;
-}
-
-/*--- the default state ---*/
-ul.appBarNav li a, ul.appBarNav li a:active, ul.appBarNav li a:visited {
- color: #fff;
-}
-
-/*--- the hover state ---*/
-ul.appBarNav li.hasMenu a:hover, ul.appBarNav li a:hover {
- color: #fff;
- background-color: #6694c7;
- background-image: none;
- background-repeat: repeat-x;
- _background-image: none; /* for IE6 */
-}
-
-/*--- the open state ---*/
-ul.appBarNav li a.menuOpen {
- color: #fff;
- background-color: #6694c7;
- background-image: none;
- background-repeat: repeat-x;
- _background-image: none; /* for IE6 */
-}
-
-/*--- link color ---*/
-ul.appBarNav li.hasMenu a:hover, ul.appBarNav li a.menuOpen {
- color: #fff;
- }
-
-/* to change arrows, see Menu section, below */
-
-
-/* Menus
----------------------------------*/
-
-/* primary menu */
-.splMenu-primary ul {
- background-color: #dbe6e9;
-}
-.splMenu-primary, .splMenu-primary a, .splMenu-primary a:visited, .splMenu-primary a:hover {
- color: #000;
-}
-
-.splMenu-primary li:hover {
- background-color: #6694c7;
-}
-.splMenu-primary a:hover {
- color: #FFF;
-}
-
-/* secondary menu, used for apps pulldown */
-.splMenu-secondary ul {
- background-color: #dbe6e9;
-}
-.splMenu-secondary, .splMenu-secondary a {
- color: #000;
-}
-
-/* disabled elements */
-.splMenu-secondary li.disabled a {
- color: #666;
-}
-.splMenu-secondary li:hover {
- background-color: #6694c7;
-}
-.splMenu-secondary a:hover {
- color: #fff;
-}
-
-/* actions menu open state */
-.TitleBar div.menuOpen {
- background-color: #dbe6e9;
- color: #000;
-}
-
-/* Arrows
----------------------------------*/
-
-/*
-Arrow color is changed by adjusting the frist background position. The second value controls the direction of the arrow (i.e. NSEW).
-
-For south arrows, Use the following values for these colors:
- grey background-position: -7px -367px;
- white background-position: -27px -367px;
- green background-position: -47px -367px;
- black background-position: -67px -367px;
-
-For east arrows, Use the following values for these colors:
- grey background-position: -7px -407px;
- white background-position: -27px -407px;
- green background-position: -47px -407px;
- black background-position: -67px -407px;
-*/
-
-/* nav arrow, default state */
-ul.appBarNav li.hasMenu a span.splIcon-triangle-2-s {
-}
-
-/* hover state */
-ul.appBarNav li.hasMenu a:hover span.splIcon-triangle-2-s {
-}
-
-/* open state */
-ul.appBarNav li.hasMenu a.menuOpen span.splIcon-triangle-2-s {
-}
-
-/* actions menu open state */
-.TitleBar div.menuOpen .splIcon-triangle-4-s {
-}
-
-/* sub menu indicator */
-.splIcon-triangle-4-e {
- background-position: -67px -407px;
-}
-
-
-/* turn black arrows white */
-.splIcon-triangle-4-s {
- background-position: -67px -367px;
-}
-
-.EventsViewer .default .fields .fm {
- background-position: -27px -364px;
-}
-
-
-/* show/hide headers */
-
-.ShowHideHeader h2 span.splIcon-triangle {
-background-position:-27px -367px;
-}
-
-.ShowHideHeader h2.closed span.splIcon-triangle {
-background-position:-27px -407px;
-}
-
-
-/* background colors
----------------------------------*/
-
-/* default page color */
-body, .splBackground-default,
-.graphArea, .resultsArea,
-.reportSecondPanel, .reportThirdPanel,
-.sidebarCollapsed,
-.SearchBar .saTypeaheadWrapper,
-.ui-datepicker-links,
-.popupContent {
- background-color: #FFFFFF;
-}
-
-/* primary background - applies to search controls and primary action panels */
-.viewHeader, .mainSearchControls, .splSearchControls-inline, .SearchBar .saHelpWrapper,
-.popupContent {
- background-color: #FBFBFB;
-}
-
-/* secondary background - sidebar, other panels */
-.splBackground-secondary, .sidebarExpanded,
-.fieldValuePopup p.reportLinks {
- background-color: #dbe6e9;
-}
-
-.TimeRangePicker .timeRangeActivatorWrapper {
- background-color: ;
-}
-
-/* Specific overrides */
-.layoutCellInner .ResultsHeader .splHeader, .layoutCellInner .ResultsHeader .splHeader-secondary {
- background: transparent none;
-}
-
-/* Specific overrides */
-.popupFooter {
- background-color: #dbe6e9;
-}
-
-/* dashboard background color */
-body.splTemplate-dashboard {
- background-color: #dbe6e9;
-}
-
-/* dashboard containers */
-.dashboardCell {
- background-color: #fbfbfb;
- background-image:url(overlay_topgradient.png);
- background-repeat:repeat-x;
- -moz-box-shadow: none;
- -webkit-box-shadow: none;
- _background-image: none; /* for IE6 */
-}
-
-/* headers
----------------------------------*/
-
-/* default header font color */
-.splHeader-dashboard h2, .dashboardContent .ServerSideInclude h2, .dashboardContent .GenericHeader h3, .SearchBar .saRow h4 {
- color: #394345;
-}
-
-/* primary header background color + overlay */
-.splHeader-primary,
-.TitleBar .splHeader,
-.FieldPickerPopup .splHeader-primary {
- background-color: #FBFBFB;
- background-image:url(overlay_reversegradient_28.png);
- background-repeat:repeat-x;
- _background-image: none;
-}
-
-/* secondary (i.e. sidebar) header background color + overlay */
-.splHeader-secondary {
-background-color: #dbe6e9;
-background-image:url(overlay_topgradient_soft.png);
-background-repeat:repeat-x;
-_background-image: none;
-}
-
-/* headers w/o any overlay */
-.FlashTimeline .splHeader-primary {
- background-color: #FBFBFB;
- background-image: url(overlay_topInnerShadow_35.png);
-}
-
-/* borders
----------------------------------*/
-
-/* ALL elements with a generic border attribute */
-* {
-border-color: #e4e2e3;
-}
-
-/* refactor to remove these in default.css since they have specific color declarations; should be same value as * elements, above */
-.popupContainer,
-.fieldLayers .popupContainer,
-.splMenu-primary .actionsMenuDivider {
-border-color: #142a2d;
-}
-
-/* those rare instances when someone uses an HR */
-hr {
- color: #112225;
-}
-
-/* specific overrides */
-
-.fieldValuePopup table tr.fieldNameHeaderRow th {
-border-bottom:1px solid #142a2d;
-}
-
-/* horizontal rules in the sidebar */
-.splDivider, .SuggestedFieldViewer .splBorder-n {
-border-color: #142a2d;
-}
-
-/* tables */
-table.splTable, table.splTable td, table.splTable th {
-border-color: #142a2d;
-}
-
-.fieldValuePopup table td, .fieldValuePopup table th {
-border-color: #142a2d;
-}
-
-
-
-
-/* search controls
----------------------------------*/
-
-/* search button color; background-position of 0 0 is black, -40px 0 is white */
-input.searchButton {
- background-color: #6694c7;
- background-position:-40px 0;
-}
-
-/* search assistant */
-
-.SearchBar .assistantActivator {
-background-color: #6694c7;
-}
-
-/* search asst. arrow closed */
-.SearchBar .assTab span.splIcon-triangle {
-/*
-white > background-position:-27px -367px;
-black > background-position:-67px -367px;
-*/
-background-position:-27px -367px;
-}
-
-/* search asst. arrow open */
-.SearchBar a.assistantEnabled span.splIcon-triangle {
-/*
-white > background-position:-27px -386px;
-black > background-position:-67px -386px;
-*/
-background-position:-27px -386px;
-}
-
-
-
-.splSearchControls-inline {
- background-image: none;
-}
-
-.SearchBar .searchFieldWrapperInner {
-border-color: #6694c7;
-}
-
-/* Flash line and charts
----------------------------------*/
-
-/* All flash charts */
-/*
- background-color -> controls bgcolor
- border-left-color -> controls foregroundColor
- color -> controls fontColor
- controls and and font color get screened via an alpha layer, so should probably be set to all black or white, depending on main background
-*/
-div.FlashChart {
- background-color: #fbfbfb;
- border-left-color:#000;
- color: #000;
-}
-
-/* flash timeline specific */
-/*
- background-color -> controls bgcolor
- border-left-color -> controls foregroundColor
- color -> controls fontColor
- border-right-color -> controls seriesColor
-controls and and font color get screened via an alpha layer, so should probably be set to all black or white, depending on main background
-*/
-div.FlashTimeline {
- background-color: #fbfbfb;
- border-left-color: #000;
- color: #000;
- /* the color of the histogram bar. border-right-color = fill */
- border-right-color: #6694c7;
-}
-
-/* popup bar chart; should be same color as flash timeline */
-.splBarGraphBar {
-background-color: #6694c7;
-}
-
-/* background of bar graph */
-.splBarGraph {
-background:#FFFFFF;
-}
-
-
-
-/* buttons
----------------------------------*/
-
-.splButton-primary {
- background-color: #6694c7;
- color: ;
- background-image: url(overlay_softgradient_28.png);
-}
-.splButton-primary:hover {
- background-color: #6694c7;
- background-image: url(overlay_softgradient_28.png);
-}
-.splButton-secondary {
- background-color: #6694c7;
- color: ;
- background-image: url(overlay_softgradient_28.png);
-}
-.splButton-secondary:hover {
- background-color: #6694c7;
- background-image: url(overlay_softgradient_28.png);
-}
-
-/* form elements
-_________________________________*/
-
-fieldset legend {
- color: #c8da4a;
- font-size: 12px;
-}
-fieldset legend span {
- color: #ccc;
- font-size: 11px;
-}
-p.exampleText {
- color: #ccc;
-}
-p.fieldsetHelpText {
- color: #ccc;
-}
-
-/*-- disabled and read-only form elements --*/
-
-label.disabledLabel {
- color: ;
-}
-select option[disabled] {
- color: ;
-}
-input.readonly {
- background-color: ;
-}
-
-
-input[disabled]{
-background-color: transparent;
-border-color: transparent;
-color: ;
-}
-
-/* Icons
----------------------------------*/
-/*-- hash mark for jobs icons --*/
-.JobStatus .output ul li {
- background-image: url(bg_hash_grey.gif);
-}
-
-.splIcon-events-list, .splIcon-events-table, .splIcon-results-table {
-/*--
-master icon file. edit the local file and include this stanza if you want to override the defaults
-background-image: url(splIcons.gif);
-
- --*/
-}
-
-/*-- background color for icons --*/
-.splIcon {
- background-color: #6694c7;
-}
-
-
-
-/*-- switchers that use icons --*/
-
-.ButtonSwitcher ul li.selected, .ButtonSwitcher ul li.selected:hover,
-.EventsViewer .default .actions,
-div.FlashTimeline a.logScaleSelected span, div.FlashTimeline a.linScaleSelected span {
- border: 1px solid #6694c7;
- background-color: #6694c7;
-}
-
-.ButtonSwitcher ul li, .Paginator a, .Paginator .disabled:hover {
- border-color: transparent;
-}
-
-/*-- hash mark for jobs icons --*/
-.JobStatus .output ul li {
- background-image: url(bg_hash_grey.gif);
-}
-
-
-/*-- paginator uses similar styles --*/
-
-.Paginator .active a, .Paginator .active a:hover {
- background-color: #6694c7;
- border-color: #6694c7;
- color: #fff;
-}
-
-/*-- arrow icons --*/
-.splIcon-arrow-n, .splIcon-arrow-e, .splIcon-arrow-s, .splIcon-arrow-w {
- background-color: #6694c7;
-}
-
-/* triangles. keep this last to avoid getting background colors in the arrows! */
-/* Note: to separate color from implementation, we're using a numbering system to differentiate colors.
- 1=grey,2=white,3=green,4=black,5=blue. If the icon sprite changes, the number mapping to colors would be different */
-.splIcon-triangle,
-.splIcon-triangle-1-n, .splIcon-triangle-1-s, .splIcon-triangle-1-e, .splIcon-triangle-1-w,
-.splIcon-triangle-2-n, .splIcon-triangle-2-s, .splIcon-triangle-2-e, .splIcon-triangle-2-w,
-.splIcon-triangle-3-n, .splIcon-triangle-3-s, .splIcon-triangle-3-e, .splIcon-triangle-3-w,
-.splIcon-triangle-4-n, .splIcon-triangle-4-s, .splIcon-triangle-4-e, .splIcon-triangle-4-w,
-.splIcon-triangle-5-n, .splIcon-triangle-5-s, .splIcon-triangle-5-e, .splIcon-triangle-5-w {
- background-color:transparent;
-}
-.splIcon-triangle-large {
- background-color:transparent;
-}
-
-/*-- table sort icons --*/
-.FieldPickerPopup .fpFieldListContainerOuter th span {
- background-position:-27px -441px;
-}
-
-.FieldPickerPopup .fpFieldListContainerOuter th.headerSortDown span {
-background-position:-27px -360px;
-}
-
-.FieldPickerPopup .fpFieldListContainerOuter th.headerSortUp span {
-background-position:-27px -379px;
-}
-
-
-/* highlight colors
----------------------------------*/
-/*-- event items --*/
-.EventsViewer .default .a, .EventsViewer .default .h, .EventsViewer .default .fields .v:hover, .EventsViewer .default .fields .tg:hover {
- background-color: #f2cb3f;
-}
-
-/*-- row highlighting for tables --*/
-table.splTable tr:hover td {
- background-color:#f2cb3f;
-}
-.mouseoverHighlight, .mouseoverHightlight td {
- background-color:#f2cb3f;
-}
-
-/*-- matching search terms --*/
-.SimpleEventsViewer span.searchTermHighlight {
- background-color:#f2d440;
-}
-
-/* MultiFieldViewer + SuggestedFieldViewer, i.e. highlight in the fields sidebar */
-.MultiFieldViewer .fieldTabs .mouseoverHighlight,
-.MultiFieldViewer .fieldTabs .selected,
-.SuggestedFieldViewer .fieldTabs .mouseoverHighlight,
-.SuggestedFieldViewer .fieldTabs .selected {
- background-color: #277991;
-}
-
-/* field picker popup hover row */
-.FieldPickerPopup .fpFieldList tbody tr:hover, .FieldPickerPopup .fpFieldList tbody tr.mouseoverHighlight {
- background-color: #277991;
-}
-
-.fieldTabs a:hover {
- color: #fff;
-}
-
-
-
-/* date picker
----------------------------------*/
-.ui-datepicker-current-day {
- background-color: #6694c7;
-}
-
-.ui-datepicker-links {
- background-image: url(overlay_gradient.png) repeat-x 0 0;
- _background-image: none;
-}
-
-/* popups
----------------------------------*/
-.splHeader-popup {
- background-color: #000;
- background-image: url(overlay_gradient.png);
- background-repeat: repeat-x;
- _background-image: none;
-}
-
-.splHeader-popup h2 {
- color:#FFF;
-}
-
-
-
-/* modal overlay */
-.splOverlay, .splOverlay-white {
- background-color: #000;
- opacity:0.8;
- filter:alpha(opacity=80);
-}
-.splOverlay-white {
- background-color:#FFF;
-}
-
-/* Misc
----------------------------------*/
-
-/* resize handle */
-.ui-resizable-s {
-background-color:#6694c7 !important;
-}
-
-/* loading image for jobs */
-.JobStatus .output .running h2,
-.JobStatus .output .runningReport h2,
-.JobStatus .output .finalizing h2 {
-background-image: url(loader.gif);
-}
-
-
-/* remove the gradient at top of event and results area */
-.EventsViewer, .SimpleResultsTableResults {
-background-image: none;
-}
-
-/* used on some dashbaords */
-.SingleValueHolder {
-background-color:#194775;
-color: #fff
-}
-
-/* tighten up dashboard title displays */
-.NullModule { display: none; }
-
-.dashboardCell .FlashChart {
- background-color: transparent;
-}
-
-.dashboardContent h3 {
- margin-top: 0;
-}
diff --git a/appserver/static/realtime_ammap.html b/appserver/static/realtime_ammap.html
deleted file mode 100755
index e3b586bf..00000000
--- a/appserver/static/realtime_ammap.html
+++ /dev/null
@@ -1,16 +0,0 @@
-
-
-
- If you see this message you most likley need to adjust your HTML file in this view or you are trying to view the HTML directly instead of in a Splunk view module.
-
-
-
diff --git a/appserver/static/screenshot.jpg b/appserver/static/screenshot.jpg
deleted file mode 100755
index bcbc21f4..00000000
Binary files a/appserver/static/screenshot.jpg and /dev/null differ
diff --git a/appserver/static/screenshot.png b/appserver/static/screenshot.png
new file mode 100644
index 00000000..332089a0
Binary files /dev/null and b/appserver/static/screenshot.png differ
diff --git a/appserver/static/threat_map.html b/appserver/static/threat_map.html
deleted file mode 100755
index 84e63b0e..00000000
--- a/appserver/static/threat_map.html
+++ /dev/null
@@ -1,28 +0,0 @@
-
-
-ammap
-
-
-
-
-
-
-
- If you see this message you most likley need to adjust your HTML file in this view or you are trying to view the HTML directly instead of in a Splunk view module.
-
-
-
-
-
-
-
diff --git a/appserver/static/threat_overview.css b/appserver/static/threat_overview.css
deleted file mode 100755
index c0aba3a5..00000000
--- a/appserver/static/threat_overview.css
+++ /dev/null
@@ -1,13 +0,0 @@
-#ExtendedFieldSearch_0_0_0 label,
-#ExtendedFieldSearch_1_1_0 label,
-#ExtendedFieldSearch_2_2_0 label{
-width: 85px;
-display: inline-block;
-}
-
-
-#ExtendedFieldSearch_3_3_0 label,
-#ExtendedFieldSearch_4_4_0 label{
-width: 60px;
-display: inline-block;
-}
diff --git a/appserver/static/traffic_overview.css b/appserver/static/traffic_overview.css
deleted file mode 100755
index 0f19278b..00000000
--- a/appserver/static/traffic_overview.css
+++ /dev/null
@@ -1,18 +0,0 @@
-#ExtendedFieldSearch_0_0_0 label,
-#ExtendedFieldSearch_4_4_0 label{
-width: 75px;
-display: inline-block;
-}
-
-
-#ExtendedFieldSearch_1_1_0 label,
-#ExtendedFieldSearch_2_2_0 label{
-width: 95px;
-display: inline-block;
-}
-
-#ExtendedFieldSearch_3_3_0 label,
-#ExtendedFieldSearch_5_5_0 label {
-width: 45px;
-display: inline-block;
-}
\ No newline at end of file
diff --git a/appserver/static/web_activity.css b/appserver/static/web_activity.css
deleted file mode 100755
index 07a445db..00000000
--- a/appserver/static/web_activity.css
+++ /dev/null
@@ -1,19 +0,0 @@
-#ExtendedFieldSearch_2_2_0 label
-{
-width: 125px;
-display: inline-block;
-}
-
-#ExtendedFieldSearch_1_1_0 label{
-width: 75px;
-display: inline-block;
-}
-
-#TimeRangePicker_0_0_0 {
-padding-top: 3px;
-}
-
-#ExtendedFieldSearch_0_0_0 label{
-width: 60px;
-display: inline-block;
-}
diff --git a/appserver/static/xml_out/realtime_threat_data.xml b/appserver/static/xml_out/realtime_threat_data.xml
deleted file mode 100755
index 110e9a72..00000000
--- a/appserver/static/xml_out/realtime_threat_data.xml
+++ /dev/null
@@ -1,26 +0,0 @@
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
\ No newline at end of file
diff --git a/appserver/static/xml_out/rt_threat_data.xml b/appserver/static/xml_out/rt_threat_data.xml
deleted file mode 100755
index 3877db1b..00000000
--- a/appserver/static/xml_out/rt_threat_data.xml
+++ /dev/null
@@ -1,19 +0,0 @@
-
-
-
-
-
-
-
-
-
-
-
-
-
-
\ No newline at end of file
diff --git a/bin/alert_scripts/map_results.sh b/bin/alert_scripts/map_results.sh
deleted file mode 100755
index b7c48633..00000000
--- a/bin/alert_scripts/map_results.sh
+++ /dev/null
@@ -1,2 +0,0 @@
-echo "$@" >> /tmp/map_results.run
-python $SPLUNK_HOME/etc/apps/SplunkforPaloAltoNetworks/bin/map_results.py "$@"
diff --git a/bin/alert_scripts/mapit.sh b/bin/alert_scripts/mapit.sh
deleted file mode 100755
index 74b5a184..00000000
--- a/bin/alert_scripts/mapit.sh
+++ /dev/null
@@ -1,2 +0,0 @@
-echo "$@" > /tmp/ammap_map_results.run
-python $SPLUNK_HOME/etc/apps/AMMAP/bin/map_results.py "$@"
diff --git a/bin/map_results.py b/bin/map_results.py
deleted file mode 100755
index aea08e84..00000000
--- a/bin/map_results.py
+++ /dev/null
@@ -1,192 +0,0 @@
-import sys, os, gzip, csv, time, traceback
-import sys,splunk.Intersplunk
-import traceback
-
-#TODO App should be determined by search that calls the script
-map_type = "threat"
-log = open(os.path.join(os.environ["SPLUNK_HOME"], 'var', 'log', 'splunk','ammap_map_results.log'), 'a')
-results_file = ""
-result_path = os.path.join(os.environ["SPLUNK_HOME"], 'var', 'run', 'splunk','dispatch')
-DEBUG = 1
-zoom_string = ' zoom="399.8812%" zoom_x="-33.8%" zoom_y="-142.62%" '
-
-
-def get_results():
- global outputFile
- global app
- global zoom
- if len(sys.argv)>5:
- logger("INFO - Alert Action Suspected!")
- results = sys.argv[6]
- path = results[results.find('sid=')+4:]
- results_file = os.path.join(result_path,path,'results.csv.gz')
-
- logger("INFO - Alert Action Fired...Moving On")
- elif len(sys.argv) == 2:
- logger("INFO - checking for SID: "+ sys.argv[1])
-
- results_file = os.path.join(results_file,sys.argv[1],'results.csv.gz')
-
- logger("INFO - SID found....Moving On")
- elif sys.argv.count('-f')>0:
- logger("INFO - Attempting to read from local file: "+ sys.argv[2])
- results_file = sys.argv[2]
- logger("INFO - File found....Moving On")
- else:
- logger("INFO - Checking Intersplunk for results")
- results,dummyresults,settings = splunk.Intersplunk.getOrganizedResults()
-
- result_dict_list = []
- logger("INFO - checking for target app in search results")
- if results[0].has_key("app"):
- app = results[0]["app"]
- logger("INFO - checking for output file in search results")
- if results[0].has_key("output_file"):
- outputFile = os.path.join(os.environ["SPLUNK_HOME"], 'etc', 'apps', app,'appserver','static','xml_out',results[0]["output_file"])
- logger("INFO - checking for zoom settings in search results")
- if results[0].has_key("zoom"):
- zoom = results[0]["zoom"]
- else:
- zoom = zoom_string
-
-
-
-
- return results
- results = csv.reader(gzip.open(results_file),delimiter=',', quotechar='"')
- logger("INFO - Results Recieved, constructing dict")
- header = []
- resultDict = {}
- result_dict_list = []
- first = 1
-
- for row in results:
- if first:
- header = row
- logger("FOUND FIELDS: "+str(row))
- first = 0
- continue;
- resultDict = {}
- x = 0
- for col in row:
- resultDict[header[x]] = col
- x = x + 1
- result_dict_list.append(resultDict)
- logger("checking for target app in search results")
- if result_dict_list[0].has_key("app"):
- app = result_dict_list[0]["app"]
-
- logger("checking for output file in search results")
- if result_dict_list[0].has_key("output_file"):
- outputFile = os.path.join(os.environ["SPLUNK_HOME"], 'etc', 'apps', app,'appserver','static','xml_out',result_dict_list[0]["output_file"])
-
- if result_dict_list[0].has_key("zoom"):
- zoom = result_dict_list[0]["zoom"]
-
- else:
- zoom = zoom_string
-
-
-
-
- return result_dict_list
-
-
-def aggregate_results(result_dict_list):
- logger("INFO - Aggregating results ....")
- iterator = result_dict_list[0]["iterator"]
- geo_dict = {}
- for dict in result_dict_list:
-## Need to crate a unique key to calculate totals by location.
- key = dict["client_lon"]+dict["client_lat"]
- if geo_dict.has_key(key) == False:
- geo_dict[key] = {'iterator':iterator,'uniq':{dict[iterator]:1},'count':int(dict["count"]),iterator:[dict[iterator]],"city":dict["client_city"],"region":dict["client_region"],"country":dict["client_country"],"long":dict["client_lon"],"lat":dict["client_lat"],"label":dict["iterator_label"],"movie_color":dict["movie_color"],"title":dict["count_label"]}
- else:
-# logger("Repeat Key updating iterator list and count for:" + key)
- geo_dict[key]['count'] = geo_dict[key]['count'] + int(dict["count"])
- geo_dict[key][iterator].append(dict[iterator])
- if geo_dict[key]['uniq'].has_key(dict[iterator]):
- continue;
- else:
- geo_dict[key]['uniq'][dict[iterator]] = 1
- return geo_dict
-
-def format_movies(geo_results):
- movie_list = []
- for key in geo_results.keys():
- movie = ""
- title = ""
- url = "/app/"+app+"/flashtimeline?q=search%20"
- if len(geo_results[key]["country"])>1:
- title = geo_results[key]["country"]
- if len(geo_results[key]["region"])>1:
- title = geo_results[key]["region"]+", "+ title
- if len(geo_results[key]["city"])>1:
- title = geo_results[key]["city"]+", "+ title
- title = title + '\n ' + geo_results[key]["title"] + '(s): ' + str(geo_results[key]["count"]) + "\n Unique " +geo_results[key]["label"] + "(s): "+ str(len(geo_results[key]["uniq"])) + '"'
- uniq_keys = ""
- for x in geo_results[key]["uniq"].keys():
- uniq_keys = uniq_keys + geo_results[key]["iterator"] + "%3D" + x + "%20OR%20"
- url = url + uniq_keys[:len(uniq_keys)-8]
- size = int(geo_results[key]["count"]) / 10
- if size>15: size = 25
- if size==15: size = 25
- if size<2: size = 10
- if size==2: size=10
- movie = '\n\n \n'
- movie_list.append(movie)
- return movie_list
-
-def write_threat_xml(movies):
-
- movies_string = ""
- for movie in movies:
- movies_string = movie + '\n' + movies_string
- end = '''
-
-
-
-
-
- '''
-
- borders = '''
-
-
-
-
-
- '''
- xml_out = '\n '+borders+'\n\t\t\n' + movies_string + ' '
- xml_file = open(outputFile,'w')
- xml_file.write(xml_out)
- logger("Writing XML to : " + outputFile)
- return 0
-
-
-def logger(string):
- if DEBUG==1:
-# print time.asctime() + ' - ' + string
- log.write(time.asctime() + ' - ' + string + "\n")
- return 0
-def run():
- try:
- logger( "INFO - get_results()" )
- result_dict_list = get_results()
- logger("INFO - aggregate_results()")
- geo_results = aggregate_results(result_dict_list)
- logger("INFO - format_movies()")
- movies = format_movies(geo_results)
- logger("INFO - write_threat_xml()")
- write_threat_xml(movies)
- print "Map Results Completed"
- except:
- stack = traceback.format_exc()
- logger('ERROR - Traceback:' + str(stack))
-
-run()
diff --git a/default/app.conf b/default/app.conf
index 96d636ef..8adda24f 100755
--- a/default/app.conf
+++ b/default/app.conf
@@ -5,7 +5,7 @@ label = Splunk for Palo Alto Networks
[launcher]
author= btorres-gil@paloaltonetworks.com
description= The Splunk for Palo Alto Networks app is a set of field extractions, reports, lookups and dashboards which provide visibility into the Palo Alto Networks Firewall data.
-version = 3.4
+version = 4.0
[package]
id= SplunkforPaloAltoNetworks
diff --git a/default/commands.conf b/default/commands.conf
index 9ac1d2db..6d064e53 100755
--- a/default/commands.conf
+++ b/default/commands.conf
@@ -1,13 +1,3 @@
-[ciscomap]
-filename = cisco_map_results.py
-retainsevents = true
-overrides_timeorder = false
-
-[mapit]
-filename = map_results.py
-retainsevents = true
-overrides_timeorder = false
-
[panblock]
filename = panChange.py
passauth = true
diff --git a/default/data/ui/nav/default.xml b/default/data/ui/nav/default.xml
index 97a40985..0350ff70 100755
--- a/default/data/ui/nav/default.xml
+++ b/default/data/ui/nav/default.xml
@@ -1,90 +1,91 @@
-
-
-
- Search
- Traffic Logs
- Threat Data
- URL Logs
- Data Filtering Logs
- WildFire Logs
- Config Messages
- System Logs
-
- Configuration
- Send Feedback
-
-
-
-
- Search Traffic Data
-
-
-
-
-
- Search Threat Data
-
-
-
-
-
- Search URL Data
- Search Data Filtering Data
-
-
-
-
-
- Search WildFire Log Data
- Search WildFire Report Data
-
-
-
-
-
- Search System Messages
-
-
- Search Config Changes
-
-
-
-
-
+
+
+
+ Search
+ Traffic Logs
+ Threat Data
+ URL Logs
+ Data Filtering Logs
+ File Blocking Logs
+ WildFire Logs
+ Config Messages
+ System Logs
+
+ Configuration
+ Send Feedback
+
+
+
+
+ Search Traffic Data
+
+
+
+
+
+ Search Threat Data
+
+
+
+
+
+ Search URL Data
+ Search Data Filtering Data
+
+
+
+
+
+ Search WildFire Log Data
+ Search WildFire Report Data
+
+
+
+
+
+ Search System Messages
+
+
+ Search Config Changes
+
+
+
+
+
diff --git a/default/data/ui/nav/default.xml.nfi_disabled b/default/data/ui/nav/default.xml.nfi_disabled
index 97a40985..0350ff70 100755
--- a/default/data/ui/nav/default.xml.nfi_disabled
+++ b/default/data/ui/nav/default.xml.nfi_disabled
@@ -1,90 +1,91 @@
-
-
-
- Search
- Traffic Logs
- Threat Data
- URL Logs
- Data Filtering Logs
- WildFire Logs
- Config Messages
- System Logs
-
- Configuration
- Send Feedback
-
-
-
-
- Search Traffic Data
-
-
-
-
-
- Search Threat Data
-
-
-
-
-
- Search URL Data
- Search Data Filtering Data
-
-
-
-
-
- Search WildFire Log Data
- Search WildFire Report Data
-
-
-
-
-
- Search System Messages
-
-
- Search Config Changes
-
-
-
-
-
+
+
+
+ Search
+ Traffic Logs
+ Threat Data
+ URL Logs
+ Data Filtering Logs
+ File Blocking Logs
+ WildFire Logs
+ Config Messages
+ System Logs
+
+ Configuration
+ Send Feedback
+
+
+
+
+ Search Traffic Data
+
+
+
+
+
+ Search Threat Data
+
+
+
+
+
+ Search URL Data
+ Search Data Filtering Data
+
+
+
+
+
+ Search WildFire Log Data
+ Search WildFire Report Data
+
+
+
+
+
+ Search System Messages
+
+
+ Search Config Changes
+
+
+
+
+
diff --git a/default/data/ui/nav/default.xml.nfi_enabled b/default/data/ui/nav/default.xml.nfi_enabled
index cd2a81c0..5f71416c 100755
--- a/default/data/ui/nav/default.xml.nfi_enabled
+++ b/default/data/ui/nav/default.xml.nfi_enabled
@@ -1,113 +1,114 @@
-
-
-
- Search
- Traffic Logs
- Threat Data
- URL Logs
- Data Filtering Logs
- WildFire Logs
- Config Messages
- System Logs
-
- Configuration
- Send Feedback
-
-
-
-
- Search Traffic Data
-
-
-
-
-
- Search Threat Data
-
-
-
-
-
- Search URL Data
- Search Data Filtering Data
-
-
-
-
-
- Search WildFire Log Data
- Search WildFire Report Data
-
-
-
-
-
- Search System Messages
-
-
- Search Config Changes
-
-
-
-
-
-
- Timeline
-
-
-
-
+
+
+
+ Search
+ Traffic Logs
+ Threat Data
+ URL Logs
+ Data Filtering Logs
+ File Blocking Logs
+ WildFire Logs
+ Config Messages
+ System Logs
+
+ Configuration
+ Send Feedback
+
+
+
+
+ Search Traffic Data
+
+
+
+
+
+ Search Threat Data
+
+
+
+
+
+ Search URL Data
+ Search Data Filtering Data
+
+
+
+
+
+ Search WildFire Log Data
+ Search WildFire Report Data
+
+
+
+
+
+ Search System Messages
+
+
+ Search Config Changes
+
+
+
+
+
+
+ Timeline
+
+
+
+
diff --git a/default/data/ui/views/about.xml b/default/data/ui/views/about.xml
deleted file mode 100755
index f3080921..00000000
--- a/default/data/ui/views/about.xml
+++ /dev/null
@@ -1,16 +0,0 @@
-
- About Splunk for Palo Alto Networks
-
-
-
-
-
-
-
diff --git a/default/data/ui/views/ammap_view.xml b/default/data/ui/views/ammap_view.xml
deleted file mode 100755
index d50e7a4e..00000000
--- a/default/data/ui/views/ammap_view.xml
+++ /dev/null
@@ -1,34 +0,0 @@
-
- AMMAP View
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
diff --git a/default/data/ui/views/config_overview.xml b/default/data/ui/views/config_overview.xml
old mode 100755
new mode 100644
index e6359e0a..8022cdc3
--- a/default/data/ui/views/config_overview.xml
+++ b/default/data/ui/views/config_overview.xml
@@ -1,272 +1,243 @@
-
+
\ No newline at end of file
+
+
+ -60m
+ now
+
+
+ Admin
+ admin="
+ "
+ ANY
+ |tstats count(admin) as count
+ FROM pan_config WHERE earliest=$earliest$ latest=$latest$ groupby admin
+ | eval admin_with_count = admin . " (" . count . ")"
+
+ Host
+ host="
+ "
+ ANY
+ |tstats count(host) as count
+ FROM pan_config WHERE earliest=$earliest$ latest=$latest$ groupby host
+ | eval host_with_count = host . " (" . count . ")"
+
+ Client
+ client="
+ "
+ ANY
+ |tstats count(client) as count
+ FROM pan_config WHERE earliest=$earliest$ latest=$latest$ groupby client
+ | eval client_with_count = client . " (" . count . ")"
+
+ Command
+ cmd="
+ "
+ ANY
+ |tstats count(cmd) as count
+ FROM pan_config WHERE earliest=$earliest$ latest=$latest$ groupby cmd
+ | eval cmd_with_count = cmd . " (" . count . ")"
+
+ Result
+ result="
+ "
+ ANY
+ |tstats count(result) as count
+ FROM pan_config WHERE earliest=$earliest$ latest=$latest$ groupby result
+ | eval result_with_count = result . " (" . count . ")"
+
+ Virtual System
+ vsys="
+ "
+ ANY
+ |tstats count(vsys) as count
+ FROM pan_config WHERE earliest=$earliest$ latest=$latest$ groupby vsys
+ | eval vsys_with_count = vsys . " (" . count . ")"
+
+
+
+
+ Latest Events
+ | tstats count(admin) FROM pan_config WHERE earliest=$earliest$ latest=$latest$ $host$ $admin$ $client$ $result$ $cmd$ $vsys$ groupby _time result serial_number host admin client cmd configuration_path | table _time result serial_number host admin client cmd configuration_path result | sort -_time
+ $earliest$
+ $latest$
+ visible
+ visible
+ linear
+ linear
+ area
+ connect
+ 0.01
+ stacked
+ shiny
+ all
+ 0
+ ellipsisMiddle
+ bottom
+ false
+ true
+ none
+ row
+ 10
+
+
+
+
+
+
+ Config Events
+ | tstats count(cmd) AS cr FROM pan_config WHERE earliest=$earliest$ latest=$latest$ $host$ $admin$ $client$
+ $result$ $cmd$ $vsys$ groupby _time cmd| timechart values(cr) by cmd
+ $earliest$
+ $latest$
+ visible
+ visible
+ linear
+ linear
+ column
+ gaps
+ 0.01
+ stacked
+ shiny
+ all
+ 0
+ ellipsisMiddle
+ bottom
+
+
+
+
+ Configuration Administrators
+ | tstats count(admin) AS ca FROM pan_config WHERE earliest=$earliest$ latest=$latest$ $host$ $admin$ $client$ $result$ $cmd$ $vsys$ groupby _time admin | timechart values(admin) by admin
+ $earliest$
+ $latest$
+ visible
+ visible
+ linear
+ linear
+ column
+ gaps
+ 0.01
+ stacked
+ shiny
+ all
+ 0
+ ellipsisMiddle
+ bottom
+
+
+
+
+
+
+ Clients Used
+ | tstats count(client) AS cc FROM pan_config WHERE earliest=$earliest$ latest=$latest$ $host$ $admin$ $client$ $result$ $cmd$ $vsys$ groupby client
+ $earliest$
+ $latest$
+ visible
+ visible
+ linear
+ linear
+ pie
+ gaps
+ 0.01
+ default
+ shiny
+ all
+ 0
+ ellipsisMiddle
+ right
+
+
+
+
+ Results
+ | tstats count(result) AS cr FROM pan_config WHERE earliest=$earliest$ latest=$latest$ $host$ $admin$ $client$ $result$ $cmd$ $vsys$ groupby result
+ $earliest$
+ $latest$
+ visible
+ visible
+ linear
+ linear
+ pie
+ gaps
+ 0.01
+ default
+ shiny
+ all
+ 0
+ ellipsisMiddle
+ right
+
+
+
+
+
diff --git a/default/data/ui/views/content_overview.xml b/default/data/ui/views/content_overview.xml
old mode 100755
new mode 100644
index d95ead5e..39f25d3d
--- a/default/data/ui/views/content_overview.xml
+++ b/default/data/ui/views/content_overview.xml
@@ -1,241 +1,221 @@
-
- Content Dashboard
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
\ No newline at end of file
+
diff --git a/default/data/ui/views/data_filtering.xml b/default/data/ui/views/data_filtering.xml
deleted file mode 100755
index c639b19b..00000000
--- a/default/data/ui/views/data_filtering.xml
+++ /dev/null
@@ -1,276 +0,0 @@
-
- Data Filtering Dashboard
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
diff --git a/default/data/ui/views/data_filtering_overview.xml b/default/data/ui/views/data_filtering_overview.xml
new file mode 100644
index 00000000..6c62128a
--- /dev/null
+++ b/default/data/ui/views/data_filtering_overview.xml
@@ -0,0 +1,186 @@
+
diff --git a/default/data/ui/views/faq.xml b/default/data/ui/views/faq.xml
deleted file mode 100644
index 3a02a618..00000000
--- a/default/data/ui/views/faq.xml
+++ /dev/null
@@ -1,7 +0,0 @@
- FAQ
-
-
-
diff --git a/default/data/ui/views/nfi_overview.xml b/default/data/ui/views/nfi_overview.xml
index b2c435b9..37d83db1 100644
--- a/default/data/ui/views/nfi_overview.xml
+++ b/default/data/ui/views/nfi_overview.xml
@@ -1,5 +1,5 @@
- Overview
+ NetFlow Overview
diff --git a/default/data/ui/views/overview.xml b/default/data/ui/views/overview.xml
new file mode 100644
index 00000000..5e3af34c
--- /dev/null
+++ b/default/data/ui/views/overview.xml
@@ -0,0 +1,110 @@
+
+ Overview
+
+
+ `pan_index` | stats dc(host)
+ rt-30s
+ rt
+ None
+ PAN Reporting
+ search
+
+
+ `pan_index` | stats count
+ rt-30s
+ rt
+ None
+ Total Events
+ search
+
+
+ `pan_index` action=block* OR action=deny | stats count
+ rt-30s
+ rt
+ None
+ Total Blocks
+ search
+
+
+ `pan_index` sourcetype=pan_traffic NOT any| top limit=1 category
+ rt-30s
+ rt
+ None
+ Top Category
+ search
+
+
+
+
+ Event Types
+ `pan_index` sourcetype="pan_*" log_subtype="*" | timechart span=10s count by log_subtype
+ rt-5m
+ rt
+ linear
+ linear
+ area
+ gaps
+ 0.01
+ stacked
+ shiny
+ all
+ 1
+ ellipsisMiddle
+ right
+ None
+ none
+ false
+ cell
+ 0
+ full
+ 1
+ 5
+ full
+ 0
+ 0
+ asc
+ 1
+ list
+ true
+ 10
+ visible
+ visible
+ 0
+ Events
+
+
+
+
+ Top Applications
+ PAN - Traffic - Applications
+ Total Events
+ None
+ none
+ true
+ cell
+ false
+ 10
+
+
+
+
+
+
+ Applications by Destination IP Location
+ `pan_traffic` | iplocation "dst_ip" | geostats count by app
+ rt-5m
+ rt
+
+
+
\ No newline at end of file
diff --git a/default/data/ui/views/pan_overview_switcher_maps.xml b/default/data/ui/views/pan_overview_switcher_maps.xml
deleted file mode 100755
index 88af9435..00000000
--- a/default/data/ui/views/pan_overview_switcher_maps.xml
+++ /dev/null
@@ -1,222 +0,0 @@
-
- PAN Overview
-
-
-
-
-
-
-
-
- - field
- - afterLabel
- - classField
-
-
-
-
-
-
-
-
-
-
-
-
- - field
- - afterLabel
- - classField
-
-
-
-
-
-
-
-
-
-
-
-
- - field
- - afterLabel
- - classField
-
-
-
-
-
-
-
-
-
-
-
-
- - field
- - afterLabel
- - classField
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
- - charting.chart
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
\ No newline at end of file
diff --git a/default/data/ui/views/readme.xml b/default/data/ui/views/readme.xml
deleted file mode 100644
index 9dda148e..00000000
--- a/default/data/ui/views/readme.xml
+++ /dev/null
@@ -1,7 +0,0 @@
- Readme
-
-
-
diff --git a/default/data/ui/views/system_overview.xml b/default/data/ui/views/system_overview.xml
old mode 100755
new mode 100644
index 76e457d1..7020b529
--- a/default/data/ui/views/system_overview.xml
+++ b/default/data/ui/views/system_overview.xml
@@ -1,211 +1,169 @@
-
+
\ No newline at end of file
+
+
+ -60m
+ now
+
+
+ Log Subtype
+ log_subtype="
+ "
+ ANY
+ |tstats count(log_subtype) as count
+ FROM pan_system WHERE earliest=$earliest$ latest=$latest$ groupby log_subtype
+ | eval log_subtype_with_count = log_subtype . " (" . count . ")"
+
+ Event ID
+ event_id="
+ "
+ ANY
+ |tstats count(event_id) as count
+ FROM pan_system WHERE earliest=$earliest$ latest=$latest$ groupby event_id
+ | eval event_id_with_count = event_id . " (" . count . ")"
+
+ Serial Number
+ serial_number="
+ "
+ ANY
+ |tstats count(serial_number) as count
+ FROM pan_system WHERE earliest=$earliest$ latest=$latest$ groupby serial_number
+ | eval serial_number_with_count = serial_number . " (" . count . ")"
+
+ Severity
+ severity="
+ "
+ ANY
+ |tstats count(severity) as count
+ FROM pan_system WHERE earliest=$earliest$ latest=$latest$ groupby severity
+ | eval severity_with_count = severity . " (" . count . ")"
+
+ Description
+ description="
+ "
+
+
+
+
+ Latest Events
+ | tstats count(description) AS cls FROM pan_system WHERE earliest=$earliest$ latest=$latest$ $serial_number$ $description$ $log_subtype$ $severity$ $event_id$ groupby _time serial_number description log_subtype severity event_id | table _time serial_number description log_subtype severity event_id | sort -_time
+ $earliest$
+ $latest$
+ visible
+ visible
+ linear
+ linear
+ area
+ connect
+ 0.01
+ stacked
+ shiny
+ all
+ 0
+ ellipsisMiddle
+ bottom
+ false
+ true
+ none
+ cell
+ 10
+
+
+
+
+
+
+ System Events Over Time
+ | tstats count(log_subtype) AS ce FROM pan_system WHERE earliest=$earliest$ latest=$latest$ $serial_number$ $description$ $log_subtype$ $severity$ $event_id$ groupby _time log_subtype | timechart values(ce) by log_subtype
+ $earliest$
+ $latest$
+ visible
+ visible
+ linear
+ linear
+ column
+ gaps
+ 0.01
+ stacked
+ shiny
+ all
+ 0
+ ellipsisMiddle
+ bottom
+
+
+
+
+ Severity
+ | tstats count(severity) AS cs FROM pan_system WHERE earliest=$earliest$ latest=$latest$ $serial_number$ $description$ $log_subtype$ $severity$ $event_id$ groupby _time severity | timechart values(cs) by severity
+ $earliest$
+ $latest$
+ visible
+ visible
+ linear
+ linear
+ column
+ gaps
+ 0.01
+ stacked
+ shiny
+ all
+ 0
+ ellipsisMiddle
+ bottom
+
+
+
+
+
diff --git a/default/data/ui/views/threat_detail.xml b/default/data/ui/views/threat_detail.xml
old mode 100755
new mode 100644
index f5fdace5..1c4ec7a6
--- a/default/data/ui/views/threat_detail.xml
+++ b/default/data/ui/views/threat_detail.xml
@@ -1,216 +1,166 @@
-
- Threat Details
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
\ No newline at end of file
+
diff --git a/default/data/ui/views/threat_overview.xml b/default/data/ui/views/threat_overview.xml
old mode 100755
new mode 100644
index ad4e1e16..b72c1d5c
--- a/default/data/ui/views/threat_overview.xml
+++ b/default/data/ui/views/threat_overview.xml
@@ -1,305 +1,273 @@
-
- Threat Dashboard
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
\ No newline at end of file
+
diff --git a/default/data/ui/views/traffic_overview.xml b/default/data/ui/views/traffic_overview.xml
old mode 100755
new mode 100644
index 0d469bf2..9e635d93
--- a/default/data/ui/views/traffic_overview.xml
+++ b/default/data/ui/views/traffic_overview.xml
@@ -1,330 +1,316 @@
-
- Traffic Dashboard
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
+
diff --git a/default/data/ui/views/url_filtering.xml b/default/data/ui/views/url_filtering.xml
deleted file mode 100755
index 6a491509..00000000
--- a/default/data/ui/views/url_filtering.xml
+++ /dev/null
@@ -1,240 +0,0 @@
-
- URL Filtering Dashboard
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
diff --git a/default/data/ui/views/url_filtering_overview.xml b/default/data/ui/views/url_filtering_overview.xml
new file mode 100644
index 00000000..ba924cec
--- /dev/null
+++ b/default/data/ui/views/url_filtering_overview.xml
@@ -0,0 +1,188 @@
+
diff --git a/default/data/ui/views/web_usage_report.xml b/default/data/ui/views/web_usage_report.xml
old mode 100755
new mode 100644
index 0dc218e7..8be899cb
--- a/default/data/ui/views/web_usage_report.xml
+++ b/default/data/ui/views/web_usage_report.xml
@@ -1,186 +1,167 @@
-
+
+
+
+ -60m
+ now
+
+
+ Source IP
+ src_ip="
+ "
+
+ Destination Hostname
+ dst_hostname="
+ "
+
+ Source User
+ src_user="
+ "
+
+ Virtual System
+ vsys="
+ "
+ ANY
+ |tstats count(vsys) as count
+ FROM pan_web WHERE earliest=$earliest$ latest=$latest$ groupby vsys
+ | eval vsys_with_count = vsys . " (" . count . ")"
+
+
+
+
+ Web Hits
+ | tstats count(dst_hostname) AS cdh FROM pan_web WHERE earliest=$earliest$ latest=$latest$ $vsys$ $src_ip$ $dst_hostname$ $src_user$ groupby dst_hostname | stats values(cdh) AS Count by dst_hostname | sort -Count | rename dst_hostname AS Hostname
+ $earliest$
+ $latest$
+ visible
+ visible
+ linear
+ linear
+ pie
+ gaps
+ 0.01
+ default
+ shiny
+ all
+ 0
+ ellipsisMiddle
+ right
+ false
+ true
+ none
+ row
+ 10
+
+
+
+
+ Categories
+ | tstats count(category) AS cc FROM pan_web WHERE earliest=$earliest$ latest=$latest$ $vsys$ $src_ip$ $dst_hostname$ $src_user$ groupby category
+ $earliest$
+ $latest$
+ visible
+ visible
+ linear
+ linear
+ pie
+ gaps
+ 0.01
+ default
+ shiny
+ all
+ 0
+ ellipsisMiddle
+ right
+
+
+
+
+ Applications
+ | tstats count(app) FROM pan_web WHERE earliest=$earliest$ latest=$latest$ $vsys$ $src_ip$ $dst_hostname$ $src_user$ groupby app
+ $earliest$
+ $latest$
+ visible
+ visible
+ linear
+ linear
+ pie
+ gaps
+ 0.01
+ default
+ shiny
+ all
+ 0
+ ellipsisMiddle
+ right
+
+
+
+
+
+
+ Web Activity Summary
+ | tstats count(action) AS Count FROM pan_web WHERE earliest=$earliest$ latest=$latest$ $vsys$ $src_ip$ $dst_hostname$ $src_user$ groupby action category dst_hostname | sort -Count | rename action AS Action | rename category AS Category | rename dst_hostname AS Hostname
+ $earliest$
+ $latest$
+ visible
+ visible
+ linear
+ linear
+ pie
+ gaps
+ 0.01
+ default
+ shiny
+ all
+ 0
+ ellipsisMiddle
+ right
+ false
+ true
+ none
+ row
+ 10
+
+
+
+
+
diff --git a/default/data/ui/views/web_usage_report_print.xml b/default/data/ui/views/web_usage_report_print.xml
deleted file mode 100755
index 898cddb5..00000000
--- a/default/data/ui/views/web_usage_report_print.xml
+++ /dev/null
@@ -1,15 +0,0 @@
-
- Web Activty Report Print
-
-
-
-
-
-
-
diff --git a/default/data/ui/views/wildfire_overview.xml b/default/data/ui/views/wildfire_overview.xml
old mode 100755
new mode 100644
index 80cf8f0a..657c708d
--- a/default/data/ui/views/wildfire_overview.xml
+++ b/default/data/ui/views/wildfire_overview.xml
@@ -1,363 +1,347 @@
-
- WildFire Dashboard
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
+
diff --git a/default/macros.conf b/default/macros.conf
index 1cb3c624..ba638649 100755
--- a/default/macros.conf
+++ b/default/macros.conf
@@ -7,10 +7,10 @@
definition = index=pan_logs
[pan_threat]
-definition = `pan_index` (sourcetype="pan_threat" OR sourcetype="pan_threat-2050") NOT "THREAT,url"
+definition = `pan_index` sourcetype="pan_threat" (log_subtype!="file" AND log_subtype!="url" AND log_subtype!="data" AND log_subtype!="wildfire")
[pan_threat_all]
-definition = `pan_index` (sourcetype="pan_threat" OR sourcetype="pan_threat-2050")
+definition = `pan_index` sourcetype="pan_threat"
[pan_traffic]
definition = `pan_index` sourcetype="pan_traffic"
@@ -22,19 +22,25 @@ definition = `pan_index` sourcetype="pan_system"
definition = `pan_index` sourcetype="pan_config"
[pan_web_activity]
-definition = `pan_index` "THREAT,url" (sourcetype="pan_threat" OR sourcetype="pan_threat-2050")
+definition = `pan_index` log_subtype="url" sourcetype="pan_threat"
[pan_url]
-definition = `pan_index` "THREAT,url" (sourcetype="pan_threat" OR sourcetype="pan_threat-2050")
+definition = `pan_index` log_subtype="url" sourcetype="pan_threat"
[pan_data_filtering]
-definition = `pan_index` "THREAT,data" (sourcetype="pan_threat" OR sourcetype="pan_threat-2050")
+definition = `pan_index` log_subtype="data" sourcetype="pan_threat"
[pan_data]
-definition = `pan_index` "THREAT,data" (sourcetype="pan_threat" OR sourcetype="pan_threat-2050")
+definition = `pan_index` log_subtype="data" sourcetype="pan_threat"
+
+[pan_file_blocking]
+definition = `pan_index` log_subtype="file" sourcetype="pan_threat"
+
+[pan_file]
+definition = `pan_index` log_subtype="file" sourcetype="pan_threat"
[pan_wildfire]
-definition = `pan_index` "THREAT,wildfire" (sourcetype="pan_threat" OR sourcetype="pan_threat-2050")
+definition = `pan_index` log_subtype="wildfire" sourcetype="pan_threat"
[pan_wildfire_report]
definition = `pan_index` sourcetype="pan_wildfire_report"
diff --git a/default/props.conf b/default/props.conf
index 3765bfaa..fb18fd97 100755
--- a/default/props.conf
+++ b/default/props.conf
@@ -1,7 +1,7 @@
LOOKUP-vendor_info_for_pan_config = pan_vendor_info_lookup sourcetype OUTPUT vendor,product
[pan_log]
-TRANSFORMS-sourcetype = pan_threat, pan_traffic, pan_system, pan_config, pan_threat-2050
+TRANSFORMS-sourcetype = pan_threat, pan_traffic, pan_system, pan_config
SHOULD_LINEMERGE = false
MAX_TIMESTAMP_LOOKAHEAD = 44
pulldown_type = true
@@ -23,23 +23,6 @@ FIELDALIAS-dest_for_pan_threat = dst_ip as dest
FIELDALIAS-dest-port_for_pan_threat = dst_port as dest_port
FIELDALIAS-rule_name_for_pan_threat = rule_name as rule
-
-[pan_threat-2050]
-REPORT-search = extract_threat-2050
-REPORT-threatid = extract_threatid
-REPORT-urlhost = extract_urlhost
-SHOULD_LINEMERGE = false
-lookup_table = threat_lookup threat_id
-lookup_table = app_lookup app
-FIELDALIAS = "application" AS "app" "virtual_system" AS "vsys"
-# Field Aliases to map palo alto fields to the Splunk Common Information Model
-FIELDALIAS-dvc_for_pan_threat = host as dvc
-FIELDALIAS-transport_for_pan_threat = protocol as transport
-FIELDALIAS-src_for_pan_threat = src_ip as src
-FIELDALIAS-dest_for_pan_threat = dst_ip as dest
-FIELDALIAS-dest-port_for_pan_threat = dst_port as dest_port
-FIELDALIAS-rule_name_for_pan_threat = rule_name as rule
-
[pan_traffic]
REPORT-search = extract_traffic
SHOULD_LINEMERGE = false
@@ -53,7 +36,6 @@ FIELDALIAS-dest_for_pan_traffic = dst_ip as dest
FIELDALIAS-dest-port_for_pan_traffic = dst_port as dest_port
FIELDALIAS-rule_name_for_pan_traffic = rule_name as rule
-
[pan_system]
REPORT-search = extract_system
SHOULD_LINEMERGE = false
diff --git a/default/savedsearches.conf b/default/savedsearches.conf
index ac244444..3cf6c3e4 100755
--- a/default/savedsearches.conf
+++ b/default/savedsearches.conf
@@ -69,7 +69,7 @@ displayview = flashtimeline
enableSched = 1
realtime_schedule = 0
request.ui_dispatch_view = flashtimeline
-search = `pan_wildfire` | rex field=threat_id "\((?\d+)\)" | table _time report_id dst_user dst_location src_ip dst_ip category app threat_id action vsys misc | tscollect namespace=pan_wildfire
+search = `pan_wildfire` | rex field=threat_id "\((?\d+)\)" | table _time report_id dst_user dst_location src_ip dst_ip category app threat_id action vsys misc | fillnull value="" dst_user | tscollect namespace=pan_wildfire
disabled = 0
[PAN - WildFire Reports - Retrieve]
@@ -109,7 +109,7 @@ displayview = flashtimeline
enableSched = 1
realtime_schedule = 0
request.ui_dispatch_view = flashtimeline
-search = `pan_config` | table _time vsys host admin client cmd configuration_path result serial_number log_subtype| tscollect namespace=pan_config
+search = `pan_config` | table _time vsys host admin client cmd configuration_path result serial_number log_subtype | fillnull value="" configuration_path | tscollect namespace=pan_config
disabled = 0
[PAN - Traffic - Applications]
@@ -120,4 +120,4 @@ dispatch.earliest_time = rt-5m
dispatch.latest_time = rt
displayview = flashtimeline
request.ui_dispatch_view = flashtimeline
-search = `pan_index` sourcetype=pan_traffic | stats sparkline sum(bytes) AS sbytes by app vsys src_zone | sort -sbytes | head 5 | eval Application=upper(app) | eval "Volume in MB"=round(sbytes/1024/1024) |rename sparkline AS Distribution | rename vsys AS VSYS| rename src_zone AS "Source Zone" | table Application VSYS "Source Zone" "Volume in MB" Distribution
+search = `pan_index` sourcetype=pan_traffic | stats sparkline sum(bytes) AS sbytes by app vsys src_zone | sort -sbytes | head 8 | eval Application=upper(app) | eval "Vol in MB"=round(sbytes/1024/1024) |rename sparkline AS Distribution | rename vsys AS VSYS| rename src_zone AS "Src Zone" | table Application VSYS "Src Zone" "Vol in MB" Distribution
diff --git a/default/searchbnf.conf b/default/searchbnf.conf
index 3cfd5f4d..88373c09 100644
--- a/default/searchbnf.conf
+++ b/default/searchbnf.conf
@@ -16,7 +16,7 @@ tags = pan
[panupdate-command]
syntax = panupdate device= devicegroup=
shortdesc = Adds Dynamic Address objects and maps users to those objects
-description = The command take user-id and IP addresses and inputs the Panorama and individual firewall configurations with those IP addresses. The command expects two fields, addrip and addruser. Use the rename command if your userid and ip fields have different labels. It may take up to a minute for the changes to take effect in the Panorama and PAN devices. The credentials for Panorama must be set using the Splunk for PaloAlto Network app's setup page. The devicegroup must exist in the Panorama prior to execution of the command Debugging and other output is here: $SPLUNK_HOME/var/log/splunk/python.log
+description = The command takes user-id and IP addresses and inputs the Panorama and individual firewall configurations with those IP addresses. The command expects two fields, addrip and addruser. Use the rename command if your userid and ip fields have different labels. It may take up to a minute for the changes to take effect in the Panorama and PAN devices. The credentials for Panorama must be set using the Splunk for PaloAlto Network app's setup page. The devicegroup must exist in the Panorama prior to execution of the command Debugging and other output is here: $SPLUNK_HOME/var/log/splunk/python.log
example1 = index=main sourcetype=radius | panupdate device="192.168.4.211" devicegroup="homedev"
comment1 = Search for all RADIUS logs and update the Panorama's homedev devicegroup with the user-id and IP's.
example2 = index=main sourcetype=authlog | rename user AS addruser | rename src_ip AS addrip | panupdate device="192.168.4.211" devicegroup="hotel-lobby"
diff --git a/default/transforms.conf b/default/transforms.conf
index c0192b12..ce819214 100755
--- a/default/transforms.conf
+++ b/default/transforms.conf
@@ -8,11 +8,6 @@ DEST_KEY = MetaData:Sourcetype
REGEX = ([^,]+,[^,]+,[^,]+,THREAT,)
FORMAT = sourcetype::pan_threat
-[pan_threat-2050]
-DEST_KEY = MetaData:Sourcetype
-REGEX = (^[a-zA-Z]+\s+[\w\s\d:.]+,[\w]+,THREAT,)
-FORMAT = sourcetype::pan_threat-2050
-
[pan_traffic]
DEST_KEY = MetaData:Sourcetype
REGEX = ([^,]+,[^,]+,[^,]+,TRAFFIC,)
@@ -44,7 +39,7 @@ FIELDS = "future_use1","receive_time","serial_number","type","log_subtype","futu
[extract_config]
DELIMS = ","
-FIELDS = "future_use1","receive_time","serial_number","type","log_subtype","future_use2","future_use3","host","virtual_system","command","admin","client","result","configuration_path","sequence_number","action_flags"
+FIELDS = "future_use1","receive_time","serial_number","type","log_subtype","future_use2","future_use3","client_ip","virtual_system","command","admin","client_type","result","configuration_path","sequence_number","action_flags"
[extract_system]
DELIMS = ","
diff --git a/static/appIcon.png b/static/appIcon.png
new file mode 100644
index 00000000..e6a02ca2
Binary files /dev/null and b/static/appIcon.png differ
diff --git a/static/appIconAlt.png b/static/appIconAlt.png
new file mode 100644
index 00000000..667e68ec
Binary files /dev/null and b/static/appIconAlt.png differ
diff --git a/static/appIconAlt_2x.png b/static/appIconAlt_2x.png
new file mode 100644
index 00000000..680fbb29
Binary files /dev/null and b/static/appIconAlt_2x.png differ
diff --git a/static/appIcon_2x.png b/static/appIcon_2x.png
new file mode 100644
index 00000000..eb94442c
Binary files /dev/null and b/static/appIcon_2x.png differ
diff --git a/static/appLogo.png b/static/appLogo.png
new file mode 100644
index 00000000..51d8fab6
Binary files /dev/null and b/static/appLogo.png differ
diff --git a/static/appLogo_2x.png b/static/appLogo_2x.png
new file mode 100644
index 00000000..14b73f49
Binary files /dev/null and b/static/appLogo_2x.png differ