Palo Alto Network Firewall

PaloAltoNetworkFirewallCompiledNormalizer  now normalises logs from the actively supported PAN-OS versions 10.2, 11.1, 11.2, and 12.1.2. It handles version- and patch-specific field differences, optional internal-use fields, and varying field counts for Threat, Config, System, HIP Match, Correlation, User-ID, Tunnel Inspection, Authentication, GTP, and SCTP logs.

PaloAltoNetworkFirewallCompiledNormalizer  now normalises the TCP telemetry fields in Traffic logs, so you can search and analyse device telemetry data. 

PaloAltoCEFCompiledNormalizer  now parses the details in the message field of CEF System authentication logs into separate fields: authentication_profile , authentication_protocol , virtual_system , server_profile , and destination_address . It also adds the Fail and Authentication labels, so you can correlate failed authentication events.

PaloAltoCEFCompiledNormalizer did not apply the timezone in the rt  field, so log_ts  was populated with an incorrect time.

PaloAltoNetworkFirewallCompiledNormalizer could populate log_ts with an incorrect time when logs with the same timestamp from devices in different time zones were processed at the same time. The data types of several fields were also updated as part of this fix; review any content that depends on field types.

PaloAltoCEFCompiledNormalizer  did not normalise GlobalProtect logs. The fix adds field mappings for GlobalProtect and other CEF fields, and renames requestcontext  to request_context , action_flags  to action_flag , and process_id  to process . After upgrading, update any searches, alerts, and dashboards that use the previous field names.

PaloAltoCEFCompiledNormalizer  normalised only the first line of multiline CEF logs, such as those sent over TCP syslog with octet-counted framing, so the remaining fields were not normalised.