Palo Alto Networks NGFW

Bug Fixes

• Fixed an issue where session-terminating block actions (reset-both, reset-server, etc.) in threat logs were classified as DETECT
• Fixed an issue where some block actions in threat logs, such as drop and sinkhole, were stored as raw values without normalization

Changes

• Changed threat log action normalization: DETECT for detected and allowed, BLOCK for blocked, UNKNOWN for others
• Undefined traffic log action values are now normalized to UNKNOWN
• API logger logs now also provide the raw value before normalization in the action_original field

Log Schema Changes

• Added the xff_ip (XFF address) field to the Palo Alto Networks NGFW 위협 and Palo Alto Networks NGFW 트래픽 log schemas, and listed the existing action_original field
• Added the xff (X-Forwarded-For header) field to the Palo Alto Networks NGFW 위협 log schema

Upgrade Notes

• Threat log action values differ from version 1.8.2610.0 and earlier, so queries and detection rules that use these values must be updated
  • Use DETECT and BLOCK instead of PERMIT, DENY, and DROP
  • Query reset-* actions as BLOCK instead of DETECT

Security Improvement

• Due to the API key being stored in plain text in API logger settings, the API logger now uses a connect profile for connection information
  • Removed Hostname, API Key, and HTTP Proxy from the API logger settings and added Connect Profile
  • After updating to this version, existing API loggers stop collecting; edit each logger to specify a connect profile

Feature Modifications

• Dynamic Address Group Updates: * Renamed query commands.
  • paloalto-ngfw-register-ip -> paloalto-ngfw-add-dynamic-address
  • paloalto-ngfw-unregister-ip -> paloalto-ngfw-remove-dynamic-address
  • paloalto-ngfw-registered-ips -> paloalto-ngfw-dynamic-addresses
  • paloalto-ngfw-register-ip-batch -> paloalto-ngfw-add-dynamic-address-batch
  • paloalto-ngfw-unregister-ip-batch -> paloalto-ngfw-remove-dynamic-address-batch
• Added validation for single tag registration.
• External SSH Connection Detection: * Updated the rule query.

Improvements

• Added DAG IP management commands and block integration
  • paloalto-ngfw-register-ip: Register a single IP tag (Block)
  • paloalto-ngfw-unregister-ip: Unregister a single IP tag
  • paloalto-ngfw-registered-ips: View the list of registered IPs
  • paloalto-ngfw-register-ip-batch: Bulk register IPs based on input records
  • paloalto-ngfw-unregister-ip-batch: Bulk unregister IPs based on input records
• Added HTTP proxy configuration options

SNMP MIB Built-in

• Based on PAN OS version 12.1
  • PAN-COMMON-MIB
  • PAN-ENTITY-EXT-MIB
  • PAN-GLOBAL-REG-MIB
  • PAN-GLOBAL-TC-MIB
  • PAN-LC-MIB
  • PAN-PRODUCT-MIB
  • PAN-TRAPS

Support for executing app query commands through forwarders.

• Logpresso Sonar 4.0.2502.0 and later is required

Changelog

• Fixed parse failure when nat_src_ip, nat_dst_ip field values are empty
• Added action_original field to store original action field value

Changelog

• AUDIT log type added
• Log schema added for Alarms, Configuration, System, Traffic log types

Added ATT&CK TTP rules

Changelog

• Resolve parser errors when the last field contains a comma (,) and the field is escaped with a double quarter (")

Changelog

• Fix errors when misc data does not exist

Fixed to recognize consecutive quotes as escapes.

Patch parsing errors due to empty quoted strings

Fixed parsing error when URLs in THREAT logs contain commas.

Added Sonar app manifest.