Prisma SAAS Security Parsing Rule

Parsing Rule

SaaS Security by Palo Alto Networks

Details

IDPrisma_SAAS_Security_ParsingRule
From Version8.4.0

Rules (XQL)

[INGEST:vendor="paloaltonetworks", product="saassecurity", target_dataset="paloaltonetworks_saassecurity_raw", no_hit = keep]
filter to_string(timestamp) ~= "\d{2}:\d{2}:\d{2}.*"
| alter _time = timestamp;