From bee814787f7fa643dad134930ede37e9f3828309 Mon Sep 17 00:00:00 2001 From: Chelsea Wright Date: Thu, 2 Jul 2026 15:50:54 +0200 Subject: [PATCH 1/4] feat(data_library): add full-width PAN-OS TRAFFIC CSV sample Adds a full-width (64-field) PAN-OS 10.x TRAFFIC log to data_library/palo-alto/ so the Bindplane Palo Alto traffic parsing blueprint can be verified end-to-end. The existing palo-alto CSV samples (auth_failure.log, config_change.log) are abbreviated and fail strict CSV parsing against the full field header. --- .../filegen/embeddedlibrary/data_library/palo-alto/traffic.log | 1 + 1 file changed, 1 insertion(+) create mode 100644 generator/filegen/embeddedlibrary/data_library/palo-alto/traffic.log diff --git a/generator/filegen/embeddedlibrary/data_library/palo-alto/traffic.log b/generator/filegen/embeddedlibrary/data_library/palo-alto/traffic.log new file mode 100644 index 0000000..c59de37 --- /dev/null +++ b/generator/filegen/embeddedlibrary/data_library/palo-alto/traffic.log @@ -0,0 +1 @@ +%b %e %T localhost 1,%Y/%m/%d %H:%M:%S,001901000123,TRAFFIC,end,,%Y/%m/%d %H:%M:%S,203.0.113.5,198.51.100.10,203.0.113.5,198.51.100.10,corp\alice,,ssl,vsys1,trust,untrust,ethernet1/1,ethernet1/2,default,,100234,1,52014,443,52014,443,0x400053,tcp,deny,1024,512,512,8,%Y/%m/%d %H:%M:%S,5,any,,7000000123456789,0x8000000000000000,United States,United States,,4,4,policy-deny,0,0,0,0,,PA-VM,from-policy,,,0,,0,,N/A,0,0,0,0 From c8b81e6f90e7a717bbf6a4349ace0113b2ddc13d Mon Sep 17 00:00:00 2001 From: Chelsea Wright Date: Fri, 3 Jul 2026 09:48:16 +0200 Subject: [PATCH 2/4] refactor(data_library): group full-width PAN-OS CSV samples under palo-alto/csv; add THREAT Move traffic.log into palo-alto/csv/ (native full-width CSV, distinct from the existing LEEF samples) and add csv/threat.log (79-field PAN-OS THREAT record). --- .../embeddedlibrary/data_library/palo-alto/csv/threat.log | 1 + .../embeddedlibrary/data_library/palo-alto/{ => csv}/traffic.log | 0 2 files changed, 1 insertion(+) create mode 100644 generator/filegen/embeddedlibrary/data_library/palo-alto/csv/threat.log rename generator/filegen/embeddedlibrary/data_library/palo-alto/{ => csv}/traffic.log (100%) diff --git a/generator/filegen/embeddedlibrary/data_library/palo-alto/csv/threat.log b/generator/filegen/embeddedlibrary/data_library/palo-alto/csv/threat.log new file mode 100644 index 0000000..065ed03 --- /dev/null +++ b/generator/filegen/embeddedlibrary/data_library/palo-alto/csv/threat.log @@ -0,0 +1 @@ +%b %e %T localhost 1,%Y/%m/%d %H:%M:%S,001901000123,THREAT,spyware,,%Y/%m/%d %H:%M:%S,203.0.113.88,198.51.100.10,203.0.113.88,198.51.100.10,Outbound-Web,corp\bob,,web-browsing,vsys1,untrust,trust,ethernet1/2,ethernet1/1,default,,200345,1,44321,443,44321,443,0x400000,tcp,alert,malicious.example.com/c2,C2 Traffic Detection(300123),command-and-control,high,client-to-server,7000000987654321,0x8000000000000000,United States,United States,,,0,,,0,Mozilla/5.0,,,,,,,0,0,0,0,0,,PA-VM,,,,get,0,,0,,N/A,spyware,AppThreat-8888-1234,,0,0,,command-and-control,abcdef01-2345-6789-abcd-ef0123456789,0, diff --git a/generator/filegen/embeddedlibrary/data_library/palo-alto/traffic.log b/generator/filegen/embeddedlibrary/data_library/palo-alto/csv/traffic.log similarity index 100% rename from generator/filegen/embeddedlibrary/data_library/palo-alto/traffic.log rename to generator/filegen/embeddedlibrary/data_library/palo-alto/csv/traffic.log From 7f3dd1a981a08d6a9ccbbab2110f5996e697cd1c Mon Sep 17 00:00:00 2001 From: Chelsea Wright Date: Fri, 3 Jul 2026 10:32:52 +0200 Subject: [PATCH 3/4] feat(data_library): add 11 more full-width PAN-OS CSV samples Adds SYSTEM, CONFIG, HIP-MATCH, AUTHENTICATION, CORRELATION, DECRYPTION, GLOBALPROTECT, GTP, IPTAG, SCTP, and USERID full-width PAN-OS 10.x CSV records under palo-alto/csv/, each matching the corresponding PAN-OS field header exactly (so strict CSV parsing succeeds). Realistic, generic values (no customer data). Used to verify the Bindplane Palo Alto full log parsing blueprint end-to-end. --- .../data_library/palo-alto/csv/authentication.log | 1 + .../embeddedlibrary/data_library/palo-alto/csv/config.log | 1 + .../embeddedlibrary/data_library/palo-alto/csv/correlation.log | 1 + .../embeddedlibrary/data_library/palo-alto/csv/decryption.log | 1 + .../embeddedlibrary/data_library/palo-alto/csv/globalprotect.log | 1 + .../filegen/embeddedlibrary/data_library/palo-alto/csv/gtp.log | 1 + .../embeddedlibrary/data_library/palo-alto/csv/hipmatch.log | 1 + .../filegen/embeddedlibrary/data_library/palo-alto/csv/iptag.log | 1 + .../filegen/embeddedlibrary/data_library/palo-alto/csv/sctp.log | 1 + .../embeddedlibrary/data_library/palo-alto/csv/system.log | 1 + .../embeddedlibrary/data_library/palo-alto/csv/userid.log | 1 + 11 files changed, 11 insertions(+) create mode 100644 generator/filegen/embeddedlibrary/data_library/palo-alto/csv/authentication.log create mode 100644 generator/filegen/embeddedlibrary/data_library/palo-alto/csv/config.log create mode 100644 generator/filegen/embeddedlibrary/data_library/palo-alto/csv/correlation.log create mode 100644 generator/filegen/embeddedlibrary/data_library/palo-alto/csv/decryption.log create mode 100644 generator/filegen/embeddedlibrary/data_library/palo-alto/csv/globalprotect.log create mode 100644 generator/filegen/embeddedlibrary/data_library/palo-alto/csv/gtp.log create mode 100644 generator/filegen/embeddedlibrary/data_library/palo-alto/csv/hipmatch.log create mode 100644 generator/filegen/embeddedlibrary/data_library/palo-alto/csv/iptag.log create mode 100644 generator/filegen/embeddedlibrary/data_library/palo-alto/csv/sctp.log create mode 100644 generator/filegen/embeddedlibrary/data_library/palo-alto/csv/system.log create mode 100644 generator/filegen/embeddedlibrary/data_library/palo-alto/csv/userid.log diff --git a/generator/filegen/embeddedlibrary/data_library/palo-alto/csv/authentication.log b/generator/filegen/embeddedlibrary/data_library/palo-alto/csv/authentication.log new file mode 100644 index 0000000..46ae2c7 --- /dev/null +++ b/generator/filegen/embeddedlibrary/data_library/palo-alto/csv/authentication.log @@ -0,0 +1 @@ +%b %e %T localhost 1,%Y/%m/%d %H:%M:%S,001901000123,AUTHENTICATION,auth,,%Y/%m/%d %H:%M:%S,vsys1,203.0.113.20,corp\alice,alice,GlobalProtect,GP-Auth,1,,PAN-OS,default,LDAP,authentication succeeded,GlobalProtect,auth-success,1,7000000000000001,0x0,0,0,0,0,,PA-VM,vsys1,LDAP,,%Y/%m/%d %H:%M:%S,,,,,,,LAPTOP-ALICE,,,,,, diff --git a/generator/filegen/embeddedlibrary/data_library/palo-alto/csv/config.log b/generator/filegen/embeddedlibrary/data_library/palo-alto/csv/config.log new file mode 100644 index 0000000..d44a9c9 --- /dev/null +++ b/generator/filegen/embeddedlibrary/data_library/palo-alto/csv/config.log @@ -0,0 +1 @@ +%b %e %T localhost 1,%Y/%m/%d %H:%M:%S,001901000123,CONFIG,0,,%Y/%m/%d %H:%M:%S,10.0.0.9,vsys1,set,admin,Web,Succeeded,deviceconfig system,,,7000000000000001,0x0,0,0,0,0,,PA-VM,,,,%Y/%m/%d %H:%M:%S diff --git a/generator/filegen/embeddedlibrary/data_library/palo-alto/csv/correlation.log b/generator/filegen/embeddedlibrary/data_library/palo-alto/csv/correlation.log new file mode 100644 index 0000000..af009e2 --- /dev/null +++ b/generator/filegen/embeddedlibrary/data_library/palo-alto/csv/correlation.log @@ -0,0 +1 @@ +%b %e %T localhost 1,%Y/%m/%d %H:%M:%S,001901000123,CORRELATION,correlation,,%Y/%m/%d %H:%M:%S,203.0.113.20,vsys1,compromised-host,high,0,0,0,0,,PA-VM,vsys1,Compromised Host,6001,Host visited known malware URL and beaconed to C2 diff --git a/generator/filegen/embeddedlibrary/data_library/palo-alto/csv/decryption.log b/generator/filegen/embeddedlibrary/data_library/palo-alto/csv/decryption.log new file mode 100644 index 0000000..e55036a --- /dev/null +++ b/generator/filegen/embeddedlibrary/data_library/palo-alto/csv/decryption.log @@ -0,0 +1 @@ +%b %e %T localhost 1,%Y/%m/%d %H:%M:%S,001901000123,DECRYPTION,decryption,10.2.3,%Y/%m/%d %H:%M:%S,203.0.113.20,198.51.100.30,203.0.113.20,198.51.100.30,Decrypt-Outbound,corp\svc,,ssl,vsys1,trust,untrust,ethernet1/1,ethernet1/2,default,%Y/%m/%d %H:%M:%S,,1,0,0,0,0,,,decrypt,,,,,,,,,TLS1.2,ECDHE,AES-256-GCM,SHA384,Decrypt-Outbound,,,,,,,,,,,,,,,,,example.com,,,example.com,,,,,,,,,,,,,,,,,,,,,,,,,,7000000000000001,0x0,0,0,0,0,,PA-VM,vsys1,,,,,,,,, diff --git a/generator/filegen/embeddedlibrary/data_library/palo-alto/csv/globalprotect.log b/generator/filegen/embeddedlibrary/data_library/palo-alto/csv/globalprotect.log new file mode 100644 index 0000000..9680fb5 --- /dev/null +++ b/generator/filegen/embeddedlibrary/data_library/palo-alto/csv/globalprotect.log @@ -0,0 +1 @@ +%b %e %T localhost 1,%Y/%m/%d %H:%M:%S,001901000123,GLOBALPROTECT,globalprotect,,%Y/%m/%d %H:%M:%S,vsys1,gateway-auth,login,LDAP,IPSec,corp\alice,US,LAPTOP-ALICE,203.0.113.20,,10.10.10.5,,,001901000123,6.1.0,Windows,,1,,,,success,gateway-us,,,,gp.example.com,7000000000000001,0x0,,,,,,,0,0,0,0,,PA-VM,vsys1, diff --git a/generator/filegen/embeddedlibrary/data_library/palo-alto/csv/gtp.log b/generator/filegen/embeddedlibrary/data_library/palo-alto/csv/gtp.log new file mode 100644 index 0000000..4ca3797 --- /dev/null +++ b/generator/filegen/embeddedlibrary/data_library/palo-alto/csv/gtp.log @@ -0,0 +1 @@ +%b %e %T localhost 1,%Y/%m/%d %H:%M:%S,001901000123,GTP,gtp,,%Y/%m/%d %H:%M:%S,203.0.113.20,198.51.100.30,,,GTP-Inspect,,,gtp,vsys1,trust,untrust,ethernet1/1,ethernet1/2,default,,,,0,0,,,,,deny,create-session,,,,32,10.20.30.40,,,S11,16,low,,,,,,,,United States,United States,,,,,,,,,,,,,,,,,,,,,,,,,,%Y/%m/%d %H:%M:%S,,,,,,,%Y/%m/%d %H:%M:%S,,,,,,,,,, diff --git a/generator/filegen/embeddedlibrary/data_library/palo-alto/csv/hipmatch.log b/generator/filegen/embeddedlibrary/data_library/palo-alto/csv/hipmatch.log new file mode 100644 index 0000000..0cba2a4 --- /dev/null +++ b/generator/filegen/embeddedlibrary/data_library/palo-alto/csv/hipmatch.log @@ -0,0 +1 @@ +%b %e %T localhost 1,%Y/%m/%d %H:%M:%S,001901000123,HIP-MATCH,hipmatch,,%Y/%m/%d %H:%M:%S,corp\alice,vsys1,LAPTOP-ALICE,Windows 10,203.0.113.20,corp-managed,1,object,,,7000000000000001,0x0,0,0,0,0,,PA-VM,vsys1,,host-abc-123,,,%Y/%m/%d %H:%M:%S, diff --git a/generator/filegen/embeddedlibrary/data_library/palo-alto/csv/iptag.log b/generator/filegen/embeddedlibrary/data_library/palo-alto/csv/iptag.log new file mode 100644 index 0000000..1cc9f91 --- /dev/null +++ b/generator/filegen/embeddedlibrary/data_library/palo-alto/csv/iptag.log @@ -0,0 +1 @@ +%b %e %T localhost 1,%Y/%m/%d %H:%M:%S,001901000123,IPTAG,iptag,,%Y/%m/%d %H:%M:%S,vsys1,203.0.113.20,malicious-host,register,1,3600,XSOAR,extension,dynamic,7000000000000001,0x0,0,0,0,0,,PA-VM,vsys1,%Y/%m/%d %H:%M:%S, diff --git a/generator/filegen/embeddedlibrary/data_library/palo-alto/csv/sctp.log b/generator/filegen/embeddedlibrary/data_library/palo-alto/csv/sctp.log new file mode 100644 index 0000000..b565bf2 --- /dev/null +++ b/generator/filegen/embeddedlibrary/data_library/palo-alto/csv/sctp.log @@ -0,0 +1 @@ +%b %e %T localhost 1,%Y/%m/%d %H:%M:%S,001901000123,SCTP,,,%Y/%m/%d %H:%M:%S,203.0.113.20,198.51.100.30,,,SCTP-Policy,,,,vsys1,trust,untrust,ethernet1/1,ethernet1/2,default,,,1,0,0,,,,,sctp,deny,0,0,0,0,,PA-VM,7000000000000001,,5001,,low,data,,,,,,,,,,,,,,,,,,,,,%Y/%m/%d %H:%M:%S diff --git a/generator/filegen/embeddedlibrary/data_library/palo-alto/csv/system.log b/generator/filegen/embeddedlibrary/data_library/palo-alto/csv/system.log new file mode 100644 index 0000000..e6c4b2c --- /dev/null +++ b/generator/filegen/embeddedlibrary/data_library/palo-alto/csv/system.log @@ -0,0 +1 @@ +%b %e %T localhost 1,%Y/%m/%d %H:%M:%S,001901000123,SYSTEM,general,,%Y/%m/%d %H:%M:%S,vsys1,general,,,,general,medium,System resource utilization warning: CPU at 85%,7000000000000001,0x0,0,0,0,0,,PA-VM,,,%Y/%m/%d %H:%M:%S diff --git a/generator/filegen/embeddedlibrary/data_library/palo-alto/csv/userid.log b/generator/filegen/embeddedlibrary/data_library/palo-alto/csv/userid.log new file mode 100644 index 0000000..64a47bb --- /dev/null +++ b/generator/filegen/embeddedlibrary/data_library/palo-alto/csv/userid.log @@ -0,0 +1 @@ +%b %e %T localhost 1,%Y/%m/%d %H:%M:%S,001901000123,USERID,userid,,%Y/%m/%d %H:%M:%S,vsys1,203.0.113.20,corp\alice,GP,login,1,3600,0,0,vpn-client,unknown,7000000000000001,0x0,0,0,0,0,,PA-VM,vsys1,,,,,,,%Y/%m/%d %H:%M:%S,,, From c09f48478d90f5183e04e69722e1d3317f08fdf3 Mon Sep 17 00:00:00 2001 From: Chelsea Wright Date: Sun, 5 Jul 2026 18:45:08 +0200 Subject: [PATCH 4/4] feat(data_library): add PAN-OS auth-failure CSV records Add a SYSTEM auth-fail and a GLOBALPROTECT gateway-auth failure record so the enrich-palo-alto-security-events blueprint's brute-force detection paths (admin_bruteforce T1110, vpn_bruteforce T1110) have realistic sample inputs. --- .../embeddedlibrary/data_library/palo-alto/csv/globalprotect.log | 1 + .../embeddedlibrary/data_library/palo-alto/csv/system.log | 1 + 2 files changed, 2 insertions(+) diff --git a/generator/filegen/embeddedlibrary/data_library/palo-alto/csv/globalprotect.log b/generator/filegen/embeddedlibrary/data_library/palo-alto/csv/globalprotect.log index 9680fb5..442b83a 100644 --- a/generator/filegen/embeddedlibrary/data_library/palo-alto/csv/globalprotect.log +++ b/generator/filegen/embeddedlibrary/data_library/palo-alto/csv/globalprotect.log @@ -1 +1,2 @@ %b %e %T localhost 1,%Y/%m/%d %H:%M:%S,001901000123,GLOBALPROTECT,globalprotect,,%Y/%m/%d %H:%M:%S,vsys1,gateway-auth,login,LDAP,IPSec,corp\alice,US,LAPTOP-ALICE,203.0.113.20,,10.10.10.5,,,001901000123,6.1.0,Windows,,1,,,,success,gateway-us,,,,gp.example.com,7000000000000001,0x0,,,,,,,0,0,0,0,,PA-VM,vsys1, +%b %e %T localhost 1,%Y/%m/%d %H:%M:%S,001901000123,GLOBALPROTECT,globalprotect,,%Y/%m/%d %H:%M:%S,vsys1,gateway-auth,login,LDAP,IPSec,corp\alice,US,LAPTOP-ALICE,203.0.113.20,,10.10.10.5,,,001901000123,6.1.0,Windows,,1,Invalid username or password,,,failure,gateway-us,,,,gp.example.com,7000000000000001,0x0,,,,,,,0,0,0,0,,PA-VM,vsys1, diff --git a/generator/filegen/embeddedlibrary/data_library/palo-alto/csv/system.log b/generator/filegen/embeddedlibrary/data_library/palo-alto/csv/system.log index e6c4b2c..9be1985 100644 --- a/generator/filegen/embeddedlibrary/data_library/palo-alto/csv/system.log +++ b/generator/filegen/embeddedlibrary/data_library/palo-alto/csv/system.log @@ -1 +1,2 @@ %b %e %T localhost 1,%Y/%m/%d %H:%M:%S,001901000123,SYSTEM,general,,%Y/%m/%d %H:%M:%S,vsys1,general,,,,general,medium,System resource utilization warning: CPU at 85%,7000000000000001,0x0,0,0,0,0,,PA-VM,,,%Y/%m/%d %H:%M:%S +%b %e %T localhost 1,%Y/%m/%d %H:%M:%S,001901000123,SYSTEM,auth,,%Y/%m/%d %H:%M:%S,vsys1,auth-fail,,,,general,high,failed authentication for user admin,7000000000000001,0x0,0,0,0,0,,PA-VM,,,%Y/%m/%d %H:%M:%S