Merge pull request #98 from kevwal1/SFN41_DNS-Security_update

Sfn41 dns security update. lgtm!
PaloAltoNetworks · Aug 26, 2020 · 2b909f9 · 2b909f9
2 parents c6103ef + a8026eb
commit 2b909f9
Showing 1 changed file with 2 additions and 1 deletion.
diff --git a/install/logstash/threat.conf b/install/logstash/threat.conf
@@ -76,7 +76,8 @@ filter {
             else if ([ThreatCategory] =~ "^dns") {
                 # The dns-cloud logging messages are formatted differently than content based
                 # so check to see if we have one of those and parse it.  
-                if ([ThreatCategory] =~ "^dns-cloud") {
+                # Now supports changes added to the DNS Security subscription.  
+                if ([ThreatCategory] =~ "^dns-cloud" or [ThreatCategory] =~ "^dns-security") {
                     if ([ThreatID] =~ "^109000001" or [ThreatID] =~ "^109001001") {
                         grok {
                             # We use the grok regex of DATA (rather than HOSTNAME) because we with Kiev/PANOS9.0 we