Prisma SAAS Security Parsing Rule

Parsing Rule

SaaS Security by Palo Alto Networks

Details

IDPrisma_SAAS_Security_ParsingRule
From Version8.4.0

Source

PrismaSaasSecurity.xif PrismaSaasSecurity.yml
Download History Raw 
[INGEST:vendor="paloaltonetworks", product="saassecurity", target_dataset="paloaltonetworks_saassecurity_raw", no_hit = keep]
filter to_string(timestamp) ~= "\d{2}:\d{2}:\d{2}.*"
| alter _time = timestamp;