Palo Alto Serializer

The Palo Alto Serializer in Observo AI allows you to serialize a palo_alto log event in format appropriate for a destination (currently Splunk).

Purpose

The purpose of a Palo Alto Serializer is to convert raw Palo Alto log data into structured formats like JSON, making it compatible with SIEM and log management systems. This serialization process normalizes various log types, such as traffic, threat, and URL logs, enabling more efficient analysis and correlation of security events. By preserving critical metadata and context from the original logs, the serializer enhances visibility and incident response capabilities for security teams.

Usage

Select Palo Alto Serializer transform. Add Name (required) and Description (optional).

General Configuration:

• Bypass Transform: Defaults to disable. When enabled, this transform will be bypassed entirely, allowing the event to pass through without any modifications.

• Add Filter Conditions: Defaults to disable. When enabled, it allows events to filter through conditions. Only events that meet the true condition will be processed; all others will bypass this transform. Based on AND/OR conditions, "+Rule" or "+Group" buttons.

Serializer: Enabled: Defaults to enabled, meaning it does evaluate all events. Toggle Enabled off to prevent event processing to feed data to the downstream Transforms.

palo_alto Field Name: Field name which contains palo_alto data. Can't be empty. Default: palo_alto.

palo_alto Metadata Field: The value here should refer to the metadata field which was used while adding the palo_alto parser. Default: _ob.palo_alto. The value here should refer to the metadata field which was used while adding the palo_alto parser. Default

palo_alto Metadata Field Note: This field helps in identifying the underlying metadata about Palo Alto logs like log_type and helps in recovering Syslog preamble if it existed.

Output: The output destination where the serialized Palo Alto logs will be sent. Supported output options include:

• Splunk

Examples

Convert Palo Alto Log for Splunk Destination

Scenario: Convert Palo Alto Log for Splunk ingestion.

Input:

{
    "timestamp": "2023-06-15T14:30:00Z",
    "source_ip": "192.168.1.100",
    "palo_alto_metadata": {
        "log_type": "TRAFFIC",
        "syslog_prefix": "<14>Jun 15 14:30:00 PA-FW"
    },
    "palo_alto_data": {
        "receive_time": "2023/06/15 14:30:00",
        "serial": "001234567890",
        "type": "TRAFFIC",
        "subtype": "start",
        "time_generated": "2023/06/15 14:29:59",
        "src": "10.1.1.1",
        "dst": "8.8.8.8",
        "natsrc": "192.168.1.100",
        "natdst": "8.8.8.8",
        "rule": "Allow_Outbound",
        "from": "Trust",
        "to": "Untrust",
        "proto": "tcp",
        "port": 443,
        "bytes": 2048,
        "packets": 4,
        "start": "2023/06/15 14:29:58",
        "elapsed": 2,
        "category": "any",
        "action": "allow"
    }
}

Output:

{
  "message": "<14>Jun 15 14:30:00 PA-FW 1,2023/06/15 14:30:00,001234567890,TRAFFIC,start,2023/06/15 14:29:59,10.1.1.1,8.8.8.8,192.168.1.100,8.8.8.8,Allow_Outbound,Trust,Untrust,tcp,443,443,443,2048,4,2023/06/15 14:29:58,2,any,allow"
}

Results: The key reason for a Palo Alto Serializer for Splunk is to convert Palo Alto log data into structured formats like JSON, ensuring seamless integration and compatibility with the Splunk platform. This process enhances the ability to analyze and correlate diverse log types, such as traffic, threat, and URL logs, improving overall security visibility. Additionally, by preserving essential metadata and context, the serializer enables security teams to quickly identify and respond to potential threats within Splunk.

Best Practices for Palo Alto Serializer for Splunk

1. Use Standardized Formats – Serialize logs in JSON to ensure compatibility with Splunk and efficient parsing.

2. Normalize Field Mappings – Map Palo Alto log fields to Splunk’s Common Information Model (CIM) to facilitate correlation across different data sources.

3. Ensure Accurate Timestamps – Convert timestamps to UTC in ISO 8601 format (YYYY-MM-DDTHH:MM:SSZ) for consistency and accurate event correlation.

4. Optimize Log Size – Exclude redundant or unnecessary fields to reduce log volume and improve Splunk’s indexing performance.

5. Escape Special Characters – Properly escape characters like |, = and \ in CEF format to prevent parsing errors.

6. Preserve Critical Metadata – Retain important information such as source and destination IPs, action types, user details, and threat indicators to enhance security analysis.

7. Validate Serialization Output – Test serialized logs within Splunk to ensure proper parsing, field extraction, and searchability.

8. Monitor for Data Quality Issues – Regularly audit logs for missing fields, inconsistencies, or formatting errors to maintain data accuracy.

9. Bypassing Splunk’s Technology Add-on (TA): Observo AI pipelines enables more efficient log processing, customizable enrichment, and optimized indexing—while still achieving the same enhanced field extraction, visualization, and correlation for better security insights, performance and at a lower cost.

10. Document Serialization Configuration – Maintain clear documentation on field mappings, transformations, and configurations to ensure consistency and simplify troubleshooting.

By following these best practices, organizations can optimize Palo Alto log ingestion into Splunk, improving threat detection, security monitoring, and compliance reporting.

Related Functions

• Windows Serializer: Converts Windows event logs into a structured format like JSON or Syslog, ensuring compatibility with targeted destinations.

• CEF Parser: Extracts and normalizes fields from CEF-formatted logs, enabling efficient search, correlation, and analysis in SIEM systems.