[^,]+),`
+ Route-Extraction=type
+ Route=AUTHENTICATION:pan_auth
+ Route=CONFIG:pan_config
+ Route=CORRELATION:pan_correlation
+ Route=DECRYPTION:pan_decryption
+ Route=GLOBALPROTECT:pan_globalprotect
+ Route=GTP:pan_gtp
+ Route=HIP-MATCH:pan_hipmatch
+ Route=HIPMATCH:pan_hipmatch
+ Route=IPTAG:pan_iptag
+ Route=SCTP:pan_sctp
+ Route=SYSTEM:pan_system
+ Route=THREAT:pan_threat
+ Route=TRAFFIC:pan_traffic
+ Route=USERID:pan_userid
+ ```
+
+- Ensure that the server running the HTTP Ingester allows incoming connections on port 8080, and that any firewalls between the Palo Alto device and the ingester system allow port 8080 traffic.
+- Once the ingester is configured, set up log forwarding on the Palo Alto device as described in [the Palo Alto documentation](https://docs.paloaltonetworks.com/ngfw/administration/monitoring/forward-logs-to-an-https-destination). You will need to set up the following:
+ - An HTTP Server Profile. The "Address" field corresponds to the HTTP Ingester's address, "Port" should be 8080, "HTTP Method" is POST, and you should populate the Username and Password fields to match your configuration above. In the "Payload Format" tab, ensure each log type sends the raw CSV field order expected by the preprocessors above, as shown in the image below:
+>
+ > 
+>
+- A Log Forwarding Profile which sends all desired log types to the HTTP Server Profile created above. Note that it is possible to use one Log Forwarding Profile to send logs to both syslog and HTTP ingesters at the same time, if desired, as seen below:
+>
+> 
+>
+- Once the changes have been committed, logs should begin flowing into Gravwell. You can check by running the following query:
+
+```gravwell
+ tag=$PAN_ALL limit 10
```
-If any results appear, logs are coming in properly.
+- If any results appear, logs are coming in properly.
+- Warning: We strongly recommend changing the "Username" and "Password" fields before deploying. We also recommend setting up a TLS frontend for better security. Palo Alto also notes that HTTP/S forwarding is intended for lower-volume deployments and can lose logs at higher forwarding rates, so syslog via Simple Relay remains the recommended option for primary ingestion.
-Warning: We strongly recommend changing the "Username" and "Password" fields before deploying! We also recommend setting up a TLS frontend (e.g. nginx) for better security, but this is beyond the scope of this playbook.
+#### 0.5 [Data Tags](#0-5-data-tags)
-## Data Tags
+- Palo Alto logs are sorted into tags on Gravwell based on the log family or format, using the mappings defined in the preprocessor configuration above. The tags are:
+ - pan_traffic: [Traffic logs](https://docs.paloaltonetworks.com/ngfw/administration/monitoring/use-syslog-for-monitoring/syslog-field-descriptions/traffic-log-fields)
+ - pan_threat: [Threat logs](https://docs.paloaltonetworks.com/ngfw/administration/monitoring/use-syslog-for-monitoring/syslog-field-descriptions/threat-log-fields), including [URL Filtering](https://docs.paloaltonetworks.com/ngfw/administration/monitoring/use-syslog-for-monitoring/syslog-field-descriptions/url-filtering-log-fields), [Data Filtering](https://docs.paloaltonetworks.com/ngfw/administration/monitoring/use-syslog-for-monitoring/syslog-field-descriptions/data-filtering-log-fields), and WildFire Submission / other THREAT-family subtypes
+ - pan_hipmatch: [HIP Match logs](https://docs.paloaltonetworks.com/ngfw/administration/monitoring/use-syslog-for-monitoring/syslog-field-descriptions/hip-match-log-fields)
+ - pan_globalprotect: [GlobalProtect logs](https://docs.paloaltonetworks.com/ngfw/administration/monitoring/use-syslog-for-monitoring/syslog-field-descriptions/globalprotect-log-fields)
+ - pan_iptag: [IP-Tag logs](https://docs.paloaltonetworks.com/ngfw/administration/monitoring/use-syslog-for-monitoring/syslog-field-descriptions/ip-tag-log-fields)
+ - pan_userid: [User-ID logs](https://docs.paloaltonetworks.com/ngfw/administration/monitoring/use-syslog-for-monitoring/syslog-field-descriptions/user-id-log-fields)
+ - pan_decryption: [Decryption logs](https://docs.paloaltonetworks.com/ngfw/administration/monitoring/use-syslog-for-monitoring/syslog-field-descriptions/decryption-log-fields)
+ - pan_tunnel: [Tunnel Inspection logs](https://docs.paloaltonetworks.com/ngfw/administration/monitoring/use-syslog-for-monitoring/syslog-field-descriptions/tunnel-inspection-log-fields)
+ - pan_sctp: [SCTP logs](https://docs.paloaltonetworks.com/ngfw/administration/monitoring/use-syslog-for-monitoring/syslog-field-descriptions/sctp-log-fields)
+ - pan_auth: [Authentication logs](https://docs.paloaltonetworks.com/ngfw/administration/monitoring/use-syslog-for-monitoring/syslog-field-descriptions/authentication-log-fields)
+ - pan_config: [Config logs](https://docs.paloaltonetworks.com/ngfw/administration/monitoring/use-syslog-for-monitoring/syslog-field-descriptions/config-log-fields)
+ - pan_system: [System logs](https://docs.paloaltonetworks.com/ngfw/administration/monitoring/use-syslog-for-monitoring/syslog-field-descriptions/system-log-fields)
+ - pan_correlation: [Correlated Events logs](https://docs.paloaltonetworks.com/ngfw/administration/monitoring/use-syslog-for-monitoring/syslog-field-descriptions/correlated-events-log-fields)
+ - pan_gtp: [GTP logs](https://docs.paloaltonetworks.com/ngfw/administration/monitoring/use-syslog-for-monitoring/syslog-field-descriptions/gtp-log-fields)
+ - pan_audit: [Audit logs](https://docs.paloaltonetworks.com/ngfw/administration/monitoring/use-syslog-for-monitoring/syslog-field-descriptions/audit-log-fields)
+ - pan_events: Catch-all for unmatched, unknown, or newly introduced PAN log formats that arrive on the dedicated Palo Alto listener or HTTP endpoint
-Palo Alto logs are sorted into tags on Gravwell based on the log type, using mappings defined in the preprocessor configuration above. The tags are:
+- The links in the list above will take you to the official Palo Alto documentation for each log type. These are the best places to find out what any given field *means*. For instance, the traffic log page includes the following definitions:
+ - Source Address (src): Original session source IP address.
+ - Destination Address (dst): Original session destination IP address.
+- The names in parentheses are the names of the fields used in Gravwell; thus to extract the source and destination IP addresses of a session, one would type ax src dst. See the next section for more information on extracting data fields.
+- If your kit defines a PAN_ALL macro, update it to include pan_audit, pan_tunnel, and pan_events in addition to the existing PAN tags.
-* pan_auth: [Authentication logs](https://docs.paloaltonetworks.com/pan-os/10-2/pan-os-admin/monitoring/use-syslog-for-monitoring/syslog-field-descriptions/authentication-log-fields.html)
-* pan_config: [Device configuration logs](https://docs.paloaltonetworks.com/pan-os/10-2/pan-os-admin/monitoring/use-syslog-for-monitoring/syslog-field-descriptions/config-log-fields.html)
-* pan_correlation: [Correlated event logs](https://docs.paloaltonetworks.com/content/techdocs/en_US/pan-os/10-2/pan-os-admin/monitoring/use-syslog-for-monitoring/syslog-field-descriptions/correlated-events-log-fields.html)
-* pan_decryption: [Decryption logs](https://docs.paloaltonetworks.com/pan-os/10-2/pan-os-admin/monitoring/use-syslog-for-monitoring/syslog-field-descriptions/decryption-log-fields.html)
-* pan_globalprotect: [GlobalProtect VPN logs](https://docs.paloaltonetworks.com/content/techdocs/en_US/pan-os/10-2/pan-os-admin/monitoring/use-syslog-for-monitoring/syslog-field-descriptions/globalprotect-log-fields.html)
-* pan_gtp: [GTP logs](https://docs.paloaltonetworks.com/content/techdocs/en_US/pan-os/10-2/pan-os-admin/monitoring/use-syslog-for-monitoring/syslog-field-descriptions/gtp-log-fields.html)
-* pan_hipmatch: [HIP match logs](https://docs.paloaltonetworks.com/content/techdocs/en_US/pan-os/10-2/pan-os-admin/monitoring/use-syslog-for-monitoring/syslog-field-descriptions/hip-match-log-fields.html)
-* pan_iptag: [IP-Tag logs](https://docs.paloaltonetworks.com/content/techdocs/en_US/pan-os/10-2/pan-os-admin/monitoring/use-syslog-for-monitoring/syslog-field-descriptions/ip-tag-log-fields.html)
-* pan_sctp: [SCTP logs](https://docs.paloaltonetworks.com/content/techdocs/en_US/pan-os/10-2/pan-os-admin/monitoring/use-syslog-for-monitoring/syslog-field-descriptions/sctp-log-fields.html)
-* pan_system: [System logs](https://docs.paloaltonetworks.com/content/techdocs/en_US/pan-os/10-2/pan-os-admin/monitoring/use-syslog-for-monitoring/syslog-field-descriptions/system-log-fields.html)
-* pan_threat: [Threat logs](https://docs.paloaltonetworks.com/content/techdocs/en_US/pan-os/10-2/pan-os-admin/monitoring/use-syslog-for-monitoring/syslog-field-descriptions/threat-log-fields.html)
-* pan_traffic: [Traffic logs](https://docs.paloaltonetworks.com/content/techdocs/en_US/pan-os/10-2/pan-os-admin/monitoring/use-syslog-for-monitoring/syslog-field-descriptions/traffic-log-fields.html)
-* pan_userid: [User-ID logs](https://docs.paloaltonetworks.com/content/techdocs/en_US/pan-os/10-2/pan-os-admin/monitoring/use-syslog-for-monitoring/syslog-field-descriptions/user-id-log-fields.html)
+#### 0.6 [Working with the Data](#0-6-working-with-the-data)
-The links in the list above will take you to the official Palo Alto documentation for each log type. These are the best places to find out what any given field *means*. For instance, the traffic log page includes the following definitions:
+- One key component of this kit is the pre-configured *auto extractors* which apply structure to the CSV-formatted logs in the system. Each log type contains *many* fields, so we recommend using a particular trick when exploring the extracted fields of a given data type. First, run a query on the tag using the ax module with no arguments, sent to the text renderer:
-
-
-Source Address (src): Original session source IP address.
-Destination Address (dst): Original session destination IP address.
-
-
+ ```gravwell
+ tag=$PAN_TRAFFIC ax
+ | text
+ ```
-The names in parentheses are the names of the fields used in Gravwell; thus to extract the source and destination IP addresses of a session, one would type ax src dst. See the next session for more information on extracting data fields.
+- Then, in the results, click the "Show details" floating button for any one of the results. This will expand the entry to show the extracted enumerated values. This lets you rapidly scroll through the raw results until you find one that looks interesting, then expand it to see which enumerated values are available:
-## Working with the Data
+> 
-One key component of this kit is the pre-configured *auto extractors* which apply structure to the CSV-formatted logs in the system. Each log type contains *many* fields; for instance, the traffic logs consist of 114 individual fields! A table with 114 columns is difficult to deal with on even the largest monitor, so we recommend using a particular trick when exploring the extracted fields of a given data type. First, run a query on the tag using the ax module with no arguments, sent to the text renderer:
+- In the image above, a single enumerated value pair is highlighted; from this, we might modify the query to filter down to only traffic destined for Switzerland for further examination:
-```
-tag=$PAN_TRAFFIC ax | text
-```
-
-Then, in the results, click the "Show details" floating button for any one of the results. This will expand the entry to show the extracted enumerated values. This lets you rapidly scroll through the raw results until you find one that looks interesting, then expand it to see which enumerated values are available:
+ ```gravwell
+ tag=$PAN_TRAFFIC ax dstloc=="Switzerland"
+ | text
+ ```
-
+- Audit and Tunnel Inspection logs use their own tags because their CSV layouts differ from standard System and Traffic logs. Explore those tags directly when validating ingestion:
-In the image above, a single enumerated value pair is highlighted; from this, we might modify the query to filter down to only traffic destined for Switzerland for further examination:
+ ```gravwell
+ tag=pan_config limit 10
+ ```
-```
-tag=$PAN_TRAFFIC ax dstloc=="Switzerland" | text
-```
+***
\ No newline at end of file
diff --git a/paloalto/playbook/e4aac01c-abda-4b6e-a95c-d42887ad29ed.meta b/paloalto/playbook/e4aac01c-abda-4b6e-a95c-d42887ad29ed.meta
index fc808495..9a6ab4ec 100644
--- a/paloalto/playbook/e4aac01c-abda-4b6e-a95c-d42887ad29ed.meta
+++ b/paloalto/playbook/e4aac01c-abda-4b6e-a95c-d42887ad29ed.meta
@@ -1,20 +1,24 @@
{
- "UUID": "0768d1ac-85b8-4ab5-ba31-db55ca7e541f",
+ "UUID": "7ce212f3-cae7-46a6-9188-e662082edebb",
"GUID": "e4aac01c-abda-4b6e-a95c-d42887ad29ed",
- "UID": 2,
- "GIDs": null,
- "Global": false,
- "Name": "Palo Alto Kit",
- "Desc": "High-level overview of the Palo Alto kit from Gravwell",
+ "UID": 1,
+ "GIDs": [],
+ "Global": true,
+ "WriteAccess": {
+ "Global": false,
+ "GIDs": []
+ },
+ "Name": "Palo Alto Kit - Integration Guide",
+ "Desc": "An Integration Guide for onboarding your Palo Alto logs into Gravwell.",
"Labels": [
"palo"
],
- "LastUpdated": "2022-03-31T16:28:58.693423457Z",
+ "LastUpdated": "2026-03-18T18:41:34.414889805Z",
"Author": {
- "Name": "The Gravwell Authors",
+ "Name": "Kyle Mallett",
"Email": "info@gravwell.io",
"Company": "Gravwell",
- "URL": "https://gravwell.io"
+ "URL": "gravwell.io"
},
- "Synced": true
+ "Synced": false
}
\ No newline at end of file
diff --git a/paloalto/playbook/e4aac01c-abda-4b6e-a95c-d42887ad29ed.playbook_metadata b/paloalto/playbook/e4aac01c-abda-4b6e-a95c-d42887ad29ed.playbook_metadata
index 3bf8b10a..779c3cc7 100644
--- a/paloalto/playbook/e4aac01c-abda-4b6e-a95c-d42887ad29ed.playbook_metadata
+++ b/paloalto/playbook/e4aac01c-abda-4b6e-a95c-d42887ad29ed.playbook_metadata
@@ -1 +1 @@
-{"dashboards":[],"attachments":[{"context":"cover","type":"image","fileGUID":"7d17282a-b57b-41d7-aa76-ebae78021abc"},{"context":"banner","type":"image","fileGUID":"3392b289-f7e5-4f0a-802e-075cd62b45a5"}]}
\ No newline at end of file
+{"dashboards":[],"attachments":[{"context":"cover","type":"image","fileGUID":"c69dee69-d682-4d6c-951b-a66924098495"},{"context":"banner","type":"image","fileGUID":"ac8d907f-c540-4237-8327-1ad55c173b6e"}]}
\ No newline at end of file
diff --git a/paloalto/resource/excluded_url_categories.meta b/paloalto/resource/excluded_url_categories.meta
index e0409f69..eb5dcb09 100644
--- a/paloalto/resource/excluded_url_categories.meta
+++ b/paloalto/resource/excluded_url_categories.meta
@@ -1,7 +1,10 @@
{
- "VersionNumber": 2,
+ "VersionNumber": 1,
"ResourceName": "excluded_url_categories",
"Description": "Palo Alto URL categories to be excluded.",
+ "Labels": [
+ "palo"
+ ],
"Size": 125,
"Hash": "OIRl5vXUFzq7WsFx5iFs7A==",
"Data": ""
diff --git a/paloalto/searchlibrary/0102c2d0-b817-413f-affc-92d00b4fd452.meta b/paloalto/searchlibrary/0102c2d0-b817-413f-affc-92d00b4fd452.meta
new file mode 100644
index 00000000..c05ed99a
--- /dev/null
+++ b/paloalto/searchlibrary/0102c2d0-b817-413f-affc-92d00b4fd452.meta
@@ -0,0 +1,11 @@
+{
+ "Name": "Search - Palo Alto - NGFW - Traffic - Application - Top Applications [chart]",
+ "Description": "Displays a chart of the most frequently observed applications in traffic logs.\n\nDependencies\n- Dashboard: Palo Alto User Behavior Overview",
+ "GUID": "0102c2d0-b817-413f-affc-92d00b4fd452",
+ "Labels": [
+ "palo"
+ ],
+ "Metadata": {
+ "timeframe": null
+ }
+}
\ No newline at end of file
diff --git a/paloalto/searchlibrary/0102c2d0-b817-413f-affc-92d00b4fd452.query b/paloalto/searchlibrary/0102c2d0-b817-413f-affc-92d00b4fd452.query
new file mode 100644
index 00000000..c26e68d8
--- /dev/null
+++ b/paloalto/searchlibrary/0102c2d0-b817-413f-affc-92d00b4fd452.query
@@ -0,0 +1,5 @@
+// Search - Palo Alto - NGFW - Traffic - Application - Top Applications [chart]
+tag=$PAN_TRAFFIC ax app!="incomplete"
+| alias app Application
+| stats count by Application
+| chart count by Application limit 16
\ No newline at end of file
diff --git a/paloalto/searchlibrary/029d59e0-bf7b-4fb0-a783-df0a644ca5b9.meta b/paloalto/searchlibrary/029d59e0-bf7b-4fb0-a783-df0a644ca5b9.meta
new file mode 100644
index 00000000..3a31a59a
--- /dev/null
+++ b/paloalto/searchlibrary/029d59e0-bf7b-4fb0-a783-df0a644ca5b9.meta
@@ -0,0 +1,11 @@
+{
+ "Name": "Search - Palo Alto - NGFW - GlobalProtect - Authentication - Failed Logins [table]",
+ "Description": "Displays a table of failed GlobalProtect login attempts by user, region, and source IP.\n\nDependencies\n- Dashboard: Palo Alto GlobalProtect Overview",
+ "GUID": "029d59e0-bf7b-4fb0-a783-df0a644ca5b9",
+ "Labels": [
+ "palo"
+ ],
+ "Metadata": {
+ "timeframe": null
+ }
+}
\ No newline at end of file
diff --git a/paloalto/searchlibrary/029d59e0-bf7b-4fb0-a783-df0a644ca5b9.query b/paloalto/searchlibrary/029d59e0-bf7b-4fb0-a783-df0a644ca5b9.query
new file mode 100644
index 00000000..6be27e73
--- /dev/null
+++ b/paloalto/searchlibrary/029d59e0-bf7b-4fb0-a783-df0a644ca5b9.query
@@ -0,0 +1,5 @@
+// Search - Palo Alto - NGFW - GlobalProtect - Authentication - Failed Logins [table]
+tag=$PAN_GLOBALPROTECT ax stage=="login" status=="failure" srcuser srcregion public_ip public_ipv6
+| alias srcuser User srcregion Region public_ip "IPv4" public_ipv6 IPv6
+| stats count as failures by User Region IPv4 IPv6
+| table User Region IPv4 IPv6 failures
\ No newline at end of file
diff --git a/paloalto/searchlibrary/03e0c1e3-b239-433a-855d-cca56e0867f9.meta b/paloalto/searchlibrary/03e0c1e3-b239-433a-855d-cca56e0867f9.meta
new file mode 100644
index 00000000..6cd98e89
--- /dev/null
+++ b/paloalto/searchlibrary/03e0c1e3-b239-433a-855d-cca56e0867f9.meta
@@ -0,0 +1,11 @@
+{
+ "Name": "Search - Palo Alto - NGFW - Traffic - Events - Count by Subtype [numbercard]",
+ "Description": "Displays a numbercard of threat event counts by subtype.\n\nDependencies\n- Dashboard: Palo Alto Threat Overview",
+ "GUID": "03e0c1e3-b239-433a-855d-cca56e0867f9",
+ "Labels": [
+ "palo"
+ ],
+ "Metadata": {
+ "timeframe": null
+ }
+}
\ No newline at end of file
diff --git a/paloalto/searchlibrary/03e0c1e3-b239-433a-855d-cca56e0867f9.query b/paloalto/searchlibrary/03e0c1e3-b239-433a-855d-cca56e0867f9.query
new file mode 100644
index 00000000..9f186f3d
--- /dev/null
+++ b/paloalto/searchlibrary/03e0c1e3-b239-433a-855d-cca56e0867f9.query
@@ -0,0 +1,4 @@
+// Search - Palo Alto - NGFW - Traffic - Events - Count by Subtype [numbercard]
+tag=$PAN_TRAFFIC ax subtype
+| stats count by subtype
+| numbercard (count "")
\ No newline at end of file
diff --git a/paloalto/searchlibrary/165321ca-629d-4560-afbb-2ac6cc3ecc56.meta b/paloalto/searchlibrary/165321ca-629d-4560-afbb-2ac6cc3ecc56.meta
new file mode 100644
index 00000000..047c0c61
--- /dev/null
+++ b/paloalto/searchlibrary/165321ca-629d-4560-afbb-2ac6cc3ecc56.meta
@@ -0,0 +1,11 @@
+{
+ "Name": "Search - Palo Alto - NGFW - Event Types - Count by Tag [chart]",
+ "Description": "Displays a chart of event counts by TAG.\n\nDependencies\n- Dashboard: Palo Alto General Overview",
+ "GUID": "165321ca-629d-4560-afbb-2ac6cc3ecc56",
+ "Labels": [
+ "palo"
+ ],
+ "Metadata": {
+ "timeframe": null
+ }
+}
\ No newline at end of file
diff --git a/paloalto/searchlibrary/165321ca-629d-4560-afbb-2ac6cc3ecc56.query b/paloalto/searchlibrary/165321ca-629d-4560-afbb-2ac6cc3ecc56.query
new file mode 100644
index 00000000..fbbc7729
--- /dev/null
+++ b/paloalto/searchlibrary/165321ca-629d-4560-afbb-2ac6cc3ecc56.query
@@ -0,0 +1,4 @@
+tag=$PAN_ALL
+| stats count by TAG
+| alias count " "
+| chart " " by TAG
\ No newline at end of file
diff --git a/paloalto/searchlibrary/17da5912-7283-4c8a-97a1-fb532c072fe8.meta b/paloalto/searchlibrary/17da5912-7283-4c8a-97a1-fb532c072fe8.meta
new file mode 100644
index 00000000..5823c98f
--- /dev/null
+++ b/paloalto/searchlibrary/17da5912-7283-4c8a-97a1-fb532c072fe8.meta
@@ -0,0 +1,11 @@
+{
+ "Name": "Search - Palo Alto - NGFW - Config - Events - Count by Results [chart]",
+ "Description": "Displays a chart of configuration event counts by command result.\n\nDependencies\n- Dashboard: Palo Alto Config Overview",
+ "GUID": "17da5912-7283-4c8a-97a1-fb532c072fe8",
+ "Labels": [
+ "palo"
+ ],
+ "Metadata": {
+ "timeframe": null
+ }
+}
\ No newline at end of file
diff --git a/paloalto/searchlibrary/17da5912-7283-4c8a-97a1-fb532c072fe8.query b/paloalto/searchlibrary/17da5912-7283-4c8a-97a1-fb532c072fe8.query
new file mode 100644
index 00000000..11e469a2
--- /dev/null
+++ b/paloalto/searchlibrary/17da5912-7283-4c8a-97a1-fb532c072fe8.query
@@ -0,0 +1,4 @@
+// Search - Palo Alto - NGFW - Config - Events - Count by Results [chart]
+tag=$PAN_CONFIG ax result
+| stats count by result
+| chart count by result
\ No newline at end of file
diff --git a/paloalto/searchlibrary/1812fddf-4109-4d57-b274-1da9981b426f.meta b/paloalto/searchlibrary/1812fddf-4109-4d57-b274-1da9981b426f.meta
new file mode 100644
index 00000000..87fbe270
--- /dev/null
+++ b/paloalto/searchlibrary/1812fddf-4109-4d57-b274-1da9981b426f.meta
@@ -0,0 +1,11 @@
+{
+ "Name": "Search - Palo Alto - NGFW - Threat - Events - Count by Scan Source Location [chart]",
+ "Description": "Displays a chart of scan event counts by source location.\n\nDependencies\n- Dashboard: Palo Alto Threat Overview",
+ "GUID": "1812fddf-4109-4d57-b274-1da9981b426f",
+ "Labels": [
+ "palo"
+ ],
+ "Metadata": {
+ "timeframe": null
+ }
+}
\ No newline at end of file
diff --git a/paloalto/searchlibrary/1812fddf-4109-4d57-b274-1da9981b426f.query b/paloalto/searchlibrary/1812fddf-4109-4d57-b274-1da9981b426f.query
new file mode 100644
index 00000000..33f0dfb7
--- /dev/null
+++ b/paloalto/searchlibrary/1812fddf-4109-4d57-b274-1da9981b426f.query
@@ -0,0 +1,4 @@
+// Search - Palo Alto - NGFW - Threat - Events - Count by Scan Source Location [chart]
+tag=$PAN_THREAT ax subtype=="scan" srcloc
+| stats count by srcloc
+| chart count by srcloc
\ No newline at end of file
diff --git a/paloalto/searchlibrary/1ef98531-447b-4dc0-8df2-3ad2e4815902.meta b/paloalto/searchlibrary/1ef98531-447b-4dc0-8df2-3ad2e4815902.meta
new file mode 100644
index 00000000..355b5425
--- /dev/null
+++ b/paloalto/searchlibrary/1ef98531-447b-4dc0-8df2-3ad2e4815902.meta
@@ -0,0 +1,11 @@
+{
+ "Name": "Search - Palo Alto - NGFW - Config - Events - Count by Client [chart]",
+ "Description": "Displays a chart of configuration event counts by client used to perform the action.\n\nDependencies\n- Dashboard: Palo Alto Config Overview",
+ "GUID": "1ef98531-447b-4dc0-8df2-3ad2e4815902",
+ "Labels": [
+ "palo"
+ ],
+ "Metadata": {
+ "timeframe": null
+ }
+}
\ No newline at end of file
diff --git a/paloalto/searchlibrary/1ef98531-447b-4dc0-8df2-3ad2e4815902.query b/paloalto/searchlibrary/1ef98531-447b-4dc0-8df2-3ad2e4815902.query
new file mode 100644
index 00000000..c5758aa5
--- /dev/null
+++ b/paloalto/searchlibrary/1ef98531-447b-4dc0-8df2-3ad2e4815902.query
@@ -0,0 +1,4 @@
+// Search - Palo Alto - NGFW - Config - Events - Count by Client [chart]
+tag=$PAN_CONFIG ax client
+| stats count by client
+| chart count by client
\ No newline at end of file
diff --git a/paloalto/searchlibrary/2332615f-d68f-4635-98e2-f931ae86713c.meta b/paloalto/searchlibrary/2332615f-d68f-4635-98e2-f931ae86713c.meta
new file mode 100644
index 00000000..6f482c63
--- /dev/null
+++ b/paloalto/searchlibrary/2332615f-d68f-4635-98e2-f931ae86713c.meta
@@ -0,0 +1,11 @@
+{
+ "Name": "Search - Palo Alto - NGFW - Traffic - SaaS - SaaS Event Count [numbercard]",
+ "Description": "Displays a numbercard of SaaS event counts by type. \n\nDependencies\n- Dashboard: Palo Alto User Behavior Overview",
+ "GUID": "2332615f-d68f-4635-98e2-f931ae86713c",
+ "Labels": [
+ "palo"
+ ],
+ "Metadata": {
+ "timeframe": null
+ }
+}
\ No newline at end of file
diff --git a/paloalto/searchlibrary/2332615f-d68f-4635-98e2-f931ae86713c.query b/paloalto/searchlibrary/2332615f-d68f-4635-98e2-f931ae86713c.query
new file mode 100644
index 00000000..0fe2d52a
--- /dev/null
+++ b/paloalto/searchlibrary/2332615f-d68f-4635-98e2-f931ae86713c.query
@@ -0,0 +1,4 @@
+// Search - Palo Alto - NGFW - Traffic - SaaS - SaaS Event Count [numbercard]
+tag=$PAN_TRAFFIC ax is_saas_of_app=="yes"
+| stats count
+| numbercard (count "SaaS Events")
\ No newline at end of file
diff --git a/paloalto/searchlibrary/2a0213fe-5013-4649-a859-4e1ed8299c99.meta b/paloalto/searchlibrary/2a0213fe-5013-4649-a859-4e1ed8299c99.meta
new file mode 100644
index 00000000..56d33a30
--- /dev/null
+++ b/paloalto/searchlibrary/2a0213fe-5013-4649-a859-4e1ed8299c99.meta
@@ -0,0 +1,11 @@
+{
+ "Name": "Search - Palo Alto - NGFW - Traffic - SaaS - Count by Sanctioned Category [chart]",
+ "Description": "Displays a chart of the most frequently observed sanctioned SaaS application categories.\n\nDependencies\n- Dashboard: Palo Alto SaaS Overview",
+ "GUID": "2a0213fe-5013-4649-a859-4e1ed8299c99",
+ "Labels": [
+ "palo"
+ ],
+ "Metadata": {
+ "timeframe": null
+ }
+}
\ No newline at end of file
diff --git a/paloalto/searchlibrary/2a0213fe-5013-4649-a859-4e1ed8299c99.query b/paloalto/searchlibrary/2a0213fe-5013-4649-a859-4e1ed8299c99.query
new file mode 100644
index 00000000..f6118bab
--- /dev/null
+++ b/paloalto/searchlibrary/2a0213fe-5013-4649-a859-4e1ed8299c99.query
@@ -0,0 +1,4 @@
+// Search - Palo Alto - NGFW - Traffic - SaaS - Count by Sanctioned Category [chart]
+tag=$PAN_TRAFFIC ax sanctioned_state_of_app=="yes" is_saas_of_app=="yes" subcategory_of_app
+| stats count by subcategory_of_app
+| chart count by subcategory_of_app limit 6
\ No newline at end of file
diff --git a/paloalto/searchlibrary/2d5b39c9-8589-442f-b1dd-715ee4c6c677.meta b/paloalto/searchlibrary/2d5b39c9-8589-442f-b1dd-715ee4c6c677.meta
new file mode 100644
index 00000000..f0e4fa2d
--- /dev/null
+++ b/paloalto/searchlibrary/2d5b39c9-8589-442f-b1dd-715ee4c6c677.meta
@@ -0,0 +1,11 @@
+{
+ "Name": "Search - Palo Alto - NGFW - Threat - Events - Scans Detected [table]",
+ "Description": "Displays a table of detected scan events grouped by source and threat ID.\n\nDependencies\n- Dashboard: Palo Alto Threat Overview",
+ "GUID": "2d5b39c9-8589-442f-b1dd-715ee4c6c677",
+ "Labels": [
+ "palo"
+ ],
+ "Metadata": {
+ "timeframe": null
+ }
+}
\ No newline at end of file
diff --git a/paloalto/searchlibrary/2d5b39c9-8589-442f-b1dd-715ee4c6c677.query b/paloalto/searchlibrary/2d5b39c9-8589-442f-b1dd-715ee4c6c677.query
new file mode 100644
index 00000000..753536a3
--- /dev/null
+++ b/paloalto/searchlibrary/2d5b39c9-8589-442f-b1dd-715ee4c6c677.query
@@ -0,0 +1,5 @@
+// Search - Palo Alto - NGFW - Threat - Events - Scans Detected [table]
+tag=$PAN_THREAT ax subtype=="scan" src threatid
+| stats count by src threatid
+| alias src Source threatid "Threat ID"
+| table Source "Threat ID" count
\ No newline at end of file
diff --git a/paloalto/searchlibrary/2e2a52c3-01c9-411e-9254-e205ac7b13fa.meta b/paloalto/searchlibrary/2e2a52c3-01c9-411e-9254-e205ac7b13fa.meta
new file mode 100644
index 00000000..26069821
--- /dev/null
+++ b/paloalto/searchlibrary/2e2a52c3-01c9-411e-9254-e205ac7b13fa.meta
@@ -0,0 +1,11 @@
+{
+ "Name": "Search - Palo Alto - NGFW - Threat - Events - Count by Subtype [numbercard]",
+ "Description": "Displays a numbercard of threat event counts by subtype.\n\nDependencies\n- Dashboard: Palo Alto Threat Overview",
+ "GUID": "2e2a52c3-01c9-411e-9254-e205ac7b13fa",
+ "Labels": [
+ "palo"
+ ],
+ "Metadata": {
+ "timeframe": null
+ }
+}
\ No newline at end of file
diff --git a/paloalto/searchlibrary/2e2a52c3-01c9-411e-9254-e205ac7b13fa.query b/paloalto/searchlibrary/2e2a52c3-01c9-411e-9254-e205ac7b13fa.query
new file mode 100644
index 00000000..5a8e726a
--- /dev/null
+++ b/paloalto/searchlibrary/2e2a52c3-01c9-411e-9254-e205ac7b13fa.query
@@ -0,0 +1,4 @@
+// Search - Palo Alto - NGFW - Threat - Events - Count by Subtype [numbercard]
+tag=$PAN_THREAT ax subtype
+| stats count by subtype
+| numbercard (count "")
\ No newline at end of file
diff --git a/paloalto/searchlibrary/308a0350-9e34-4e97-91e2-16d27ff0a350.meta b/paloalto/searchlibrary/308a0350-9e34-4e97-91e2-16d27ff0a350.meta
new file mode 100644
index 00000000..3d68a3a4
--- /dev/null
+++ b/paloalto/searchlibrary/308a0350-9e34-4e97-91e2-16d27ff0a350.meta
@@ -0,0 +1,11 @@
+{
+ "Name": "Search - Palo Alto - NGFW - Traffic - SaaS - Unsanctioned Applications [table]",
+ "Description": "Displays a table of unsanctioned SaaS applications with session counts and total traffic volume.\n\nDependencies\n- Dashboard: Palo Alto SaaS Overview",
+ "GUID": "308a0350-9e34-4e97-91e2-16d27ff0a350",
+ "Labels": [
+ "palo"
+ ],
+ "Metadata": {
+ "timeframe": null
+ }
+}
\ No newline at end of file
diff --git a/paloalto/searchlibrary/308a0350-9e34-4e97-91e2-16d27ff0a350.query b/paloalto/searchlibrary/308a0350-9e34-4e97-91e2-16d27ff0a350.query
new file mode 100644
index 00000000..86b6ed0a
--- /dev/null
+++ b/paloalto/searchlibrary/308a0350-9e34-4e97-91e2-16d27ff0a350.query
@@ -0,0 +1,7 @@
+// Search - Palo Alto - NGFW - Traffic - SaaS - Unsanctioned Applications [table]
+tag=$PAN_TRAFFIC ax app category_of_app subcategory_of_app bytes is_saas_of_app=="yes" sanctioned_state_of_app=="no"
+| alias app App category_of_app Category subcategory_of_app Subcategory
+| stats sum(bytes) count as Sessions by App Category Subcategory
+| eval Volume = sum;
+| sort by sum desc
+| table App Category Subcategory Sessions Volume
\ No newline at end of file
diff --git a/paloalto/searchlibrary/3233c046-6e37-4318-8b78-b5a4cb25f12a.meta b/paloalto/searchlibrary/3233c046-6e37-4318-8b78-b5a4cb25f12a.meta
new file mode 100644
index 00000000..e98ea4fe
--- /dev/null
+++ b/paloalto/searchlibrary/3233c046-6e37-4318-8b78-b5a4cb25f12a.meta
@@ -0,0 +1,11 @@
+{
+ "Name": "Search - Palo Alto - NGFW - Traffic - SaaS - Sanctioned Application Percentages [chart]",
+ "Description": "Displays a chart of SaaS traffic counts comparing sanctioned and non-sanctioned applications.\n\nDependencies\n- Dashboard: Palo Alto SaaS Overview",
+ "GUID": "3233c046-6e37-4318-8b78-b5a4cb25f12a",
+ "Labels": [
+ "palo"
+ ],
+ "Metadata": {
+ "timeframe": null
+ }
+}
\ No newline at end of file
diff --git a/paloalto/searchlibrary/3233c046-6e37-4318-8b78-b5a4cb25f12a.query b/paloalto/searchlibrary/3233c046-6e37-4318-8b78-b5a4cb25f12a.query
new file mode 100644
index 00000000..dbdd0268
--- /dev/null
+++ b/paloalto/searchlibrary/3233c046-6e37-4318-8b78-b5a4cb25f12a.query
@@ -0,0 +1,5 @@
+// Search - Palo Alto - NGFW - Traffic - SaaS - Sanctioned Application Percentages [chart]
+tag=$PAN_TRAFFIC ax sanctioned_state_of_app
+| eval if (sanctioned_state_of_app == "yes") { state = "Sanctioned"; } else { state = "Non-sanctioned"; }
+| stats count by state
+| chart count by state
\ No newline at end of file
diff --git a/paloalto/searchlibrary/32e6de72-2601-41be-b6ed-dc4acb4e834e.meta b/paloalto/searchlibrary/32e6de72-2601-41be-b6ed-dc4acb4e834e.meta
new file mode 100644
index 00000000..daf5f096
--- /dev/null
+++ b/paloalto/searchlibrary/32e6de72-2601-41be-b6ed-dc4acb4e834e.meta
@@ -0,0 +1,11 @@
+{
+ "Name": "Search - Palo Alto - NGFW - Config - Events - Count by Command [chart]",
+ "Description": "Displays a chart of configuration event counts by command executed.\n\nDependencies\n- Dashboard: Palo Alto Config Overview",
+ "GUID": "32e6de72-2601-41be-b6ed-dc4acb4e834e",
+ "Labels": [
+ "palo"
+ ],
+ "Metadata": {
+ "timeframe": null
+ }
+}
\ No newline at end of file
diff --git a/paloalto/searchlibrary/32e6de72-2601-41be-b6ed-dc4acb4e834e.query b/paloalto/searchlibrary/32e6de72-2601-41be-b6ed-dc4acb4e834e.query
new file mode 100644
index 00000000..fc8a20a3
--- /dev/null
+++ b/paloalto/searchlibrary/32e6de72-2601-41be-b6ed-dc4acb4e834e.query
@@ -0,0 +1,4 @@
+// Search - Palo Alto - NGFW - Config - Events - Count by Command [chart]
+tag=$PAN_CONFIG ax cmd
+| stats count by cmd
+| chart count by cmd
\ No newline at end of file
diff --git a/paloalto/searchlibrary/38108c90-9965-4eaa-8c00-13baef49fcb5.meta b/paloalto/searchlibrary/38108c90-9965-4eaa-8c00-13baef49fcb5.meta
new file mode 100644
index 00000000..c43b39e3
--- /dev/null
+++ b/paloalto/searchlibrary/38108c90-9965-4eaa-8c00-13baef49fcb5.meta
@@ -0,0 +1,11 @@
+{
+ "Name": "Search - Palo Alto - NGFW - Threat - WildFire - Count by Application [chart]",
+ "Description": "Displays a chart of WildFire submission counts by application.\n\nDependencies\n- Dashboard: Palo Alto Wildfire Overview",
+ "GUID": "38108c90-9965-4eaa-8c00-13baef49fcb5",
+ "Labels": [
+ "palo"
+ ],
+ "Metadata": {
+ "timeframe": null
+ }
+}
\ No newline at end of file
diff --git a/paloalto/searchlibrary/38108c90-9965-4eaa-8c00-13baef49fcb5.query b/paloalto/searchlibrary/38108c90-9965-4eaa-8c00-13baef49fcb5.query
new file mode 100644
index 00000000..1b8fdc27
--- /dev/null
+++ b/paloalto/searchlibrary/38108c90-9965-4eaa-8c00-13baef49fcb5.query
@@ -0,0 +1,4 @@
+// Search - Palo Alto - NGFW - Threat - WildFire - Count by Application [chart]
+tag=$PAN_THREAT ax subtype=="wildfire" app
+| stats count by app
+| chart count by app
\ No newline at end of file
diff --git a/paloalto/searchlibrary/3afdb278-a9cb-4d28-afa9-1e06707ddb46.meta b/paloalto/searchlibrary/3afdb278-a9cb-4d28-afa9-1e06707ddb46.meta
new file mode 100644
index 00000000..d2176a4e
--- /dev/null
+++ b/paloalto/searchlibrary/3afdb278-a9cb-4d28-afa9-1e06707ddb46.meta
@@ -0,0 +1,11 @@
+{
+ "Name": "Search - Palo Alto - NGFW - Threat - URL - Top Web Categories [chart]",
+ "Description": "Displays a numbercard of SaaS event counts by type. \n\nDependencies\n- Dashboard: Palo Alto User Behavior Overview",
+ "GUID": "3afdb278-a9cb-4d28-afa9-1e06707ddb46",
+ "Labels": [
+ "palo"
+ ],
+ "Metadata": {
+ "timeframe": null
+ }
+}
\ No newline at end of file
diff --git a/paloalto/searchlibrary/3afdb278-a9cb-4d28-afa9-1e06707ddb46.query b/paloalto/searchlibrary/3afdb278-a9cb-4d28-afa9-1e06707ddb46.query
new file mode 100644
index 00000000..68174693
--- /dev/null
+++ b/paloalto/searchlibrary/3afdb278-a9cb-4d28-afa9-1e06707ddb46.query
@@ -0,0 +1,7 @@
+// Search - Palo Alto - NGFW - Threat - URL - Top Web Categories [chart]
+tag=$PAN_THREAT ax url_category_list
+| split -clean -d "," url_category_list
+| alias url_category_list url_category
+| lookup -v -s -r excluded_url_categories url_category category reason
+| stats count by url_category
+| chart count by url_category limit 16
\ No newline at end of file
diff --git a/paloalto/searchlibrary/3fd985ab-3814-433a-920c-42586088ca44.meta b/paloalto/searchlibrary/3fd985ab-3814-433a-920c-42586088ca44.meta
new file mode 100644
index 00000000..8bfc1e7d
--- /dev/null
+++ b/paloalto/searchlibrary/3fd985ab-3814-433a-920c-42586088ca44.meta
@@ -0,0 +1,11 @@
+{
+ "Name": "Search - Palo Alto - NGFW - Threat - Events - Threat Source Locations [heatmap]",
+ "Description": "Displays a heatmap of threat event source IP locations.\n\nDependencies\n- Dashboard: Palo Alto Threat Overview",
+ "GUID": "3fd985ab-3814-433a-920c-42586088ca44",
+ "Labels": [
+ "palo"
+ ],
+ "Metadata": {
+ "timeframe": null
+ }
+}
\ No newline at end of file
diff --git a/paloalto/searchlibrary/3fd985ab-3814-433a-920c-42586088ca44.query b/paloalto/searchlibrary/3fd985ab-3814-433a-920c-42586088ca44.query
new file mode 100644
index 00000000..41413115
--- /dev/null
+++ b/paloalto/searchlibrary/3fd985ab-3814-433a-920c-42586088ca44.query
@@ -0,0 +1,4 @@
+// Search - Palo Alto - NGFW - Threat - Events - Threat Source Locations [heatmap]
+tag=$PAN_THREAT ax subtype!=url src
+| geoip src.Location
+| heatmap
\ No newline at end of file
diff --git a/paloalto/searchlibrary/45a0354b-4971-4917-a273-a16dd78b5ee3.meta b/paloalto/searchlibrary/45a0354b-4971-4917-a273-a16dd78b5ee3.meta
new file mode 100644
index 00000000..380aa780
--- /dev/null
+++ b/paloalto/searchlibrary/45a0354b-4971-4917-a273-a16dd78b5ee3.meta
@@ -0,0 +1,11 @@
+{
+ "Name": "Search - Palo Alto - NGFW - GlobalProtect - Session - GlobalProtect Users [table]",
+ "Description": "Displays a table of GlobalProtect users with associated client system and operating system information.\n\nDependencies\n- Dashboard: Palo Alto GlobalProtect Overview",
+ "GUID": "45a0354b-4971-4917-a273-a16dd78b5ee3",
+ "Labels": [
+ "palo"
+ ],
+ "Metadata": {
+ "timeframe": null
+ }
+}
\ No newline at end of file
diff --git a/paloalto/searchlibrary/45a0354b-4971-4917-a273-a16dd78b5ee3.query b/paloalto/searchlibrary/45a0354b-4971-4917-a273-a16dd78b5ee3.query
new file mode 100644
index 00000000..125b5359
--- /dev/null
+++ b/paloalto/searchlibrary/45a0354b-4971-4917-a273-a16dd78b5ee3.query
@@ -0,0 +1,5 @@
+// Search - Palo Alto - NGFW - GlobalProtect - Session - GlobalProtect Users [table]
+tag=$PAN_GLOBALPROTECT ax stage=="connected" srcuser machinename client_os_ver
+| stats count by srcuser machinename client_os_ver
+| alias srcuser User machinename "Client System" client_os_ver "Client OS"
+| table User "Client System" "Client OS" count
\ No newline at end of file
diff --git a/paloalto/searchlibrary/47076a81-7c11-474f-86a1-4d1c3d53a8d8.meta b/paloalto/searchlibrary/47076a81-7c11-474f-86a1-4d1c3d53a8d8.meta
new file mode 100644
index 00000000..f35ca9ce
--- /dev/null
+++ b/paloalto/searchlibrary/47076a81-7c11-474f-86a1-4d1c3d53a8d8.meta
@@ -0,0 +1,11 @@
+{
+ "Name": "Search - Palo Alto - NGFW - Traffic - SaaS - Application Distribution [table]",
+ "Description": "Displays a table of SaaS applications with session counts and total traffic volume by category and subcategory.\n\nDependencies\n- Dashboard: Palo Alto SaaS Overview",
+ "GUID": "47076a81-7c11-474f-86a1-4d1c3d53a8d8",
+ "Labels": [
+ "palo"
+ ],
+ "Metadata": {
+ "timeframe": null
+ }
+}
\ No newline at end of file
diff --git a/paloalto/searchlibrary/47076a81-7c11-474f-86a1-4d1c3d53a8d8.query b/paloalto/searchlibrary/47076a81-7c11-474f-86a1-4d1c3d53a8d8.query
new file mode 100644
index 00000000..96d870e6
--- /dev/null
+++ b/paloalto/searchlibrary/47076a81-7c11-474f-86a1-4d1c3d53a8d8.query
@@ -0,0 +1,7 @@
+// Search - Palo Alto - NGFW - Traffic - SaaS - Application Distribution [table]
+tag=$PAN_TRAFFIC ax app category_of_app subcategory_of_app bytes is_saas_of_app=="yes"
+| alias app App category_of_app Category subcategory_of_app Subcategory
+| stats sum(bytes) count as Sessions by App Category Subcategory
+| eval Volume = sum;
+| sort by sum desc
+| table App Category Subcategory Sessions "Volume"
\ No newline at end of file
diff --git a/paloalto/searchlibrary/4890dfae-9bc6-4428-8f02-c32b98a7ddab.meta b/paloalto/searchlibrary/4890dfae-9bc6-4428-8f02-c32b98a7ddab.meta
new file mode 100644
index 00000000..538e5bb6
--- /dev/null
+++ b/paloalto/searchlibrary/4890dfae-9bc6-4428-8f02-c32b98a7ddab.meta
@@ -0,0 +1,11 @@
+{
+ "Name": "Search - Palo Alto - NGFW - Threat - Events - Scan Source Locations [heatmap]",
+ "Description": "Displays a heatmap of scan event source IP locations.\n\nDependencies\n- Dashboard: Palo Alto Threat Overview",
+ "GUID": "4890dfae-9bc6-4428-8f02-c32b98a7ddab",
+ "Labels": [
+ "palo"
+ ],
+ "Metadata": {
+ "timeframe": null
+ }
+}
\ No newline at end of file
diff --git a/paloalto/searchlibrary/4890dfae-9bc6-4428-8f02-c32b98a7ddab.query b/paloalto/searchlibrary/4890dfae-9bc6-4428-8f02-c32b98a7ddab.query
new file mode 100644
index 00000000..426c2771
--- /dev/null
+++ b/paloalto/searchlibrary/4890dfae-9bc6-4428-8f02-c32b98a7ddab.query
@@ -0,0 +1,4 @@
+// Search - Palo Alto - NGFW - Threat - Events - Scan Source Locations [heatmap]
+tag=$PAN_THREAT ax subtype==scan src
+| geoip src.Location
+| heatmap
\ No newline at end of file
diff --git a/paloalto/searchlibrary/4898082c-5181-43a9-86f9-00b86bead404.meta b/paloalto/searchlibrary/4898082c-5181-43a9-86f9-00b86bead404.meta
new file mode 100644
index 00000000..9e163d44
--- /dev/null
+++ b/paloalto/searchlibrary/4898082c-5181-43a9-86f9-00b86bead404.meta
@@ -0,0 +1,11 @@
+{
+ "Name": "Search - Palo Alto - NGFW - GlobalProtect - Events - Count by Subtype [numbercard]",
+ "Description": "Displays a numbercard of GlobalProtect event counts by subtype.\n\nDependencies\n- Dashboard: Palo Alto Threat Overview",
+ "GUID": "4898082c-5181-43a9-86f9-00b86bead404",
+ "Labels": [
+ "palo"
+ ],
+ "Metadata": {
+ "timeframe": null
+ }
+}
\ No newline at end of file
diff --git a/paloalto/searchlibrary/4898082c-5181-43a9-86f9-00b86bead404.query b/paloalto/searchlibrary/4898082c-5181-43a9-86f9-00b86bead404.query
new file mode 100644
index 00000000..a152b133
--- /dev/null
+++ b/paloalto/searchlibrary/4898082c-5181-43a9-86f9-00b86bead404.query
@@ -0,0 +1,4 @@
+// Search - Palo Alto - NGFW - Threat - GlobalProtect - Count by Subtype [numbercard]
+tag=$PAN_GLOBALPROTECT ax subtype
+| stats count by subtype
+| numbercard (count "")
\ No newline at end of file
diff --git a/paloalto/searchlibrary/52cd3303-4013-47e5-bc75-fa8f999222aa.meta b/paloalto/searchlibrary/52cd3303-4013-47e5-bc75-fa8f999222aa.meta
new file mode 100644
index 00000000..a7dcc0aa
--- /dev/null
+++ b/paloalto/searchlibrary/52cd3303-4013-47e5-bc75-fa8f999222aa.meta
@@ -0,0 +1,11 @@
+{
+ "Name": "Search - Palo Alto - NGFW - Config - Events - Latest Events [table]",
+ "Description": "Displays a chart of configuration event counts by administrator.\n\nDependencies\n- Dashboard: Palo Alto Config Overview",
+ "GUID": "52cd3303-4013-47e5-bc75-fa8f999222aa",
+ "Labels": [
+ "palo"
+ ],
+ "Metadata": {
+ "timeframe": null
+ }
+}
\ No newline at end of file
diff --git a/paloalto/searchlibrary/52cd3303-4013-47e5-bc75-fa8f999222aa.query b/paloalto/searchlibrary/52cd3303-4013-47e5-bc75-fa8f999222aa.query
new file mode 100644
index 00000000..5dd90e4c
--- /dev/null
+++ b/paloalto/searchlibrary/52cd3303-4013-47e5-bc75-fa8f999222aa.query
@@ -0,0 +1,4 @@
+// Search - Palo Alto - NGFW - Config - Events - Latest Events [table]
+tag=$PAN_CONFIG ax admin serial host client cmd result
+| alias admin User serial Serial host Host client Client cmd Command result Result
+| table User Serial Host Client Command Result
\ No newline at end of file
diff --git a/paloalto/searchlibrary/5a11f630-f7f2-4c98-9500-688928974ac3.meta b/paloalto/searchlibrary/5a11f630-f7f2-4c98-9500-688928974ac3.meta
new file mode 100644
index 00000000..3aca3297
--- /dev/null
+++ b/paloalto/searchlibrary/5a11f630-f7f2-4c98-9500-688928974ac3.meta
@@ -0,0 +1,11 @@
+{
+ "Name": "Search - Palo Alto - NGFW - Threat - Events - Most Frequent Threat IDs [table]",
+ "Description": "Displays a table of the most frequently observed threat IDs in threat events.\n\nDependencies\n- Dashboard: Palo Alto Threat Overview",
+ "GUID": "5a11f630-f7f2-4c98-9500-688928974ac3",
+ "Labels": [
+ "palo"
+ ],
+ "Metadata": {
+ "timeframe": null
+ }
+}
\ No newline at end of file
diff --git a/paloalto/searchlibrary/5a11f630-f7f2-4c98-9500-688928974ac3.query b/paloalto/searchlibrary/5a11f630-f7f2-4c98-9500-688928974ac3.query
new file mode 100644
index 00000000..259abeeb
--- /dev/null
+++ b/paloalto/searchlibrary/5a11f630-f7f2-4c98-9500-688928974ac3.query
@@ -0,0 +1,6 @@
+// Search - Palo Alto - NGFW - Threat - Events - Most Frequent Threat IDs [table]
+tag=$PAN_THREAT ax subtype threatid
+| stats count by threatid
+| awk -e threatid "{gsub(/\(9999\)/, 'URL Filtering(9999)'); print}"
+| alias threatid "Threat ID"
+| table "Threat ID" count
\ No newline at end of file
diff --git a/paloalto/searchlibrary/61fde793-b8b0-47ab-8c6b-7a4fa7a90dd4.meta b/paloalto/searchlibrary/61fde793-b8b0-47ab-8c6b-7a4fa7a90dd4.meta
new file mode 100644
index 00000000..da3f453d
--- /dev/null
+++ b/paloalto/searchlibrary/61fde793-b8b0-47ab-8c6b-7a4fa7a90dd4.meta
@@ -0,0 +1,11 @@
+{
+ "Name": "Search - Palo Alto - NGFW - Threat - WildFire - Count by Category [numbercard]",
+ "Description": "Displays a numbercard of WildFire verdict counts by category.\n\nDependencies\n- Dashboard: Palo Alto Wildfire Overview",
+ "GUID": "61fde793-b8b0-47ab-8c6b-7a4fa7a90dd4",
+ "Labels": [
+ "palo"
+ ],
+ "Metadata": {
+ "timeframe": null
+ }
+}
\ No newline at end of file
diff --git a/paloalto/searchlibrary/61fde793-b8b0-47ab-8c6b-7a4fa7a90dd4.query b/paloalto/searchlibrary/61fde793-b8b0-47ab-8c6b-7a4fa7a90dd4.query
new file mode 100644
index 00000000..63893f2c
--- /dev/null
+++ b/paloalto/searchlibrary/61fde793-b8b0-47ab-8c6b-7a4fa7a90dd4.query
@@ -0,0 +1,4 @@
+// Search - Palo Alto - NGFW - Threat - WildFire - Count by Category [numbercard]
+tag=$PAN_THREAT ax subtype=="wildfire" category
+| stats count by category
+| numbercard (count "")
\ No newline at end of file
diff --git a/paloalto/searchlibrary/73263790-9a8a-43e1-b231-be2b784de192.meta b/paloalto/searchlibrary/73263790-9a8a-43e1-b231-be2b784de192.meta
new file mode 100644
index 00000000..519b7f71
--- /dev/null
+++ b/paloalto/searchlibrary/73263790-9a8a-43e1-b231-be2b784de192.meta
@@ -0,0 +1,11 @@
+{
+ "Name": "Search - Palo Alto - NGFW - Config - Events - Count by Command [numbercard]",
+ "Description": "Displays a numbercard of configuration event counts by command executed.\n\nDependencies\n- Dashboard: Palo Alto Config Overview",
+ "GUID": "73263790-9a8a-43e1-b231-be2b784de192",
+ "Labels": [
+ "palo"
+ ],
+ "Metadata": {
+ "timeframe": null
+ }
+}
\ No newline at end of file
diff --git a/paloalto/searchlibrary/73263790-9a8a-43e1-b231-be2b784de192.query b/paloalto/searchlibrary/73263790-9a8a-43e1-b231-be2b784de192.query
new file mode 100644
index 00000000..6e575131
--- /dev/null
+++ b/paloalto/searchlibrary/73263790-9a8a-43e1-b231-be2b784de192.query
@@ -0,0 +1,4 @@
+// Search - Palo Alto - NGFW - Config - Events - Count by Command [numbercard]
+tag=$PAN_CONFIG ax cmd
+| stats count by cmd
+| numbercard (count "")
\ No newline at end of file
diff --git a/paloalto/searchlibrary/741a45c8-9248-4922-97c2-a6b9b525e6d4.meta b/paloalto/searchlibrary/741a45c8-9248-4922-97c2-a6b9b525e6d4.meta
new file mode 100644
index 00000000..f96c4ef4
--- /dev/null
+++ b/paloalto/searchlibrary/741a45c8-9248-4922-97c2-a6b9b525e6d4.meta
@@ -0,0 +1,11 @@
+{
+ "Name": "Search - Palo Alto - NGFW - Traffic - Bytes - Total Traffic Volume [chart]",
+ "Description": "Displays a chart of total traffic volume in megabytes based on summed byte counts from traffic logs.\n\nDependencies\n- Dashboard: Palo Alto User Behavior Overview",
+ "GUID": "741a45c8-9248-4922-97c2-a6b9b525e6d4",
+ "Labels": [
+ "palo"
+ ],
+ "Metadata": {
+ "timeframe": null
+ }
+}
\ No newline at end of file
diff --git a/paloalto/searchlibrary/741a45c8-9248-4922-97c2-a6b9b525e6d4.query b/paloalto/searchlibrary/741a45c8-9248-4922-97c2-a6b9b525e6d4.query
new file mode 100644
index 00000000..20695197
--- /dev/null
+++ b/paloalto/searchlibrary/741a45c8-9248-4922-97c2-a6b9b525e6d4.query
@@ -0,0 +1,5 @@
+// Search - Palo Alto - NGFW - Traffic - Bytes - Total Traffic Volume [chart]
+tag=$PAN_TRAFFIC ax bytes
+| stats sum(bytes)
+| eval (Megabytes = sum / (1024 * 1024))
+| chart Megabytes
\ No newline at end of file
diff --git a/paloalto/searchlibrary/80ade539-a898-480c-b9da-c284f3da09dc.meta b/paloalto/searchlibrary/80ade539-a898-480c-b9da-c284f3da09dc.meta
new file mode 100644
index 00000000..da727efa
--- /dev/null
+++ b/paloalto/searchlibrary/80ade539-a898-480c-b9da-c284f3da09dc.meta
@@ -0,0 +1,11 @@
+{
+ "Name": "Search - Palo Alto - NGFW - Threat - Events - Count by Threat Source Location [chart]",
+ "Description": "Displays a chart of threat event counts by source location.\n\nDependencies\n- Dashboard: Palo Alto Threat Overview",
+ "GUID": "80ade539-a898-480c-b9da-c284f3da09dc",
+ "Labels": [
+ "palo"
+ ],
+ "Metadata": {
+ "timeframe": null
+ }
+}
\ No newline at end of file
diff --git a/paloalto/searchlibrary/80ade539-a898-480c-b9da-c284f3da09dc.query b/paloalto/searchlibrary/80ade539-a898-480c-b9da-c284f3da09dc.query
new file mode 100644
index 00000000..2e9ff927
--- /dev/null
+++ b/paloalto/searchlibrary/80ade539-a898-480c-b9da-c284f3da09dc.query
@@ -0,0 +1,4 @@
+// Search - Palo Alto - NGFW - Threat - Events - Count by Threat Source Location [chart]
+tag=$PAN_THREAT ax subtype srcloc
+| stats count by srcloc
+| chart count by srcloc
\ No newline at end of file
diff --git a/paloalto/searchlibrary/80c5d3bb-81fb-475a-b922-f5387e023102.meta b/paloalto/searchlibrary/80c5d3bb-81fb-475a-b922-f5387e023102.meta
new file mode 100644
index 00000000..25455567
--- /dev/null
+++ b/paloalto/searchlibrary/80c5d3bb-81fb-475a-b922-f5387e023102.meta
@@ -0,0 +1,11 @@
+{
+ "Name": "Search - Palo Alto - NGFW - Event Types - Count by Tag [numbercard]",
+ "Description": "Displays a numbercard of event counts by TAG.\n\nDependencies\n- Dashboard: Palo Alto General Overview",
+ "GUID": "80c5d3bb-81fb-475a-b922-f5387e023102",
+ "Labels": [
+ "palo"
+ ],
+ "Metadata": {
+ "timeframe": null
+ }
+}
\ No newline at end of file
diff --git a/paloalto/searchlibrary/80c5d3bb-81fb-475a-b922-f5387e023102.query b/paloalto/searchlibrary/80c5d3bb-81fb-475a-b922-f5387e023102.query
new file mode 100644
index 00000000..72fdf664
--- /dev/null
+++ b/paloalto/searchlibrary/80c5d3bb-81fb-475a-b922-f5387e023102.query
@@ -0,0 +1,4 @@
+tag=$PAN_ALL
+| stats count by TAG
+| alias count " "
+| numbercard " "
\ No newline at end of file
diff --git a/paloalto/searchlibrary/847bc392-e6f0-4aa3-ba1f-db7b9608c672.meta b/paloalto/searchlibrary/847bc392-e6f0-4aa3-ba1f-db7b9608c672.meta
new file mode 100644
index 00000000..4c40698b
--- /dev/null
+++ b/paloalto/searchlibrary/847bc392-e6f0-4aa3-ba1f-db7b9608c672.meta
@@ -0,0 +1,11 @@
+{
+ "Name": "Search - Palo Alto - NGFW - GlobalProtect - Authentication - Count by Status [numbercard]",
+ "Description": "Displays a numbercard of GlobalProtect login attempt counts by status.\n\nDependencies\n- Dashboard: Palo Alto GlobalProtect Overview",
+ "GUID": "847bc392-e6f0-4aa3-ba1f-db7b9608c672",
+ "Labels": [
+ "palo"
+ ],
+ "Metadata": {
+ "timeframe": null
+ }
+}
\ No newline at end of file
diff --git a/paloalto/searchlibrary/847bc392-e6f0-4aa3-ba1f-db7b9608c672.query b/paloalto/searchlibrary/847bc392-e6f0-4aa3-ba1f-db7b9608c672.query
new file mode 100644
index 00000000..1669f945
--- /dev/null
+++ b/paloalto/searchlibrary/847bc392-e6f0-4aa3-ba1f-db7b9608c672.query
@@ -0,0 +1,4 @@
+// Search - Palo Alto - NGFW - GlobalProtect - Authentication - Count by Status [numbercard]
+tag=$PAN_GLOBALPROTECT ax stage=="login" status
+| stats count by status
+| numbercard (count "")
\ No newline at end of file
diff --git a/paloalto/searchlibrary/8b60b817-ad70-4c99-95ec-c82c43e61d64.meta b/paloalto/searchlibrary/8b60b817-ad70-4c99-95ec-c82c43e61d64.meta
new file mode 100644
index 00000000..592b505a
--- /dev/null
+++ b/paloalto/searchlibrary/8b60b817-ad70-4c99-95ec-c82c43e61d64.meta
@@ -0,0 +1,11 @@
+{
+ "Name": "Search - Palo Alto - NGFW - Config - Events - Count by Administrators [chart]",
+ "Description": "Displays a chart of configuration event counts by administrator.\n\nDependencies\n- Dashboard: Palo Alto Config Overview",
+ "GUID": "8b60b817-ad70-4c99-95ec-c82c43e61d64",
+ "Labels": [
+ "palo"
+ ],
+ "Metadata": {
+ "timeframe": null
+ }
+}
\ No newline at end of file
diff --git a/paloalto/searchlibrary/8b60b817-ad70-4c99-95ec-c82c43e61d64.query b/paloalto/searchlibrary/8b60b817-ad70-4c99-95ec-c82c43e61d64.query
new file mode 100644
index 00000000..8294e24a
--- /dev/null
+++ b/paloalto/searchlibrary/8b60b817-ad70-4c99-95ec-c82c43e61d64.query
@@ -0,0 +1,4 @@
+// Search - Palo Alto - NGFW - Config - Administrator - Configuration Administrators [chart]
+tag=$PAN_CONFIG ax admin
+| stats count by admin
+| chart count by admin
\ No newline at end of file
diff --git a/paloalto/searchlibrary/8fbf3919-9199-41a0-b72e-07a4aed91ab7.meta b/paloalto/searchlibrary/8fbf3919-9199-41a0-b72e-07a4aed91ab7.meta
new file mode 100644
index 00000000..92eef317
--- /dev/null
+++ b/paloalto/searchlibrary/8fbf3919-9199-41a0-b72e-07a4aed91ab7.meta
@@ -0,0 +1,11 @@
+{
+ "Name": "Search - Palo Alto - NGFW - Threat - Events - Count by Threat Destination Location [chart]",
+ "Description": "Displays a chart of threat event counts by destination location.\n\nDependencies\n- Dashboard: Palo Alto Threat Overview",
+ "GUID": "8fbf3919-9199-41a0-b72e-07a4aed91ab7",
+ "Labels": [
+ "palo"
+ ],
+ "Metadata": {
+ "timeframe": null
+ }
+}
\ No newline at end of file
diff --git a/paloalto/searchlibrary/8fbf3919-9199-41a0-b72e-07a4aed91ab7.query b/paloalto/searchlibrary/8fbf3919-9199-41a0-b72e-07a4aed91ab7.query
new file mode 100644
index 00000000..aef46189
--- /dev/null
+++ b/paloalto/searchlibrary/8fbf3919-9199-41a0-b72e-07a4aed91ab7.query
@@ -0,0 +1,4 @@
+// Search - Palo Alto - NGFW - Threat - Events - Count by Threat Destination Location [chart]
+tag=$PAN_THREAT ax subtype dstloc
+| stats count by dstloc
+| chart count by dstloc
\ No newline at end of file
diff --git a/paloalto/searchlibrary/9a538ea3-3656-4d12-a252-9b4c88487299.meta b/paloalto/searchlibrary/9a538ea3-3656-4d12-a252-9b4c88487299.meta
new file mode 100644
index 00000000..1782b0fc
--- /dev/null
+++ b/paloalto/searchlibrary/9a538ea3-3656-4d12-a252-9b4c88487299.meta
@@ -0,0 +1,11 @@
+{
+ "Name": "Search - Palo Alto - NGFW - Threat/Traffic - Event Type - Count by Type [numbercard]",
+ "Description": "Displays a numbercard of event counts by type. \n\nDependencies:\nDashboard: Palo Alto User Behavior Overview",
+ "GUID": "9a538ea3-3656-4d12-a252-9b4c88487299",
+ "Labels": [
+ "palo"
+ ],
+ "Metadata": {
+ "timeframe": null
+ }
+}
\ No newline at end of file
diff --git a/paloalto/searchlibrary/9a538ea3-3656-4d12-a252-9b4c88487299.query b/paloalto/searchlibrary/9a538ea3-3656-4d12-a252-9b4c88487299.query
new file mode 100644
index 00000000..c59039c0
--- /dev/null
+++ b/paloalto/searchlibrary/9a538ea3-3656-4d12-a252-9b4c88487299.query
@@ -0,0 +1,16 @@
+// Search - Palo Alto - NGFW - Threat/Traffic - Event Type - Count by Type [numbercard]
+tag=$PAN_THREAT_TRAFFIC ax subtype
+| tag=$PAN_TRAFFIC eval if (subtype == "end") {
+ $(type) = "Traffic Events";
+}
+| tag=$PAN_THREAT eval if (subtype == "url") {
+ $(type) = "URL Events";
+} else if (subtype == "data") {
+ $(type) = "Data Events";
+} else if (subtype == "file") {
+ $(type) = "File Events";
+} else if (subtype == "vulnerability") {
+ $(type) = "Vulnerability Events";
+}
+| stats count by type
+| numbercard (count "")
\ No newline at end of file
diff --git a/paloalto/searchlibrary/9b25ad03-4189-445f-b27c-48ec3af4b0e7.meta b/paloalto/searchlibrary/9b25ad03-4189-445f-b27c-48ec3af4b0e7.meta
new file mode 100644
index 00000000..043dc6cf
--- /dev/null
+++ b/paloalto/searchlibrary/9b25ad03-4189-445f-b27c-48ec3af4b0e7.meta
@@ -0,0 +1,11 @@
+{
+ "Name": "Search - Palo Alto - NGFW - Traffic - SaaS - Total Bytes Transferred [numbercard]",
+ "Description": "Displays a numbercard of total bytes transferred for SaaS traffic sessions.\n\nDependencies\n- Dashboard: Palo Alto SaaS Overview",
+ "GUID": "9b25ad03-4189-445f-b27c-48ec3af4b0e7",
+ "Labels": [
+ "palo"
+ ],
+ "Metadata": {
+ "timeframe": null
+ }
+}
\ No newline at end of file
diff --git a/paloalto/searchlibrary/9b25ad03-4189-445f-b27c-48ec3af4b0e7.query b/paloalto/searchlibrary/9b25ad03-4189-445f-b27c-48ec3af4b0e7.query
new file mode 100644
index 00000000..4519415e
--- /dev/null
+++ b/paloalto/searchlibrary/9b25ad03-4189-445f-b27c-48ec3af4b0e7.query
@@ -0,0 +1,4 @@
+// Search - Palo Alto - NGFW - Traffic - SaaS - Total Bytes Transferred [numbercard]
+tag=$PAN_TRAFFIC ax subtype=="end" is_saas_of_app=="yes" bytes
+| stats sum(bytes)
+| numbercard (sum "SaaS bytes transferred")
\ No newline at end of file
diff --git a/paloalto/searchlibrary/9ed28079-5408-43b7-8d44-c1b9c9dfbfed.meta b/paloalto/searchlibrary/9ed28079-5408-43b7-8d44-c1b9c9dfbfed.meta
new file mode 100644
index 00000000..7f93e988
--- /dev/null
+++ b/paloalto/searchlibrary/9ed28079-5408-43b7-8d44-c1b9c9dfbfed.meta
@@ -0,0 +1,11 @@
+{
+ "Name": "Search - Palo Alto - NGFW - Threat - WildFire - Recent Wildfire Submissions [table]",
+ "Description": "Displays a table of recent non-benign WildFire file submissions including source, destination, and file details.\n\nDependencies\n- Dashboard: Palo Alto Wildfire Overview",
+ "GUID": "9ed28079-5408-43b7-8d44-c1b9c9dfbfed",
+ "Labels": [
+ "palo"
+ ],
+ "Metadata": {
+ "timeframe": null
+ }
+}
\ No newline at end of file
diff --git a/paloalto/searchlibrary/9ed28079-5408-43b7-8d44-c1b9c9dfbfed.query b/paloalto/searchlibrary/9ed28079-5408-43b7-8d44-c1b9c9dfbfed.query
new file mode 100644
index 00000000..29ad581c
--- /dev/null
+++ b/paloalto/searchlibrary/9ed28079-5408-43b7-8d44-c1b9c9dfbfed.query
@@ -0,0 +1,4 @@
+// Search - Palo Alto - NGFW - Threat - WildFire - Recent Wildfire Submissions [table]
+tag=$PAN_THREAT ax subtype=="wildfire" category!="benign"
+| alias misc filename
+| table category rule app src dst filename filetype filedigest
\ No newline at end of file
diff --git a/paloalto/searchlibrary/a787167f-da7d-4c92-b2fd-09698f21e49b.meta b/paloalto/searchlibrary/a787167f-da7d-4c92-b2fd-09698f21e49b.meta
new file mode 100644
index 00000000..15077c37
--- /dev/null
+++ b/paloalto/searchlibrary/a787167f-da7d-4c92-b2fd-09698f21e49b.meta
@@ -0,0 +1,11 @@
+{
+ "Name": "Search - Palo Alto - NGFW - GlobalProtect - Diagnostics - Average Latency [chart]",
+ "Description": "Displays a chart of average pre-tunnel and post-tunnel latency for GlobalProtect gateway connections.\n\nDependencies\n- Dashboard: Palo Alto GlobalProtect Overview",
+ "GUID": "a787167f-da7d-4c92-b2fd-09698f21e49b",
+ "Labels": [
+ "palo"
+ ],
+ "Metadata": {
+ "timeframe": null
+ }
+}
\ No newline at end of file
diff --git a/paloalto/searchlibrary/a787167f-da7d-4c92-b2fd-09698f21e49b.query b/paloalto/searchlibrary/a787167f-da7d-4c92-b2fd-09698f21e49b.query
new file mode 100644
index 00000000..266a6c9b
--- /dev/null
+++ b/paloalto/searchlibrary/a787167f-da7d-4c92-b2fd-09698f21e49b.query
@@ -0,0 +1,10 @@
+// Search - Palo Alto - NGFW - GlobalProtect - Diagnostics - Average Latency [chart]
+tag=$PAN_GLOBALPROTECT ax eventid=="gateway-tunnel-latency" description
+| regex -e description "Pre-tunnel latency: (?P[^,]+), Post-tunnel latency: (?P[^,]+)"
+/* We use toDuration to go from a string to a Duration */
+| eval pre = duration(pre);
+ post = duration(post);
+| stats mean(pre) as pre mean(post) as post
+/* At this point, pre and post are in nanoseconds. Let's convert them to milliseconds */
+| eval $(Pre-tunnel Latency) = pre / 1000000; $(Post-tunnel Latency) = post / 1000000;
+| chart "Pre-tunnel Latency" "Post-tunnel Latency"
\ No newline at end of file
diff --git a/paloalto/searchlibrary/bc005eda-32cf-4a11-accf-6684a2fb9af2.meta b/paloalto/searchlibrary/bc005eda-32cf-4a11-accf-6684a2fb9af2.meta
new file mode 100644
index 00000000..923626e0
--- /dev/null
+++ b/paloalto/searchlibrary/bc005eda-32cf-4a11-accf-6684a2fb9af2.meta
@@ -0,0 +1,11 @@
+{
+ "Name": "Search - Palo Alto - NGFW - Traffic - SaaS - Sanctioned Applications [table]",
+ "Description": "Displays a table of sanctioned SaaS applications with session counts and total traffic volume.\n\nDependencies\n- Dashboard: Palo Alto SaaS Overview",
+ "GUID": "bc005eda-32cf-4a11-accf-6684a2fb9af2",
+ "Labels": [
+ "palo"
+ ],
+ "Metadata": {
+ "timeframe": null
+ }
+}
\ No newline at end of file
diff --git a/paloalto/searchlibrary/bc005eda-32cf-4a11-accf-6684a2fb9af2.query b/paloalto/searchlibrary/bc005eda-32cf-4a11-accf-6684a2fb9af2.query
new file mode 100644
index 00000000..e1b1b637
--- /dev/null
+++ b/paloalto/searchlibrary/bc005eda-32cf-4a11-accf-6684a2fb9af2.query
@@ -0,0 +1,7 @@
+// Search - Palo Alto - NGFW - Traffic - SaaS - Sanctioned Applications [table]
+tag=$PAN_TRAFFIC ax app category_of_app subcategory_of_app bytes is_saas_of_app=="yes" sanctioned_state_of_app=="yes"
+| alias app App category_of_app Category subcategory_of_app Subcategory
+| stats sum(bytes) count as Sessions by App Category Subcategory
+| eval Volume = sum;
+| sort by sum desc
+| table App Category Subcategory Sessions Volume
\ No newline at end of file
diff --git a/paloalto/searchlibrary/ce08d927-0617-41e5-9b44-22f8568c5ff0.meta b/paloalto/searchlibrary/ce08d927-0617-41e5-9b44-22f8568c5ff0.meta
new file mode 100644
index 00000000..1aa31927
--- /dev/null
+++ b/paloalto/searchlibrary/ce08d927-0617-41e5-9b44-22f8568c5ff0.meta
@@ -0,0 +1,11 @@
+{
+ "Name": "Search - Palo Alto - NGFW - Traffic - SaaS - Count by Action [chart]",
+ "Description": "Displays a chart of SaaS traffic event counts by action.\n\nDependencies\n- Dashboard: Palo Alto SaaS Overview",
+ "GUID": "ce08d927-0617-41e5-9b44-22f8568c5ff0",
+ "Labels": [
+ "palo"
+ ],
+ "Metadata": {
+ "timeframe": null
+ }
+}
\ No newline at end of file
diff --git a/paloalto/searchlibrary/ce08d927-0617-41e5-9b44-22f8568c5ff0.query b/paloalto/searchlibrary/ce08d927-0617-41e5-9b44-22f8568c5ff0.query
new file mode 100644
index 00000000..b8a61cd4
--- /dev/null
+++ b/paloalto/searchlibrary/ce08d927-0617-41e5-9b44-22f8568c5ff0.query
@@ -0,0 +1,4 @@
+// Search - Palo Alto - NGFW - Traffic - SaaS - Count by Action [chart]
+tag=$PAN_TRAFFIC ax is_saas_of_app=="yes" action
+| stats count by action
+| chart count by action
\ No newline at end of file
diff --git a/paloalto/searchlibrary/d625b9af-4e63-40df-9392-62cbd04c8213.meta b/paloalto/searchlibrary/d625b9af-4e63-40df-9392-62cbd04c8213.meta
new file mode 100644
index 00000000..abe70988
--- /dev/null
+++ b/paloalto/searchlibrary/d625b9af-4e63-40df-9392-62cbd04c8213.meta
@@ -0,0 +1,11 @@
+{
+ "Name": "Search - Palo Alto - NGFW - GlobalProtect - Authentication - Count by Status [chart]",
+ "Description": "Displays a chart of GlobalProtect login attempt counts by status.\n\nDependencies\n- Dashboard: Palo Alto GlobalProtect Overview",
+ "GUID": "d625b9af-4e63-40df-9392-62cbd04c8213",
+ "Labels": [
+ "palo"
+ ],
+ "Metadata": {
+ "timeframe": null
+ }
+}
\ No newline at end of file
diff --git a/paloalto/searchlibrary/d625b9af-4e63-40df-9392-62cbd04c8213.query b/paloalto/searchlibrary/d625b9af-4e63-40df-9392-62cbd04c8213.query
new file mode 100644
index 00000000..e4be0e91
--- /dev/null
+++ b/paloalto/searchlibrary/d625b9af-4e63-40df-9392-62cbd04c8213.query
@@ -0,0 +1,4 @@
+// Search - Palo Alto - NGFW - GlobalProtect - Authentication - Count by Status [chart]
+tag=$PAN_GLOBALPROTECT ax stage=="login" status
+| stats count by status
+| chart count by status
\ No newline at end of file
diff --git a/paloalto/searchlibrary/dfec2b9b-5466-4ec5-9ce6-5a23b42488f7.meta b/paloalto/searchlibrary/dfec2b9b-5466-4ec5-9ce6-5a23b42488f7.meta
new file mode 100644
index 00000000..59002b85
--- /dev/null
+++ b/paloalto/searchlibrary/dfec2b9b-5466-4ec5-9ce6-5a23b42488f7.meta
@@ -0,0 +1,11 @@
+{
+ "Name": "Search - Palo Alto - NGFW - Threat - WildFire - Count by Category [chart]",
+ "Description": "Displays a chart of WildFire verdict counts by category.\n\nDependencies\n- Dashboard: Palo Alto Wildfire Overview",
+ "GUID": "dfec2b9b-5466-4ec5-9ce6-5a23b42488f7",
+ "Labels": [
+ "palo"
+ ],
+ "Metadata": {
+ "timeframe": null
+ }
+}
\ No newline at end of file
diff --git a/paloalto/searchlibrary/dfec2b9b-5466-4ec5-9ce6-5a23b42488f7.query b/paloalto/searchlibrary/dfec2b9b-5466-4ec5-9ce6-5a23b42488f7.query
new file mode 100644
index 00000000..68d8feb5
--- /dev/null
+++ b/paloalto/searchlibrary/dfec2b9b-5466-4ec5-9ce6-5a23b42488f7.query
@@ -0,0 +1,4 @@
+// Search - Palo Alto - NGFW - Threat - WildFire - Count by Category [chart]
+tag=$PAN_THREAT ax subtype=="wildfire" category
+| stats count by category
+| chart count by category
\ No newline at end of file
diff --git a/paloalto/searchlibrary/e442e808-5c6e-4509-a66b-cb744a26aff6.meta b/paloalto/searchlibrary/e442e808-5c6e-4509-a66b-cb744a26aff6.meta
new file mode 100644
index 00000000..be23b125
--- /dev/null
+++ b/paloalto/searchlibrary/e442e808-5c6e-4509-a66b-cb744a26aff6.meta
@@ -0,0 +1,11 @@
+{
+ "Name": "Search - Palo Alto - NGFW - Traffic - SaaS - Count by Unsanctioned Category [chart]",
+ "Description": "Displays a chart of the least frequently observed sanctioned SaaS application categories.\n\nDependencies\n- Dashboard: Palo Alto SaaS Overview",
+ "GUID": "e442e808-5c6e-4509-a66b-cb744a26aff6",
+ "Labels": [
+ "palo"
+ ],
+ "Metadata": {
+ "timeframe": null
+ }
+}
\ No newline at end of file
diff --git a/paloalto/searchlibrary/e442e808-5c6e-4509-a66b-cb744a26aff6.query b/paloalto/searchlibrary/e442e808-5c6e-4509-a66b-cb744a26aff6.query
new file mode 100644
index 00000000..dbb592af
--- /dev/null
+++ b/paloalto/searchlibrary/e442e808-5c6e-4509-a66b-cb744a26aff6.query
@@ -0,0 +1,4 @@
+// Search - Palo Alto - NGFW - Traffic - SaaS - Count by Unsanctioned Category [chart]
+tag=$PAN_TRAFFIC ax sanctioned_state_of_app=="no" is_saas_of_app=="yes" subcategory_of_app
+| stats count by subcategory_of_app
+| chart count by subcategory_of_app limit 6
\ No newline at end of file
diff --git a/paloalto/searchlibrary/eb5f3a03-f3fc-479e-a4fb-babff92baf97.meta b/paloalto/searchlibrary/eb5f3a03-f3fc-479e-a4fb-babff92baf97.meta
new file mode 100644
index 00000000..3c5ad076
--- /dev/null
+++ b/paloalto/searchlibrary/eb5f3a03-f3fc-479e-a4fb-babff92baf97.meta
@@ -0,0 +1,11 @@
+{
+ "Name": "Search - Palo Alto - NGFW - Threat - WildFire - Count by File Type [chart]",
+ "Description": "Displays a chart of WildFire submission counts by file type.\n\nDependencies\n- Dashboard: Palo Alto Wildfire Overview",
+ "GUID": "eb5f3a03-f3fc-479e-a4fb-babff92baf97",
+ "Labels": [
+ "palo"
+ ],
+ "Metadata": {
+ "timeframe": null
+ }
+}
\ No newline at end of file
diff --git a/paloalto/searchlibrary/eb5f3a03-f3fc-479e-a4fb-babff92baf97.query b/paloalto/searchlibrary/eb5f3a03-f3fc-479e-a4fb-babff92baf97.query
new file mode 100644
index 00000000..a4571013
--- /dev/null
+++ b/paloalto/searchlibrary/eb5f3a03-f3fc-479e-a4fb-babff92baf97.query
@@ -0,0 +1,4 @@
+// Search - Palo Alto - NGFW - Threat - WildFire - Count by File Type [chart]
+tag=$PAN_THREAT ax subtype=="wildfire" filetype
+| stats count by filetype
+| chart count by filetype
\ No newline at end of file
diff --git a/paloalto/searchlibrary/ed30530c-b91b-4e37-aa5a-c9c3c889832c.meta b/paloalto/searchlibrary/ed30530c-b91b-4e37-aa5a-c9c3c889832c.meta
new file mode 100644
index 00000000..92ad6535
--- /dev/null
+++ b/paloalto/searchlibrary/ed30530c-b91b-4e37-aa5a-c9c3c889832c.meta
@@ -0,0 +1,11 @@
+{
+ "Name": "Search - Palo Alto - NGFW - Traffic - Application - Rare Applications [table]",
+ "Description": "Displays a table of the least frequently observed applications in traffic logs.\n\nDependencies\n- Dashboard: Palo Alto User Behavior Overview",
+ "GUID": "ed30530c-b91b-4e37-aa5a-c9c3c889832c",
+ "Labels": [
+ "palo"
+ ],
+ "Metadata": {
+ "timeframe": null
+ }
+}
\ No newline at end of file
diff --git a/paloalto/searchlibrary/ed30530c-b91b-4e37-aa5a-c9c3c889832c.query b/paloalto/searchlibrary/ed30530c-b91b-4e37-aa5a-c9c3c889832c.query
new file mode 100644
index 00000000..b8120f93
--- /dev/null
+++ b/paloalto/searchlibrary/ed30530c-b91b-4e37-aa5a-c9c3c889832c.query
@@ -0,0 +1,6 @@
+// Search - Palo Alto - NGFW - Traffic - Application - Rare Applications [table]
+tag=$PAN_TRAFFIC ax subtype=="end" app
+| stats count by app
+| sort by count asc
+| limit 10
+| table app count
\ No newline at end of file
diff --git a/paloalto/searchlibrary/f04b1ebf-96d1-4220-97da-291ab125f4d4.meta b/paloalto/searchlibrary/f04b1ebf-96d1-4220-97da-291ab125f4d4.meta
new file mode 100644
index 00000000..92389423
--- /dev/null
+++ b/paloalto/searchlibrary/f04b1ebf-96d1-4220-97da-291ab125f4d4.meta
@@ -0,0 +1,11 @@
+{
+ "Name": "Search - Palo Alto - NGFW - Threat - URL - Count by Top Hostnames [table]",
+ "Description": "Displays a table of hostname counts extracted from URL threat events.\n\nDependencies\n- Dashboard: Palo Alto User Behavior Overview",
+ "GUID": "f04b1ebf-96d1-4220-97da-291ab125f4d4",
+ "Labels": [
+ "palo"
+ ],
+ "Metadata": {
+ "timeframe": null
+ }
+}
\ No newline at end of file
diff --git a/paloalto/searchlibrary/f04b1ebf-96d1-4220-97da-291ab125f4d4.query b/paloalto/searchlibrary/f04b1ebf-96d1-4220-97da-291ab125f4d4.query
new file mode 100644
index 00000000..e2694f39
--- /dev/null
+++ b/paloalto/searchlibrary/f04b1ebf-96d1-4220-97da-291ab125f4d4.query
@@ -0,0 +1,5 @@
+// Search - Palo Alto - NGFW - Threat - URL - Top Hostnames [table]
+tag=$PAN_THREAT ax subtype=="url" misc
+| regex -e misc "(?P[^/]+)/"
+| stats count by hostname
+| table hostname count
\ No newline at end of file
diff --git a/paloalto/searchlibrary/fd4e2509-d685-49d4-b9c8-cdb8d1c0d153.meta b/paloalto/searchlibrary/fd4e2509-d685-49d4-b9c8-cdb8d1c0d153.meta
new file mode 100644
index 00000000..f28b4d8c
--- /dev/null
+++ b/paloalto/searchlibrary/fd4e2509-d685-49d4-b9c8-cdb8d1c0d153.meta
@@ -0,0 +1,11 @@
+{
+ "Name": "Search - Palo Alto - NGFW - Threat - Events - Count by Scan Types [chart]",
+ "Description": "Displays a chart of scan event counts by threat ID.\n\nDependencies\n- Dashboard: Palo Alto Threat Overview",
+ "GUID": "fd4e2509-d685-49d4-b9c8-cdb8d1c0d153",
+ "Labels": [
+ "palo"
+ ],
+ "Metadata": {
+ "timeframe": null
+ }
+}
\ No newline at end of file
diff --git a/paloalto/searchlibrary/fd4e2509-d685-49d4-b9c8-cdb8d1c0d153.query b/paloalto/searchlibrary/fd4e2509-d685-49d4-b9c8-cdb8d1c0d153.query
new file mode 100644
index 00000000..a2ab0fea
--- /dev/null
+++ b/paloalto/searchlibrary/fd4e2509-d685-49d4-b9c8-cdb8d1c0d153.query
@@ -0,0 +1,4 @@
+// Search - Palo Alto - NGFW - Threat - Events - Count by Scan Types [chart]
+tag=$PAN_THREAT ax subtype=="scan" threatid
+| stats count by threatid
+| chart count by threatid
\ No newline at end of file
diff --git a/paloalto/searchlibrary/fe4898de-8dd2-46dc-a3bc-3263bdaae33a.meta b/paloalto/searchlibrary/fe4898de-8dd2-46dc-a3bc-3263bdaae33a.meta
new file mode 100644
index 00000000..d6d89971
--- /dev/null
+++ b/paloalto/searchlibrary/fe4898de-8dd2-46dc-a3bc-3263bdaae33a.meta
@@ -0,0 +1,11 @@
+{
+ "Name": "Search - Palo Alto - NGFW - Traffic - SaaS - Count by Application [chart]",
+ "Description": "Displays a chart of SaaS traffic session counts by application.\n\nDependencies\n- Dashboard: Palo Alto SaaS Overview",
+ "GUID": "fe4898de-8dd2-46dc-a3bc-3263bdaae33a",
+ "Labels": [
+ "palo"
+ ],
+ "Metadata": {
+ "timeframe": null
+ }
+}
\ No newline at end of file
diff --git a/paloalto/searchlibrary/fe4898de-8dd2-46dc-a3bc-3263bdaae33a.query b/paloalto/searchlibrary/fe4898de-8dd2-46dc-a3bc-3263bdaae33a.query
new file mode 100644
index 00000000..b8a1cdac
--- /dev/null
+++ b/paloalto/searchlibrary/fe4898de-8dd2-46dc-a3bc-3263bdaae33a.query
@@ -0,0 +1,4 @@
+// Search - Palo Alto - NGFW - Traffic - SaaS - Count by Application [chart]
+tag=$PAN_TRAFFIC ax subtype=="end" is_saas_of_app=="yes" app
+| stats count by app
+| chart count by app
\ No newline at end of file
diff --git a/paloalto/template/10e2589a-08f8-4665-857d-3e6092c9500a.meta b/paloalto/template/10e2589a-08f8-4665-857d-3e6092c9500a.meta
new file mode 100644
index 00000000..0f6f0068
--- /dev/null
+++ b/paloalto/template/10e2589a-08f8-4665-857d-3e6092c9500a.meta
@@ -0,0 +1,28 @@
+{
+ "UUID": "10e2589a-08f8-4665-857d-3e6092c9500a",
+ "Name": "Template - Palo Alto - NGFW - Threat - WildFire - All Submissions for User \u0026 IP [table]",
+ "Description": "Displays a table of WildFire file submissions associated with the specified IP address.\n\nDependencies\n- Dashboard: Palo Alto Investigations",
+ "Data": {
+ "variables": [
+ {
+ "name": "%%user%%",
+ "label": "User",
+ "description": "This variable for the User allows you to query the relevant EVs such as srcuser and dstuser (if applicable).",
+ "required": true,
+ "defaultValue": ".",
+ "previewValue": "."
+ },
+ {
+ "name": "%%ip%%",
+ "label": "IP Address",
+ "description": "This variable for the IP Address allows you to query the relevant EVs such as src, natsrc, dst, natdst, xff_ip, private_ip, and public_ip (if applicable).",
+ "required": true,
+ "defaultValue": ".",
+ "previewValue": "."
+ }
+ ]
+ },
+ "Labels": [
+ "palo"
+ ]
+}
\ No newline at end of file
diff --git a/paloalto/template/10e2589a-08f8-4665-857d-3e6092c9500a.query b/paloalto/template/10e2589a-08f8-4665-857d-3e6092c9500a.query
new file mode 100644
index 00000000..d74b5a6b
--- /dev/null
+++ b/paloalto/template/10e2589a-08f8-4665-857d-3e6092c9500a.query
@@ -0,0 +1,18 @@
+// Template - Palo Alto - NGFW - Threat - WildFire - All Submissions for User & IP [table]
+tag=$PAN_THREAT ax subtype=="wildfire"
+| alias
+ misc Filename
+ filetype Filetype
+ filedigest "File Digest"
+ category Category
+ rule Rule
+ app App
+ src "Source"
+ natsrc "NAT Source"
+ srcuser "Source User"
+ dst "Destination"
+ natdst "NAT Destination"
+ dstuser "Destination User"
+ xff_ip "XFF Address"
+| eval (srcuser~"%%user%%" || dstuser~"%%user%%") && (src~"%%ip%%" || natsrc~"%%ip%%" || dst~"%%ip%%" || natdst~"%%ip%%" || xff_ip~"%%ip%%")
+| table Category Rule App "Source" "NAT Source" "Source User" "Destination" "NAT Destination" "Destination User" "XFF Address" Filename Filetype "File Digest"
\ No newline at end of file
diff --git a/paloalto/template/15e8e4fd-763e-4043-97f0-162778ec859c.meta b/paloalto/template/15e8e4fd-763e-4043-97f0-162778ec859c.meta
new file mode 100644
index 00000000..dca3c7bc
--- /dev/null
+++ b/paloalto/template/15e8e4fd-763e-4043-97f0-162778ec859c.meta
@@ -0,0 +1,28 @@
+{
+ "UUID": "15e8e4fd-763e-4043-97f0-162778ec859c",
+ "Name": "Template - Palo Alto - NGFW - Threat - Events - All Threat Events for User \u0026 IP [table]",
+ "Description": "Displays a table of threat events associated with the specified IP address including source, destination, and threat ID.\n\nDependencies\n- Dashboard: Palo Alto Investigations",
+ "Data": {
+ "variables": [
+ {
+ "name": "%%user%%",
+ "label": "User",
+ "description": "This variable for the User allows you to query the relevant EVs such as srcuser and dstuser (if applicable).",
+ "required": true,
+ "defaultValue": ".",
+ "previewValue": "."
+ },
+ {
+ "name": "%%ip%%",
+ "label": "IP Address",
+ "description": "This variable for the IP Address allows you to query the relevant EVs such as src, natsrc, dst, natdst, xff_ip, private_ip, and public_ip (if applicable).",
+ "required": true,
+ "defaultValue": ".",
+ "previewValue": "."
+ }
+ ]
+ },
+ "Labels": [
+ "palo"
+ ]
+}
\ No newline at end of file
diff --git a/paloalto/template/15e8e4fd-763e-4043-97f0-162778ec859c.query b/paloalto/template/15e8e4fd-763e-4043-97f0-162778ec859c.query
new file mode 100644
index 00000000..14497c29
--- /dev/null
+++ b/paloalto/template/15e8e4fd-763e-4043-97f0-162778ec859c.query
@@ -0,0 +1,5 @@
+// Template - Palo Alto - NGFW - Threat - Events - All Threat Events for User & IP [table]
+tag=$PAN_THREAT ax src natsrc srcuser dst natdst dstuser threatid xff_ip category_of_app subcategory_of_app
+| alias threatid "Threat ID" src "Source" srcuser "Source User" dst "Destination" dstuser "Destination User" category_of_app "Category"
+| eval (srcuser~"%%user%%" || dstuser~"%%user%%") && (src~"%%ip%%" || natsrc~"%%ip%%" || dst~"%%ip%%" || natdst~"%%ip%%" || xff_ip~"%%ip%%")
+| table Source natsrc "Source User" Destination natdst "Destination User" xff_ip "Threat ID" "Category"
\ No newline at end of file
diff --git a/paloalto/template/182e5db7-4513-4056-a8a8-987fbf570599.meta b/paloalto/template/182e5db7-4513-4056-a8a8-987fbf570599.meta
deleted file mode 100644
index 039fc808..00000000
--- a/paloalto/template/182e5db7-4513-4056-a8a8-987fbf570599.meta
+++ /dev/null
@@ -1,20 +0,0 @@
-{
- "UUID": "182e5db7-4513-4056-a8a8-987fbf570599",
- "Name": "Traffic categories for IP",
- "Description": "Categories of traffic seen by Palo Alto related to given IP address.",
- "Data": {
- "variables": [
- {
- "name": "%%IP%%",
- "label": "",
- "description": "",
- "required": true,
- "defaultValue": "",
- "previewValue": ""
- }
- ]
- },
- "Labels": [
- "palo"
- ]
-}
\ No newline at end of file
diff --git a/paloalto/template/182e5db7-4513-4056-a8a8-987fbf570599.query b/paloalto/template/182e5db7-4513-4056-a8a8-987fbf570599.query
deleted file mode 100644
index 0af71520..00000000
--- a/paloalto/template/182e5db7-4513-4056-a8a8-987fbf570599.query
+++ /dev/null
@@ -1,5 +0,0 @@
-tag=$PAN_TRAFFIC words "%%IP%%"
-| ax src dst category_of_app subcategory_of_app
-| alias src "Source" dst "Destination" category_of_app "Category"
-| stats count by Category
-| chart count by Category
\ No newline at end of file
diff --git a/paloalto/template/21c85c02-8c7a-42fd-9cba-005d36c2cce1.meta b/paloalto/template/21c85c02-8c7a-42fd-9cba-005d36c2cce1.meta
deleted file mode 100644
index cfc32500..00000000
--- a/paloalto/template/21c85c02-8c7a-42fd-9cba-005d36c2cce1.meta
+++ /dev/null
@@ -1,20 +0,0 @@
-{
- "UUID": "21c85c02-8c7a-42fd-9cba-005d36c2cce1",
- "Name": "Threat subtypes for IP",
- "Description": "Generate a numbercard showing counts of threat subtypes related to a given IP.",
- "Data": {
- "variables": [
- {
- "name": "%%IP%%",
- "label": "",
- "description": "",
- "required": true,
- "defaultValue": "",
- "previewValue": ""
- }
- ]
- },
- "Labels": [
- "palo"
- ]
-}
\ No newline at end of file
diff --git a/paloalto/template/21c85c02-8c7a-42fd-9cba-005d36c2cce1.query b/paloalto/template/21c85c02-8c7a-42fd-9cba-005d36c2cce1.query
deleted file mode 100644
index ec369dba..00000000
--- a/paloalto/template/21c85c02-8c7a-42fd-9cba-005d36c2cce1.query
+++ /dev/null
@@ -1 +0,0 @@
-tag=$PAN_THREAT words "%%IP%%" | ax subtype | stats count by subtype | numbercard (count "")
\ No newline at end of file
diff --git a/paloalto/template/278a59ad-0113-42d1-8cf5-3c8bd2bc921c.meta b/paloalto/template/278a59ad-0113-42d1-8cf5-3c8bd2bc921c.meta
new file mode 100644
index 00000000..26042705
--- /dev/null
+++ b/paloalto/template/278a59ad-0113-42d1-8cf5-3c8bd2bc921c.meta
@@ -0,0 +1,28 @@
+{
+ "UUID": "278a59ad-0113-42d1-8cf5-3c8bd2bc921c",
+ "Name": "Template - Palo Alto - NGFW - Traffic - Category - Count by Category [chart]",
+ "Description": "Displays a chart of traffic event counts by application category for the specified IP address.\n\nDependencies\n- Dashboard: Palo Alto Investigations",
+ "Data": {
+ "variables": [
+ {
+ "name": "%%user%%",
+ "label": "User",
+ "description": "This variable for the User allows you to query the relevant EVs such as srcuser and dstuser (if applicable).",
+ "required": true,
+ "defaultValue": ".",
+ "previewValue": "."
+ },
+ {
+ "name": "%%ip%%",
+ "label": "IP Address",
+ "description": "This variable for the IP Address allows you to query the relevant EVs such as src, natsrc, dst, natdst, xff_ip, private_ip, and public_ip (if applicable).",
+ "required": true,
+ "defaultValue": ".",
+ "previewValue": "."
+ }
+ ]
+ },
+ "Labels": [
+ "palo"
+ ]
+}
\ No newline at end of file
diff --git a/paloalto/template/278a59ad-0113-42d1-8cf5-3c8bd2bc921c.query b/paloalto/template/278a59ad-0113-42d1-8cf5-3c8bd2bc921c.query
new file mode 100644
index 00000000..6c359e2a
--- /dev/null
+++ b/paloalto/template/278a59ad-0113-42d1-8cf5-3c8bd2bc921c.query
@@ -0,0 +1,6 @@
+// Template - Palo Alto - NGFW - Traffic - Category - Count by Category [chart]
+tag=$PAN_TRAFFIC ax
+| eval (srcuser~"%%user%%" || dstuser~"%%user%%") && (src~"%%ip%%" || natsrc~"%%ip%%" || dst~"%%ip%%" || natdst~"%%ip%%" || xff_ip~"%%ip%%")
+| alias src "Source" dst "Destination" category_of_app "Category"
+| stats count by Category
+| chart count by Category
\ No newline at end of file
diff --git a/paloalto/template/8ff368b5-1d29-422a-89a7-7eb20c50d224.meta b/paloalto/template/8ff368b5-1d29-422a-89a7-7eb20c50d224.meta
deleted file mode 100644
index b472bbd1..00000000
--- a/paloalto/template/8ff368b5-1d29-422a-89a7-7eb20c50d224.meta
+++ /dev/null
@@ -1,20 +0,0 @@
-{
- "UUID": "8ff368b5-1d29-422a-89a7-7eb20c50d224",
- "Name": "Threat Table for IP",
- "Description": "Table of threats related to a given IP.",
- "Data": {
- "variables": [
- {
- "name": "%%IP%%",
- "label": "",
- "description": "",
- "required": true,
- "defaultValue": "",
- "previewValue": ""
- }
- ]
- },
- "Labels": [
- "palo"
- ]
-}
\ No newline at end of file
diff --git a/paloalto/template/8ff368b5-1d29-422a-89a7-7eb20c50d224.query b/paloalto/template/8ff368b5-1d29-422a-89a7-7eb20c50d224.query
deleted file mode 100644
index d2227ca4..00000000
--- a/paloalto/template/8ff368b5-1d29-422a-89a7-7eb20c50d224.query
+++ /dev/null
@@ -1,4 +0,0 @@
-tag=$PAN_THREAT words "%%IP%%"
-| ax src dst threatid category_of_app subcategory_of_app
-| alias threatid "Threat ID" src "Source" dst "Destination" category_of_app "Category"
-| table Source Destination "Threat ID" "Category"
\ No newline at end of file
diff --git a/paloalto/template/c9e19be7-3673-4d7e-8303-352a1a3ce0bc.meta b/paloalto/template/c9e19be7-3673-4d7e-8303-352a1a3ce0bc.meta
new file mode 100644
index 00000000..65352954
--- /dev/null
+++ b/paloalto/template/c9e19be7-3673-4d7e-8303-352a1a3ce0bc.meta
@@ -0,0 +1,28 @@
+{
+ "UUID": "c9e19be7-3673-4d7e-8303-352a1a3ce0bc",
+ "Name": "Template - Palo Alto - NGFW - Threat - Subtype - Count by Subtypes for User \u0026 IP [numbercard]",
+ "Description": "Displays a numbercard of threat event counts by subtype for the specified IP address.\n\nDependencies\n- Dashboard: Palo Alto Investigations",
+ "Data": {
+ "variables": [
+ {
+ "name": "%%ip%%",
+ "label": "IP Address",
+ "description": "This variable for the IP Address allows you to query the relevant EVs such as src, natsrc, dst, natdst, xff_ip, private_ip, and public_ip (if applicable).",
+ "required": true,
+ "defaultValue": ".",
+ "previewValue": "."
+ },
+ {
+ "name": "%%user%%",
+ "label": "User",
+ "description": "This variable for the User allows you to query the relevant EVs such as srcuser and dstuser (if applicable).",
+ "required": true,
+ "defaultValue": ".",
+ "previewValue": "."
+ }
+ ]
+ },
+ "Labels": [
+ "palo"
+ ]
+}
\ No newline at end of file
diff --git a/paloalto/template/c9e19be7-3673-4d7e-8303-352a1a3ce0bc.query b/paloalto/template/c9e19be7-3673-4d7e-8303-352a1a3ce0bc.query
new file mode 100644
index 00000000..b48d0981
--- /dev/null
+++ b/paloalto/template/c9e19be7-3673-4d7e-8303-352a1a3ce0bc.query
@@ -0,0 +1,5 @@
+// Template - Palo Alto - NGFW - Threat - Subtype - Count by Subtypes for User & IP [numbercard]
+tag=$PAN_THREAT ax
+| eval (srcuser~"%%user%%" || dstuser~"%%user%%") && (src~"%%ip%%" || natsrc~"%%ip%%" || dst~"%%ip%%" || natdst~"%%ip%%" || xff_ip~"%%ip%%")
+| stats count by subtype
+| numbercard (count "")
\ No newline at end of file
diff --git a/paloalto/template/e06715fe-29f6-4d29-bdf2-df6ef933fc72.meta b/paloalto/template/e06715fe-29f6-4d29-bdf2-df6ef933fc72.meta
deleted file mode 100644
index 2d896970..00000000
--- a/paloalto/template/e06715fe-29f6-4d29-bdf2-df6ef933fc72.meta
+++ /dev/null
@@ -1,20 +0,0 @@
-{
- "UUID": "e06715fe-29f6-4d29-bdf2-df6ef933fc72",
- "Name": "Wildfire Submissions for IP",
- "Description": "Table of Wildfire submissions related to a given IP.",
- "Data": {
- "variables": [
- {
- "name": "%%IP%%",
- "label": "",
- "description": "",
- "required": true,
- "defaultValue": "",
- "previewValue": ""
- }
- ]
- },
- "Labels": [
- "palo"
- ]
-}
\ No newline at end of file
diff --git a/paloalto/template/e06715fe-29f6-4d29-bdf2-df6ef933fc72.query b/paloalto/template/e06715fe-29f6-4d29-bdf2-df6ef933fc72.query
deleted file mode 100644
index 2fbe37f3..00000000
--- a/paloalto/template/e06715fe-29f6-4d29-bdf2-df6ef933fc72.query
+++ /dev/null
@@ -1,3 +0,0 @@
-tag=$PAN_THREAT words "%%IP%%" | ax subtype=="wildfire" category misc app rule src dst filetype filedigest
-| alias misc filename
-| table category rule app src dst filename filetype filedigest
\ No newline at end of file
diff --git a/paloalto/template/ecd856f4-ee40-4cc9-a327-5f85ed518a13.meta b/paloalto/template/ecd856f4-ee40-4cc9-a327-5f85ed518a13.meta
new file mode 100644
index 00000000..46414071
--- /dev/null
+++ b/paloalto/template/ecd856f4-ee40-4cc9-a327-5f85ed518a13.meta
@@ -0,0 +1,28 @@
+{
+ "UUID": "ecd856f4-ee40-4cc9-a327-5f85ed518a13",
+ "Name": "Template - Palo Alto - NGFW - GlobalProtect - Events - All VPN Events for User \u0026 IP [table]",
+ "Description": "Displays a table of GlobalProtect sessions associated with the specified IP address including user and machine information.\n\nDependencies\n- Dashboard: Palo Alto Investigations",
+ "Data": {
+ "variables": [
+ {
+ "name": "%%user%%",
+ "label": "User",
+ "description": "This variable for the User allows you to query the relevant EVs such as srcuser and dstuser (if applicable).",
+ "required": true,
+ "defaultValue": ".",
+ "previewValue": "."
+ },
+ {
+ "name": "%%ip%%",
+ "label": "IP Address",
+ "description": "This variable for the IP Address allows you to query the relevant EVs such as src, natsrc, dst, natdst, xff_ip, private_ip, and public_ip (if applicable).",
+ "required": true,
+ "defaultValue": ".",
+ "previewValue": "."
+ }
+ ]
+ },
+ "Labels": [
+ "palo"
+ ]
+}
\ No newline at end of file
diff --git a/paloalto/template/ecd856f4-ee40-4cc9-a327-5f85ed518a13.query b/paloalto/template/ecd856f4-ee40-4cc9-a327-5f85ed518a13.query
new file mode 100644
index 00000000..55971255
--- /dev/null
+++ b/paloalto/template/ecd856f4-ee40-4cc9-a327-5f85ed518a13.query
@@ -0,0 +1,6 @@
+// Template - Palo Alto - NGFW - GlobalProtect - Events - All VPN Events for User & IP [table]
+tag=$PAN_GLOBALPROTECT ax
+| alias srcuser User machinename Machine private_ip "GlobalProtect Private IP" public_ip "GlobalProtect Public IP"
+| unique "GlobalProtect Private IP" User Machine
+| eval (srcuser~"%%user%%") && (public_ip~"%%ip%%" || private_ip~"%%ip%%")
+| table "GlobalProtect Public IP" "GlobalProtect Private IP" User Machine
\ No newline at end of file
diff --git a/paloalto/template/f451f8b7-cf3d-423b-95c6-3738852bd9ea.meta b/paloalto/template/f451f8b7-cf3d-423b-95c6-3738852bd9ea.meta
deleted file mode 100644
index 3327f7e7..00000000
--- a/paloalto/template/f451f8b7-cf3d-423b-95c6-3738852bd9ea.meta
+++ /dev/null
@@ -1,20 +0,0 @@
-{
- "UUID": "f451f8b7-cf3d-423b-95c6-3738852bd9ea",
- "Name": "GlobalProtect Info for IP",
- "Description": "If IP is a GlobalProtect private IP, show information about the user \u0026 machine associated with the IP.",
- "Data": {
- "variables": [
- {
- "name": "%%IP%%",
- "label": "",
- "description": "",
- "required": true,
- "defaultValue": "",
- "previewValue": ""
- }
- ]
- },
- "Labels": [
- "palo"
- ]
-}
\ No newline at end of file
diff --git a/paloalto/template/f451f8b7-cf3d-423b-95c6-3738852bd9ea.query b/paloalto/template/f451f8b7-cf3d-423b-95c6-3738852bd9ea.query
deleted file mode 100644
index 77c81f17..00000000
--- a/paloalto/template/f451f8b7-cf3d-423b-95c6-3738852bd9ea.query
+++ /dev/null
@@ -1,3 +0,0 @@
-tag=$PAN_GLOBALPROTECT ax private_ip=="%%IP%%" srcuser machinename | alias srcuser User machinename Machine private_ip "GlobalProtect IP"
-| unique "GlobalProtect IP" User Machine
-| table "GlobalProtect IP" User Machine
\ No newline at end of file