Palo Alto PA Series

Use the IBM® QRadar® Palo Alto PA Series Content Extension for Palo Alto PA Series Firewall.

Important: To avoid content errors in this content extension, keep the associated DSMs up to date. DSMs are updated as part of the automatic updates. If automatic updates are not enabled, download the most recent version of the associated DSMs from IBM Fix Central (https://www.ibm.com/support/fixcentral).

IBM Security QRadar Palo Alto PA Series Content Extensions

IBM Security QRadar Palo Alto PA Series Content Extension 1.1.1

The following table shows the changed custom properties in IBM Security QRadar Palo Alto PA Series Content Extension 1.1.1.

Table 1. Custom Properties in IBM Security QRadar Palo Alto PA Series Content Extension 1.1.1
Name Optimized Capture Group Regex
URL Yes 1 The \|subtype=url\|.*?\|Miscellaneous="(.*?)(?:"|$) is now \|[sS]ubtype=url\|.*?\|Miscellaneous="(.*?)(?:"|$)

Duplicated expressions IDs were updated to make them unique in the Rule Name and Web Category custom properties.

IBM Security QRadar Palo Alto PA Series Content Extension 1.1.0

The following table shows the changed custom properties in IBM Security QRadar Palo Alto PA Series Content Extension 1.1.0.

Table 2. Custom Properties in IBM Security QRadar Palo Alto PA Series Content Extension 1.1.0
Name Optimized Capture Group Regex
BytesReceived Yes 1 dstBytes=([^|]+)
BytesSent Yes 1 srcBytes=([^|]+)
Device Name No 1 DeviceName=([^|]+)
Packets Received No 1 dstPackets=([^|]+)
Packets Sent No 1 srcPackets=([^|]+)

IBM Security QRadar Palo Alto PA Series Content Extension 1.0.2

All custom property descriptions were updated, and changes were made to allow custom properties to be translated.

The Object Category and Rulename custom properties were renamed and assigned new IDs. Object Category is now Web Category. Rulename is now Rule Name. Delete any existing Object Category and Rulename custom properties before you upgrade to 1.0.2.

The following table shows the changed custom properties in IBM Security QRadar Palo Alto PA Series Content Extension 1.0.2.

Table 3. Custom Properties in IBM Security QRadar Palo Alto PA Series Content Extension 1.0.2
Name Optimized Capture Group Regex
Application Yes 1 Application=([^|]+)
Bytes No 1 totalBytes=(\d+)
BytesReceived Yes 1 BytesIn=([^|]+)
BytesSent Yes 1 BytesOut=([^|]+)
Criticality Rating No 1 sev=([^|]+)
Destination Zone No 1 DestinationZone=([^|]+)
Elapsed Time No 1 ElapsedTime=([^|]+)
Object type(s) Yes 1 Subtype=([^|]+)
Packets No 1 Packets=([^|]+)
Rule Name Yes 1 RuleName=([^|]+)
Source Zone No 1 SourceZone=([^|]+)
Web Category Yes 1 URLCategory=([^|]+)

(Back to top)

IBM Security QRadar Palo Alto PA Series Content Extension 1.0.1

The following table shows the changed custom properties in IBM Security QRadar Palo Alto PA Series Content Extension 1.0.1.

Table 4. Changed Custom Properties in IBM Security QRadar FPalo Alto PA Series Content Extension 1.0.1
Name Optimized
Application No
BytesReceived No
BytesSent Yes
Filename Yes
Object type(s) Yes
URL Yes

(Back to top)

IBM Security QRadar Palo Alto PA Series Content Extension 1.0.0

The following table shows the custom properties in IBM Security QRadar Palo Alto PA Series Content Extension 1.0.0.

Table 5. Changed Custom Properties in IBM Security QRadar FPalo Alto PA Series Content Extension 1.0.1
Name Regex
Application Application=([^|]+)
Bytes Bytes=([^|]+)
Bytes Received BytesIn=([^|]+)
Bytes Sent BytesOut=([^|]+)
Content Type ContentType=([^|]+)
Criticality Rating sev=([^|]+)
Destination Zone DestinationZone=([^|]+)
Elapsed Time ElapsedTime=([^|]+)
Filename Filename=([^|]+)
Object Category URLCategory=([^|]+)
Object Name \|Miscellaneous="(.*?)(?:"|$)
Object type(s) Subtype=([^|]+)
Packets Packets=([^|]+)
Rule Name RuleName=([^|]+)
Source Zone SourceZone=([^|]+)
URL \|subtype=url\|.*?\|Miscellaneous="(.*?)(?:"|$)

(Back to top)