diff --git a/generator/filegen/embeddedlibrary/data_library/palo-alto/csv/authentication.log b/generator/filegen/embeddedlibrary/data_library/palo-alto/csv/authentication.log new file mode 100644 index 0000000..46ae2c7 --- /dev/null +++ b/generator/filegen/embeddedlibrary/data_library/palo-alto/csv/authentication.log @@ -0,0 +1 @@ +%b %e %T localhost 1,%Y/%m/%d %H:%M:%S,001901000123,AUTHENTICATION,auth,,%Y/%m/%d %H:%M:%S,vsys1,203.0.113.20,corp\alice,alice,GlobalProtect,GP-Auth,1,,PAN-OS,default,LDAP,authentication succeeded,GlobalProtect,auth-success,1,7000000000000001,0x0,0,0,0,0,,PA-VM,vsys1,LDAP,,%Y/%m/%d %H:%M:%S,,,,,,,LAPTOP-ALICE,,,,,, diff --git a/generator/filegen/embeddedlibrary/data_library/palo-alto/csv/config.log b/generator/filegen/embeddedlibrary/data_library/palo-alto/csv/config.log new file mode 100644 index 0000000..d44a9c9 --- /dev/null +++ b/generator/filegen/embeddedlibrary/data_library/palo-alto/csv/config.log @@ -0,0 +1 @@ +%b %e %T localhost 1,%Y/%m/%d %H:%M:%S,001901000123,CONFIG,0,,%Y/%m/%d %H:%M:%S,10.0.0.9,vsys1,set,admin,Web,Succeeded,deviceconfig system,,,7000000000000001,0x0,0,0,0,0,,PA-VM,,,,%Y/%m/%d %H:%M:%S diff --git a/generator/filegen/embeddedlibrary/data_library/palo-alto/csv/correlation.log b/generator/filegen/embeddedlibrary/data_library/palo-alto/csv/correlation.log new file mode 100644 index 0000000..af009e2 --- /dev/null +++ b/generator/filegen/embeddedlibrary/data_library/palo-alto/csv/correlation.log @@ -0,0 +1 @@ +%b %e %T localhost 1,%Y/%m/%d %H:%M:%S,001901000123,CORRELATION,correlation,,%Y/%m/%d %H:%M:%S,203.0.113.20,vsys1,compromised-host,high,0,0,0,0,,PA-VM,vsys1,Compromised Host,6001,Host visited known malware URL and beaconed to C2 diff --git a/generator/filegen/embeddedlibrary/data_library/palo-alto/csv/decryption.log b/generator/filegen/embeddedlibrary/data_library/palo-alto/csv/decryption.log new file mode 100644 index 0000000..e55036a --- /dev/null +++ b/generator/filegen/embeddedlibrary/data_library/palo-alto/csv/decryption.log @@ -0,0 +1 @@ +%b %e %T localhost 1,%Y/%m/%d %H:%M:%S,001901000123,DECRYPTION,decryption,10.2.3,%Y/%m/%d %H:%M:%S,203.0.113.20,198.51.100.30,203.0.113.20,198.51.100.30,Decrypt-Outbound,corp\svc,,ssl,vsys1,trust,untrust,ethernet1/1,ethernet1/2,default,%Y/%m/%d %H:%M:%S,,1,0,0,0,0,,,decrypt,,,,,,,,,TLS1.2,ECDHE,AES-256-GCM,SHA384,Decrypt-Outbound,,,,,,,,,,,,,,,,,example.com,,,example.com,,,,,,,,,,,,,,,,,,,,,,,,,,7000000000000001,0x0,0,0,0,0,,PA-VM,vsys1,,,,,,,,, diff --git a/generator/filegen/embeddedlibrary/data_library/palo-alto/csv/globalprotect.log b/generator/filegen/embeddedlibrary/data_library/palo-alto/csv/globalprotect.log new file mode 100644 index 0000000..442b83a --- /dev/null +++ b/generator/filegen/embeddedlibrary/data_library/palo-alto/csv/globalprotect.log @@ -0,0 +1,2 @@ +%b %e %T localhost 1,%Y/%m/%d %H:%M:%S,001901000123,GLOBALPROTECT,globalprotect,,%Y/%m/%d %H:%M:%S,vsys1,gateway-auth,login,LDAP,IPSec,corp\alice,US,LAPTOP-ALICE,203.0.113.20,,10.10.10.5,,,001901000123,6.1.0,Windows,,1,,,,success,gateway-us,,,,gp.example.com,7000000000000001,0x0,,,,,,,0,0,0,0,,PA-VM,vsys1, +%b %e %T localhost 1,%Y/%m/%d %H:%M:%S,001901000123,GLOBALPROTECT,globalprotect,,%Y/%m/%d %H:%M:%S,vsys1,gateway-auth,login,LDAP,IPSec,corp\alice,US,LAPTOP-ALICE,203.0.113.20,,10.10.10.5,,,001901000123,6.1.0,Windows,,1,Invalid username or password,,,failure,gateway-us,,,,gp.example.com,7000000000000001,0x0,,,,,,,0,0,0,0,,PA-VM,vsys1, diff --git a/generator/filegen/embeddedlibrary/data_library/palo-alto/csv/gtp.log b/generator/filegen/embeddedlibrary/data_library/palo-alto/csv/gtp.log new file mode 100644 index 0000000..4ca3797 --- /dev/null +++ b/generator/filegen/embeddedlibrary/data_library/palo-alto/csv/gtp.log @@ -0,0 +1 @@ +%b %e %T localhost 1,%Y/%m/%d %H:%M:%S,001901000123,GTP,gtp,,%Y/%m/%d %H:%M:%S,203.0.113.20,198.51.100.30,,,GTP-Inspect,,,gtp,vsys1,trust,untrust,ethernet1/1,ethernet1/2,default,,,,0,0,,,,,deny,create-session,,,,32,10.20.30.40,,,S11,16,low,,,,,,,,United States,United States,,,,,,,,,,,,,,,,,,,,,,,,,,%Y/%m/%d %H:%M:%S,,,,,,,%Y/%m/%d %H:%M:%S,,,,,,,,,, diff --git a/generator/filegen/embeddedlibrary/data_library/palo-alto/csv/hipmatch.log b/generator/filegen/embeddedlibrary/data_library/palo-alto/csv/hipmatch.log new file mode 100644 index 0000000..0cba2a4 --- /dev/null +++ b/generator/filegen/embeddedlibrary/data_library/palo-alto/csv/hipmatch.log @@ -0,0 +1 @@ +%b %e %T localhost 1,%Y/%m/%d %H:%M:%S,001901000123,HIP-MATCH,hipmatch,,%Y/%m/%d %H:%M:%S,corp\alice,vsys1,LAPTOP-ALICE,Windows 10,203.0.113.20,corp-managed,1,object,,,7000000000000001,0x0,0,0,0,0,,PA-VM,vsys1,,host-abc-123,,,%Y/%m/%d %H:%M:%S, diff --git a/generator/filegen/embeddedlibrary/data_library/palo-alto/csv/iptag.log b/generator/filegen/embeddedlibrary/data_library/palo-alto/csv/iptag.log new file mode 100644 index 0000000..1cc9f91 --- /dev/null +++ b/generator/filegen/embeddedlibrary/data_library/palo-alto/csv/iptag.log @@ -0,0 +1 @@ +%b %e %T localhost 1,%Y/%m/%d %H:%M:%S,001901000123,IPTAG,iptag,,%Y/%m/%d %H:%M:%S,vsys1,203.0.113.20,malicious-host,register,1,3600,XSOAR,extension,dynamic,7000000000000001,0x0,0,0,0,0,,PA-VM,vsys1,%Y/%m/%d %H:%M:%S, diff --git a/generator/filegen/embeddedlibrary/data_library/palo-alto/csv/sctp.log b/generator/filegen/embeddedlibrary/data_library/palo-alto/csv/sctp.log new file mode 100644 index 0000000..b565bf2 --- /dev/null +++ b/generator/filegen/embeddedlibrary/data_library/palo-alto/csv/sctp.log @@ -0,0 +1 @@ +%b %e %T localhost 1,%Y/%m/%d %H:%M:%S,001901000123,SCTP,,,%Y/%m/%d %H:%M:%S,203.0.113.20,198.51.100.30,,,SCTP-Policy,,,,vsys1,trust,untrust,ethernet1/1,ethernet1/2,default,,,1,0,0,,,,,sctp,deny,0,0,0,0,,PA-VM,7000000000000001,,5001,,low,data,,,,,,,,,,,,,,,,,,,,,%Y/%m/%d %H:%M:%S diff --git a/generator/filegen/embeddedlibrary/data_library/palo-alto/csv/system.log b/generator/filegen/embeddedlibrary/data_library/palo-alto/csv/system.log new file mode 100644 index 0000000..9be1985 --- /dev/null +++ b/generator/filegen/embeddedlibrary/data_library/palo-alto/csv/system.log @@ -0,0 +1,2 @@ +%b %e %T localhost 1,%Y/%m/%d %H:%M:%S,001901000123,SYSTEM,general,,%Y/%m/%d %H:%M:%S,vsys1,general,,,,general,medium,System resource utilization warning: CPU at 85%,7000000000000001,0x0,0,0,0,0,,PA-VM,,,%Y/%m/%d %H:%M:%S +%b %e %T localhost 1,%Y/%m/%d %H:%M:%S,001901000123,SYSTEM,auth,,%Y/%m/%d %H:%M:%S,vsys1,auth-fail,,,,general,high,failed authentication for user admin,7000000000000001,0x0,0,0,0,0,,PA-VM,,,%Y/%m/%d %H:%M:%S diff --git a/generator/filegen/embeddedlibrary/data_library/palo-alto/csv/threat.log b/generator/filegen/embeddedlibrary/data_library/palo-alto/csv/threat.log new file mode 100644 index 0000000..065ed03 --- /dev/null +++ b/generator/filegen/embeddedlibrary/data_library/palo-alto/csv/threat.log @@ -0,0 +1 @@ +%b %e %T localhost 1,%Y/%m/%d %H:%M:%S,001901000123,THREAT,spyware,,%Y/%m/%d %H:%M:%S,203.0.113.88,198.51.100.10,203.0.113.88,198.51.100.10,Outbound-Web,corp\bob,,web-browsing,vsys1,untrust,trust,ethernet1/2,ethernet1/1,default,,200345,1,44321,443,44321,443,0x400000,tcp,alert,malicious.example.com/c2,C2 Traffic Detection(300123),command-and-control,high,client-to-server,7000000987654321,0x8000000000000000,United States,United States,,,0,,,0,Mozilla/5.0,,,,,,,0,0,0,0,0,,PA-VM,,,,get,0,,0,,N/A,spyware,AppThreat-8888-1234,,0,0,,command-and-control,abcdef01-2345-6789-abcd-ef0123456789,0, diff --git a/generator/filegen/embeddedlibrary/data_library/palo-alto/csv/traffic.log b/generator/filegen/embeddedlibrary/data_library/palo-alto/csv/traffic.log new file mode 100644 index 0000000..c59de37 --- /dev/null +++ b/generator/filegen/embeddedlibrary/data_library/palo-alto/csv/traffic.log @@ -0,0 +1 @@ +%b %e %T localhost 1,%Y/%m/%d %H:%M:%S,001901000123,TRAFFIC,end,,%Y/%m/%d %H:%M:%S,203.0.113.5,198.51.100.10,203.0.113.5,198.51.100.10,corp\alice,,ssl,vsys1,trust,untrust,ethernet1/1,ethernet1/2,default,,100234,1,52014,443,52014,443,0x400053,tcp,deny,1024,512,512,8,%Y/%m/%d %H:%M:%S,5,any,,7000000123456789,0x8000000000000000,United States,United States,,4,4,policy-deny,0,0,0,0,,PA-VM,from-policy,,,0,,0,,N/A,0,0,0,0 diff --git a/generator/filegen/embeddedlibrary/data_library/palo-alto/csv/userid.log b/generator/filegen/embeddedlibrary/data_library/palo-alto/csv/userid.log new file mode 100644 index 0000000..64a47bb --- /dev/null +++ b/generator/filegen/embeddedlibrary/data_library/palo-alto/csv/userid.log @@ -0,0 +1 @@ +%b %e %T localhost 1,%Y/%m/%d %H:%M:%S,001901000123,USERID,userid,,%Y/%m/%d %H:%M:%S,vsys1,203.0.113.20,corp\alice,GP,login,1,3600,0,0,vpn-client,unknown,7000000000000001,0x0,0,0,0,0,,PA-VM,vsys1,,,,,,,%Y/%m/%d %H:%M:%S,,,