Splunk-Apps
Splunk-Apps copied to clipboard
Correct bytes sent/received field aliases for pan:firewall_cloud
Description
Flip the bytes_in and bytes_out field aliases.
Motivation and Context
'bytes_in' should be mapped to the BytesReceived field from the perspective of the client in a client-to-server connection. Currently, bytes_in is evaluated from the perspective of the server.
How Has This Been Tested?
This change was tested and evaluated in my organization's Splunk environment using log events from Cortex Data Lake/Prisma Access. We were able to confirm that the change provides the expected mapping of BytesReceived and BytesSent to CIM-compliant fields.
This change was also evaluated using the existing built-in tests.
Screenshots (if appropriate)
Types of changes
- Bug fix (non-breaking change which fixes an issue)
Checklist
- [x] I have updated the documentation accordingly.
- [x] I have read the CONTRIBUTING document.
- [x] I have added tests to cover my changes if appropriate.
- [x] All new and existing tests passed.
:tada: Thanks for opening this pull request! We really appreciate contributors like you! :raised_hands: