Splunk-Apps icon indicating copy to clipboard operation
Splunk-Apps copied to clipboard

Correct bytes sent/received field aliases for pan:firewall_cloud

Open ryanbsaunders opened this issue 3 years ago • 1 comments

Description

Flip the bytes_in and bytes_out field aliases.

Motivation and Context

'bytes_in' should be mapped to the BytesReceived field from the perspective of the client in a client-to-server connection. Currently, bytes_in is evaluated from the perspective of the server.

How Has This Been Tested?

This change was tested and evaluated in my organization's Splunk environment using log events from Cortex Data Lake/Prisma Access. We were able to confirm that the change provides the expected mapping of BytesReceived and BytesSent to CIM-compliant fields.

This change was also evaluated using the existing built-in tests.

Screenshots (if appropriate)

Types of changes

  • Bug fix (non-breaking change which fixes an issue)

Checklist

  • [x] I have updated the documentation accordingly.
  • [x] I have read the CONTRIBUTING document.
  • [x] I have added tests to cover my changes if appropriate.
  • [x] All new and existing tests passed.

ryanbsaunders avatar Jul 29 '22 20:07 ryanbsaunders

:tada: Thanks for opening this pull request! We really appreciate contributors like you! :raised_hands: