The splunk> app for Palo Alto firewalls lacks a few things like having a good view on your Roadwarriors VPN’s for example.
The other miss is having an easy troubleshooting view for blocked sessions which is to be honest the most important one for administrators when something is not working as expected.
Extending the current view needs some preparation because not all fields are extracted by the Palo Alto TA but when this is done the following dashboards can give you very interesting insights:
Comments are closed.