Checking in Difference from Export from AOB

Splunk_TA_paloalto/README.txt

@@ -0,0 +1 @@
+This is an add-on powered by the Splunk Add-on Builder.

Splunk_TA_paloalto/VERSION

@@ -0,0 +1,2 @@
+8.1.0R0fc6bef
+8.1.0R0fc6bef

Splunk_TA_paloalto/app.manifest

@@ -1,78 +1,56 @@
 {
-  "schemaVersion": "2.0.0",
-  "info": {
-    "title": "Palo Alto Networks Add-on for Splunk",
-    "id": {
-      "group": null,
-      "name": "Splunk_TA_paloalto",
-      "version": "0.0.0-develop"
+    "schemaVersion": "2.0.0",
+    "info": {
+        "title": "Palo Alto Networks Add-on for Splunk",
+        "id": {
+            "group": null,
+            "name": "Splunk_TA_paloalto",
+            "version": "0.0.0.develop"
+        },
+        "author": [
+            {
+                "name": "Palo Alto Networks",
+                "email": null,
+                "company": null
+            }
+        ],
+        "releaseDate": null,
+        "description": "",
+        "classification": {
+            "intendedAudience": null,
+            "categories": [],
+            "developmentStatus": null
+        },
+        "commonInformationModels": null,
+        "license": {
+            "name": null,
+            "text": null,
+            "uri": null
+        },
+        "privacyPolicy": {
+            "name": null,
+            "text": null,
+            "uri": null
+        },
+        "releaseNotes": {
+            "name": null,
+            "text": null,
+            "uri": null
+        }
     },
-    "author": [
-      {
-        "name": "Palo Alto Networks",
-        "email": "[email protected]",
-        "company": "Palo Alto Networks"
-      }
-    ],
-    "releaseDate": null,
-    "description": "The Palo Alto Networks Add-on allows a Splunk Enterprise administrator to collect data from Palo Alto Networks Next-Generation Firewall devices, Panorama, Advanced Endpoint Protection, Aperture SaaS Security, AutoFocus Threat Intelligence, and MineMeld.",
-    "classification": {
-      "intendedAudience": "IT Professionals",
-      "categories": [
-        "IT Operations",
-        "Security, Fraud & Compliance"
-      ],
-      "developmentStatus": "Alpha"
-    },
-    "commonInformationModels": {
-      "Authentication":"4.19.0",
-      "Alert":"4.19.0",
-      "Change":"4.19.0",
-      "Endpoint":"4.19.0",
-      "Network Traffic":"4.19.0",
-      "Malware":"4.19.0",
-      "Intrusion Detection":"4.19.0",
-      "Network Sessions":"4.19.0",
-      "Web":"4.19.0"
-    },
-    "license": {
-      "name": null,
-      "text": null,
-      "uri": null
+    "dependencies": {},
+    "tasks": [],
+    "inputGroups": {},
+    "incompatibleApps": {},
+    "platformRequirements": {
+        "splunk": {
+            "Enterprise": "*"
+        }
     },
-    "privacyPolicy": {
-      "name": null,
-      "text": null,
-      "uri": null
-    },
-    "releaseNotes": {
-      "name": null,
-      "text": "./README.md",
-      "uri": null
-    }
-  },
-  "dependencies": {},
-  "tasks": [
-    "autofocus_export",
-    "aperture",
-    "minemeld_feed",
-    "iot_security"
-  ],
-  "inputGroups": {},
-  "incompatibleApps": {},
-  "platformRequirements": {
-    "splunk": {
-      "Enterprise": "*"
-    }
-  },
-  "supportedDeployments": [
-    "_standalone",
-    "_distributed",
-    "_search_head_clustering"
-  ],
-  "targetWorkloads": [
-    "_search_heads",
-    "_indexers",
-    "_forwarders"
-  ]
-}
+    "supportedDeployments": [
+        "*"
+    ],
+    "targetWorkloads": [
+        "*"
+    ]
+}

Splunk_TA_paloalto/default/app.conf

@@ -1,18 +1,18 @@
 [install]
 is_configured = false
 state = enabled
-build = 000develop0
+build = 1698367618
 splunk_supported = 9.0,8.2,8.1
 cim_supported = 5.x,4.x
 
 [launcher]
 author = Palo Alto Networks
-version = 0.0.0-develop
+version = 8.1.0R0fc6bef
 description = The Palo Alto Networks Add-on allows a Splunk Enterprise administrator to collect data from Palo Alto Networks Next-Generation Firewall devices, Panorama, Advanced Endpoint Protection, Aperture SaaS Security, AutoFocus Threat Intelligence, and MineMeld.
 
 [ui]
-is_visible = 1
-label = Palo Alto Networks Add-on
+is_visible = false
+label = Palo Alto Networks Add-on for Splunk
 
 [package]
 id = Splunk_TA_paloalto
@@ -23,3 +23,8 @@ reload.addon_builder = simple
 reload.splunk_ta_paloalto_account = simple
 reload.splunk_ta_paloalto_settings = simple
 reload.passwords = simple
+
+[id]
+version = 8.1.0R0fc6bef
+name = Splunk_TA_paloalto
+

Splunk_TA_paloalto/default/data/ui/nav/default.xml

@@ -1,6 +1,6 @@
 <nav search_view="search" color="#FFFFFF">
-  <view name="inputs" default="true" />
-  <view name="configuration"/>
-  <view name="health"/>
-  <view name="search" label="Search"/>
+<view name="inputs" default="true" />
+<view name="configuration"/>
+<view name="health"/>
+<view name="search" label="Search"/>
 </nav>

Splunk_TA_paloalto/default/props.conf

@@ -73,7 +73,7 @@ FIELDALIAS-fwcloud_session_id = SessionID as session_id
 EVAL-severity = coalesce(Severity, VendorSeverity)
 FIELDALIAS-fwcloud_signature = ThreatName as signature
 FIELDALIAS-fwcloud_signature_id = ThreatID as signature_id
-EVAL-src = coalesce(SourceAddress, PublicIPv4)
+FIELDALIAS-fwcloud_src = SourceAddress as src
 FIELDALIAS-fwcloud_src_host = SourceDeviceHost as src_host
 FIELDALIAS-fwcloud_src_interface = InboundInterface as src_interface
 EVAL-src_ip = coalesce(SourceAddress, PublicIPv4)
@@ -98,6 +98,8 @@ FIELDALIAS-fwcloud_vsys_id = VirtualSystemID as vsys_id
 FIELDALIAS-fwcloud_vsys_name = VirtualSystemName as vsys_name
 
 LOOKUP-vendor_action = pan_vendor_action_lookup vendor_action OUTPUT action
+FIELDALIAS-src_for_pan_cloud = src_ip as src
+FIELDALIAS-dest_for_pan_cloud = dest_ip as dest
 FIELDALIAS-dvc_for_pan_cloud = host as dvc
 
 EVAL-dest_name = replace(dest_hostname, "^([^:/]+).*", "\1")