569 palo alto rules (#570)
* feat: add Palo Alto Networks alerts to AvailableMonitoringAlerts enum * feat: add Palo Alto monitoring alerts for firewall traffic and correlation events * feat: add new Palo Alto firewall monitoring alerts for various traffic scenarios
taylor_socfortress committed
Dec 19, 2025 at 09:30 UTC
2b2d6c90b7105cc3f0cdf7b12a5810697c1214da
3 files changed
+444
backend/app/integrations/monitoring_alert/routes/provision.py
+56
@@ -89,6 +89,21 @@ from app.integrations.monitoring_alert.services.provision import (
89
from app.integrations.monitoring_alert.services.provision import (
90
provision_office365_threat_intel_alert,
91
)
92
+from app.integrations.monitoring_alert.services.provision import (
93
+ provision_paloalto_firewall_medium_severity_correlation_event_detected_monitoring_alert,
94
+)
95
+from app.integrations.monitoring_alert.services.provision import (
96
+ provision_paloalto_firewall_tor_traffic_allowed_monitoring_alert,
97
+)
98
+from app.integrations.monitoring_alert.services.provision import (
99
+ provision_paloalto_firewall_traffic_to_malicious_url_allowed_monitoring_alert,
100
+)
101
+from app.integrations.monitoring_alert.services.provision import (
102
+ provision_paloalto_firewall_traffic_to_phishing_url_allowed_monitoring_alert,
103
+)
104
+from app.integrations.monitoring_alert.services.provision import (
105
+ provision_paloalto_firewall_virus_allowed_monitoring_alert,
106
+)
107
from app.integrations.monitoring_alert.services.provision import (
108
provision_paloalto_monitoring_alert,
109
)
@@ -327,6 +342,42 @@ async def invoke_provision_paloalto_monitoring_alert(
342
await provision_paloalto_monitoring_alert(request)
343
344
345
+async def invoke_provision_paloalto_firewall_traffic_to_phishing_url_allowed_monitoring_alert(
346
+ request: ProvisionMonitoringAlertRequest,
347
+):
348
+ await provision_paloalto_firewall_traffic_to_phishing_url_allowed_monitoring_alert(
349
+ request,
350
+ )
351
+
352
+
353
+async def invoke_provision_paloalto_firewall_traffic_to_malicious_url_allowed_monitoring_alert(
354
+ request: ProvisionMonitoringAlertRequest,
355
+):
356
+ await provision_paloalto_firewall_traffic_to_malicious_url_allowed_monitoring_alert(
357
+ request,
358
+ )
359
+
360
+
361
+async def invoke_provision_paloalto_firewall_virus_allowed_monitoring_alert(
362
+ request: ProvisionMonitoringAlertRequest,
363
+):
364
+ await provision_paloalto_firewall_virus_allowed_monitoring_alert(request)
365
+
366
+
367
+async def invoke_provision_paloalto_firewall_tor_traffic_allowed_monitoring_alert(
368
+ request: ProvisionMonitoringAlertRequest,
369
+):
370
+ await provision_paloalto_firewall_tor_traffic_allowed_monitoring_alert(request)
371
+
372
+
373
+async def invoke_provision_paloalto_firewall_medium_severity_correlation_event_detected_monitoring_alert(
374
+ request: ProvisionMonitoringAlertRequest,
375
+):
376
+ await provision_paloalto_firewall_medium_severity_correlation_event_detected_monitoring_alert(
377
+ request,
378
+ )
379
+
380
+
381
async def invoke_provision_custom_monitoring_alert(
382
request: CustomMonitoringAlertProvisionModel,
383
):
@@ -360,6 +411,11 @@ PROVISION_FUNCTIONS = {
411
"FORTINET_WIDS_WIRELESS_WEAK_ENCRYPTION_DETECTED": invoke_provision_fortinet_wids_wireless_weak_encryption_detected_monitoring_alert,
412
"FORTINET_SUSPICIOUS_SUPER_ADMIN_LOGIN_DETECTED": invoke_provision_fortinet_suspicious_super_admin_login_detected_monitoring_alert,
413
"PALOALTO_ALERT": invoke_provision_paloalto_monitoring_alert,
414
+ "PALOALTO_FIREWALL_TRAFFIC_TO_PHISHING_URL_ALLOWED": invoke_provision_paloalto_firewall_traffic_to_phishing_url_allowed_monitoring_alert,
415
+ "PALOALTO_FIREWALL_TRAFFIC_TO_MALICIOUS_URL_ALLOWED": invoke_provision_paloalto_firewall_traffic_to_malicious_url_allowed_monitoring_alert,
416
+ "PALOALTO_FIREWALL_VIRUS_ALLOWED": invoke_provision_paloalto_firewall_virus_allowed_monitoring_alert,
417
+ "PALOALTO_FIREWALL_TOR_TRAFFIC_ALLOWED": invoke_provision_paloalto_firewall_tor_traffic_allowed_monitoring_alert,
418
+ "PALOALTO_FIREWALL_MEDIUM_SEVERITY_CORRELATION_EVENT_DETECTED": invoke_provision_paloalto_firewall_medium_severity_correlation_event_detected_monitoring_alert,
419
"CUSTOM": invoke_provision_custom_monitoring_alert,
420
# Add more alert names and functions as needed
421
}
backend/app/integrations/monitoring_alert/schema/provision.py
+33
@@ -171,11 +171,44 @@ class AvailableMonitoringAlerts(str, Enum):
171
"This may indicate an attempt to exploit CVE-2025-24472 which allows unauthenticated attackers to gain "
172
"super admin privileges on vulnerable FortiOS devices (<7.0.16) with exposed management interfaces."
173
)
174
+ # ! --- Palo Alto Networks (PANW) alerts ---
175
PALOALTO_ALERT = (
176
"This alert monitors the PaloAlto events. When an alert is detected, it triggers an "
177
"alert that is created within CoPilot. Ensure that you have a pipeline rule that sets the "
178
"alert_severity field to 1 when the PaloAlto alert is detected."
179
)
180
+ PALOALTO_FIREWALL_TRAFFIC_TO_PHISHING_URL_ALLOWED = (
181
+ "Detects when the Palo Alto Networks firewall does not block traffic to a URL known to be used in phishing "
182
+ "attacks. "
183
+ "An adversary can abuse this by directing victims to the phishing site, potentially stealing credentials, "
184
+ "deploying malware, or conducting other malicious activities."
185
+ )
186
+ PALOALTO_FIREWALL_TRAFFIC_TO_MALICIOUS_URL_ALLOWED = (
187
+ "Detects when the Palo Alto Networks firewall does not block traffic to a URL associated with malware "
188
+ "distribution or operation. "
189
+ "This typically indicates a lapse in the firewall's threat intelligence or a misconfiguration. "
190
+ "An adversary can abuse this by using the unblocked URL to download malware onto a target system, establish "
191
+ "a command and control channel, or exfiltrate data."
192
+ )
193
+ PALOALTO_FIREWALL_VIRUS_ALLOWED = (
194
+ "Detects active network communication associated with known malware that is being allowed by the Palo Alto "
195
+ "Networks firewall. "
196
+ "This may indicate an ongoing security threat, where malicious traffic is bypassing firewall protections, "
197
+ "potentially leading to system compromise, data exfiltration, or further infiltration within the network."
198
+ )
199
+ PALOALTO_FIREWALL_TOR_TRAFFIC_ALLOWED = (
200
+ "Detects allowed network traffic to the TOR network. Adversaries can use TOR to anonymize their network "
201
+ "activity, bypass security controls, and evade detection while conducting malicious operations. "
202
+ "This could lead to unauthorized access, data exfiltration, and compliance violations if deemed malicious."
203
+ )
204
+ PALOALTO_FIREWALL_MEDIUM_SEVERITY_CORRELATION_EVENT_DETECTED = (
205
+ "Detects medium severity correlation events generated by Palo Alto Networks firewall's automated correlation "
206
+ "engine. "
207
+ "The correlation engine connects isolated network events and looks for patterns that indicate a more "
208
+ "significant event. "
209
+ "This helps identify suspicious traffic patterns and network anomalies which, when correlated, indicate with "
210
+ "a high probability that a host on the network has been compromised."
211
+ )
212
213
214
class AvailableMonitoringAlertsResponse(BaseModel):
backend/app/integrations/monitoring_alert/services/provision.py
+355
@@ -1862,6 +1862,7 @@ async def provision_fortinet_suspicious_super_admin_login_detected_monitoring_al
1862
)
1863
1864
1865
+# ! -- PaloAlto Monitoring Alerts -- ! #
1866
async def provision_paloalto_monitoring_alert(
1867
request: ProvisionMonitoringAlertRequest,
1868
) -> ProvisionWazuhMonitoringAlertResponse:
@@ -1955,6 +1956,360 @@ async def provision_paloalto_monitoring_alert(
1956
)
1957
1958
1959
+async def provision_paloalto_firewall_traffic_to_phishing_url_allowed_monitoring_alert(
1960
+ request: ProvisionMonitoringAlertRequest,
1961
+) -> ProvisionWazuhMonitoringAlertResponse:
1962
+ """
1963
+ Provisions PaloAlto Firewall Traffic to Phishing URL Allowed monitoring alert.
1964
+ """
1965
+ logger.info(
1966
+ "Invoking provision_paloalto_firewall_traffic_to_phishing_url_allowed_monitoring_alert " f"with request: {request.dict()}",
1967
+ )
1968
+ await provision_alert_definition(
1969
+ GraylogAlertProvisionModel(
1970
+ title="PALOALTO - FIREWALL TRAFFIC TO PHISHING URL ALLOWED",
1971
+ description=(
1972
+ "Detects when the Palo Alto Networks firewall does not block traffic to a URL known to be used in phishing "
1973
+ "attacks. "
1974
+ "An adversary can abuse this by directing victims to the phishing site, potentially stealing credentials, "
1975
+ "deploying malware, or conducting other malicious activities."
1976
+ ),
1977
+ priority=2,
1978
+ config=GraylogAlertProvisionConfig(
1979
+ type="aggregation-v1",
1980
+ query=(
1981
+ "syslog_type:palo_alto_fw AND event_log_name:THREAT AND pan_log_subtype:url AND alert_category:phishing "
1982
+ "AND (event_severity:critical OR event_severity:high OR event_severity:medium) "
1983
+ "AND !vendor_event_action:deny AND !vendor_event_action:drop AND !vendor_event_action:reset AND !vendor_event_action:block"
1984
+ ),
1985
+ query_parameters=[],
1986
+ streams=[],
1987
+ group_by=[],
1988
+ series=[],
1989
+ conditions={"expression": None},
1990
+ search_within_ms=await convert_seconds_to_milliseconds(request.search_within_last),
1991
+ execute_every_ms=await convert_seconds_to_milliseconds(request.execute_every),
1992
+ event_limit=1000,
1993
+ ),
1994
+ field_spec={
1995
+ "ALERT_ID": GraylogAlertProvisionFieldSpecItem(
1996
+ data_type="string",
1997
+ providers=[
1998
+ GraylogAlertProvisionProvider(type="template-v1", template="${source._id}", require_values=True),
1999
+ ],
2000
+ ),
2001
+ "CUSTOMER_CODE": GraylogAlertProvisionFieldSpecItem(
2002
+ data_type="string",
2003
+ providers=[
2004
+ GraylogAlertProvisionProvider(type="template-v1", template="${source.syslog_customer}", require_values=True),
2005
+ ],
2006
+ ),
2007
+ "ALERT_SOURCE": GraylogAlertProvisionFieldSpecItem(
2008
+ data_type="string",
2009
+ providers=[
2010
+ GraylogAlertProvisionProvider(type="template-v1", template="PALOALTO", require_values=True),
2011
+ ],
2012
+ ),
2013
+ "COPILOT_ALERT_ID": GraylogAlertProvisionFieldSpecItem(
2014
+ data_type="string",
2015
+ providers=[
2016
+ GraylogAlertProvisionProvider(type="template-v1", template="NONE", require_values=True),
2017
+ ],
2018
+ ),
2019
+ },
2020
+ key_spec=[],
2021
+ notification_settings=GraylogAlertProvisionNotificationSettings(grace_period_ms=0, backlog_size=None),
2022
+ alert=True,
2023
+ ),
2024
+ )
2025
+ return ProvisionWazuhMonitoringAlertResponse(
2026
+ success=True,
2027
+ message="PaloAlto firewall traffic to phishing URL allowed monitoring alert provisioned successfully",
2028
+ )
2029
+
2030
+
2031
+async def provision_paloalto_firewall_traffic_to_malicious_url_allowed_monitoring_alert(
2032
+ request: ProvisionMonitoringAlertRequest,
2033
+) -> ProvisionWazuhMonitoringAlertResponse:
2034
+ """
2035
+ Provisions PaloAlto Firewall Traffic to Malicious URL Allowed monitoring alert.
2036
+ """
2037
+ logger.info(
2038
+ "Invoking provision_paloalto_firewall_traffic_to_malicious_url_allowed_monitoring_alert " f"with request: {request.dict()}",
2039
+ )
2040
+ await provision_alert_definition(
2041
+ GraylogAlertProvisionModel(
2042
+ title="PALOALTO - FIREWALL TRAFFIC TO MALICIOUS URL ALLOWED",
2043
+ description=(
2044
+ "Detects when the Palo Alto Networks firewall does not block traffic to a URL associated with malware "
2045
+ "distribution or operation. "
2046
+ "This typically indicates a lapse in the firewall's threat intelligence or a misconfiguration. "
2047
+ "An adversary can abuse this by using the unblocked URL to download malware onto a target system, establish "
2048
+ "a command and control channel, or exfiltrate data."
2049
+ ),
2050
+ priority=2,
2051
+ config=GraylogAlertProvisionConfig(
2052
+ type="aggregation-v1",
2053
+ query=(
2054
+ "syslog_type:palo_alto_fw AND event_log_name:THREAT AND pan_log_subtype:url AND alert_category:malware "
2055
+ "AND (event_severity:critical OR event_severity:high OR event_severity:medium) "
2056
+ "AND !vendor_event_action:deny AND !vendor_event_action:drop AND !vendor_event_action:reset AND !vendor_event_action:block"
2057
+ ),
2058
+ query_parameters=[],
2059
+ streams=[],
2060
+ group_by=[],
2061
+ series=[],
2062
+ conditions={"expression": None},
2063
+ search_within_ms=await convert_seconds_to_milliseconds(request.search_within_last),
2064
+ execute_every_ms=await convert_seconds_to_milliseconds(request.execute_every),
2065
+ event_limit=1000,
2066
+ ),
2067
+ field_spec={
2068
+ "ALERT_ID": GraylogAlertProvisionFieldSpecItem(
2069
+ data_type="string",
2070
+ providers=[
2071
+ GraylogAlertProvisionProvider(type="template-v1", template="${source._id}", require_values=True),
2072
+ ],
2073
+ ),
2074
+ "CUSTOMER_CODE": GraylogAlertProvisionFieldSpecItem(
2075
+ data_type="string",
2076
+ providers=[
2077
+ GraylogAlertProvisionProvider(type="template-v1", template="${source.syslog_customer}", require_values=True),
2078
+ ],
2079
+ ),
2080
+ "ALERT_SOURCE": GraylogAlertProvisionFieldSpecItem(
2081
+ data_type="string",
2082
+ providers=[
2083
+ GraylogAlertProvisionProvider(type="template-v1", template="PALOALTO", require_values=True),
2084
+ ],
2085
+ ),
2086
+ "COPILOT_ALERT_ID": GraylogAlertProvisionFieldSpecItem(
2087
+ data_type="string",
2088
+ providers=[
2089
+ GraylogAlertProvisionProvider(type="template-v1", template="NONE", require_values=True),
2090
+ ],
2091
+ ),
2092
+ },
2093
+ key_spec=[],
2094
+ notification_settings=GraylogAlertProvisionNotificationSettings(grace_period_ms=0, backlog_size=None),
2095
+ alert=True,
2096
+ ),
2097
+ )
2098
+ return ProvisionWazuhMonitoringAlertResponse(
2099
+ success=True,
2100
+ message="PaloAlto firewall traffic to malicious URL allowed monitoring alert provisioned successfully",
2101
+ )
2102
+
2103
+
2104
+async def provision_paloalto_firewall_virus_allowed_monitoring_alert(
2105
+ request: ProvisionMonitoringAlertRequest,
2106
+) -> ProvisionWazuhMonitoringAlertResponse:
2107
+ """
2108
+ Provisions PaloAlto Firewall Virus Allowed monitoring alert.
2109
+ """
2110
+ logger.info(
2111
+ "Invoking provision_paloalto_firewall_virus_allowed_monitoring_alert " f"with request: {request.dict()}",
2112
+ )
2113
+ await provision_alert_definition(
2114
+ GraylogAlertProvisionModel(
2115
+ title="PALOALTO - FIREWALL VIRUS ALLOWED",
2116
+ description=(
2117
+ "Detects active network communication associated with known malware that is being allowed by the Palo Alto "
2118
+ "Networks firewall. "
2119
+ "This may indicate an ongoing security threat, where malicious traffic is bypassing firewall protections, "
2120
+ "potentially leading to system compromise, data exfiltration, or further infiltration within the network."
2121
+ ),
2122
+ priority=2,
2123
+ config=GraylogAlertProvisionConfig(
2124
+ type="aggregation-v1",
2125
+ query=(
2126
+ "syslog_type:palo_alto_fw AND event_log_name:THREAT AND pan_log_subtype:virus "
2127
+ "AND !vendor_event_action:deny AND !vendor_event_action:drop AND !vendor_event_action:reset AND !vendor_event_action:block"
2128
+ ),
2129
+ query_parameters=[],
2130
+ streams=[],
2131
+ group_by=[],
2132
+ series=[],
2133
+ conditions={"expression": None},
2134
+ search_within_ms=await convert_seconds_to_milliseconds(request.search_within_last),
2135
+ execute_every_ms=await convert_seconds_to_milliseconds(request.execute_every),
2136
+ event_limit=1000,
2137
+ ),
2138
+ field_spec={
2139
+ "ALERT_ID": GraylogAlertProvisionFieldSpecItem(
2140
+ data_type="string",
2141
+ providers=[
2142
+ GraylogAlertProvisionProvider(type="template-v1", template="${source._id}", require_values=True),
2143
+ ],
2144
+ ),
2145
+ "CUSTOMER_CODE": GraylogAlertProvisionFieldSpecItem(
2146
+ data_type="string",
2147
+ providers=[
2148
+ GraylogAlertProvisionProvider(type="template-v1", template="${source.syslog_customer}", require_values=True),
2149
+ ],
2150
+ ),
2151
+ "ALERT_SOURCE": GraylogAlertProvisionFieldSpecItem(
2152
+ data_type="string",
2153
+ providers=[
2154
+ GraylogAlertProvisionProvider(type="template-v1", template="PALOALTO", require_values=True),
2155
+ ],
2156
+ ),
2157
+ "COPILOT_ALERT_ID": GraylogAlertProvisionFieldSpecItem(
2158
+ data_type="string",
2159
+ providers=[
2160
+ GraylogAlertProvisionProvider(type="template-v1", template="NONE", require_values=True),
2161
+ ],
2162
+ ),
2163
+ },
2164
+ key_spec=[],
2165
+ notification_settings=GraylogAlertProvisionNotificationSettings(grace_period_ms=0, backlog_size=None),
2166
+ alert=True,
2167
+ ),
2168
+ )
2169
+ return ProvisionWazuhMonitoringAlertResponse(
2170
+ success=True,
2171
+ message="PaloAlto firewall virus allowed monitoring alert provisioned successfully",
2172
+ )
2173
+
2174
+
2175
+async def provision_paloalto_firewall_tor_traffic_allowed_monitoring_alert(
2176
+ request: ProvisionMonitoringAlertRequest,
2177
+) -> ProvisionWazuhMonitoringAlertResponse:
2178
+ """
2179
+ Provisions PaloAlto Firewall TOR Traffic Allowed monitoring alert.
2180
+ """
2181
+ logger.info(
2182
+ "Invoking provision_paloalto_firewall_tor_traffic_allowed_monitoring_alert " f"with request: {request.dict()}",
2183
+ )
2184
+ await provision_alert_definition(
2185
+ GraylogAlertProvisionModel(
2186
+ title="PALOALTO - FIREWALL TOR TRAFFIC ALLOWED",
2187
+ description=(
2188
+ "Detects allowed network traffic to the TOR network. Adversaries can use TOR to anonymize their network "
2189
+ "activity, bypass security controls, and evade detection while conducting malicious operations. "
2190
+ "This could lead to unauthorized access, data exfiltration, and compliance violations if deemed malicious."
2191
+ ),
2192
+ priority=2,
2193
+ config=GraylogAlertProvisionConfig(
2194
+ type="aggregation-v1",
2195
+ query="syslog_type:palo_alto_fw AND event_log_name:TRAFFIC AND application_name:tor AND vendor_event_action:allow",
2196
+ query_parameters=[],
2197
+ streams=[],
2198
+ group_by=[],
2199
+ series=[],
2200
+ conditions={"expression": None},
2201
+ search_within_ms=await convert_seconds_to_milliseconds(request.search_within_last),
2202
+ execute_every_ms=await convert_seconds_to_milliseconds(request.execute_every),
2203
+ event_limit=1000,
2204
+ ),
2205
+ field_spec={
2206
+ "ALERT_ID": GraylogAlertProvisionFieldSpecItem(
2207
+ data_type="string",
2208
+ providers=[
2209
+ GraylogAlertProvisionProvider(type="template-v1", template="${source._id}", require_values=True),
2210
+ ],
2211
+ ),
2212
+ "CUSTOMER_CODE": GraylogAlertProvisionFieldSpecItem(
2213
+ data_type="string",
2214
+ providers=[
2215
+ GraylogAlertProvisionProvider(type="template-v1", template="${source.syslog_customer}", require_values=True),
2216
+ ],
2217
+ ),
2218
+ "ALERT_SOURCE": GraylogAlertProvisionFieldSpecItem(
2219
+ data_type="string",
2220
+ providers=[
2221
+ GraylogAlertProvisionProvider(type="template-v1", template="PALOALTO", require_values=True),
2222
+ ],
2223
+ ),
2224
+ "COPILOT_ALERT_ID": GraylogAlertProvisionFieldSpecItem(
2225
+ data_type="string",
2226
+ providers=[
2227
+ GraylogAlertProvisionProvider(type="template-v1", template="NONE", require_values=True),
2228
+ ],
2229
+ ),
2230
+ },
2231
+ key_spec=[],
2232
+ notification_settings=GraylogAlertProvisionNotificationSettings(grace_period_ms=0, backlog_size=None),
2233
+ alert=True,
2234
+ ),
2235
+ )
2236
+ return ProvisionWazuhMonitoringAlertResponse(
2237
+ success=True,
2238
+ message="PaloAlto firewall TOR traffic allowed monitoring alert provisioned successfully",
2239
+ )
2240
+
2241
+
2242
+async def provision_paloalto_firewall_medium_severity_correlation_event_detected_monitoring_alert(
2243
+ request: ProvisionMonitoringAlertRequest,
2244
+) -> ProvisionWazuhMonitoringAlertResponse:
2245
+ """
2246
+ Provisions PaloAlto Firewall Medium Severity Correlation Event Detected monitoring alert.
2247
+ """
2248
+ logger.info(
2249
+ "Invoking provision_paloalto_firewall_medium_severity_correlation_event_detected_monitoring_alert "
2250
+ f"with request: {request.dict()}",
2251
+ )
2252
+ await provision_alert_definition(
2253
+ GraylogAlertProvisionModel(
2254
+ title="PALOALTO - FIREWALL MEDIUM SEVERITY CORRELATION EVENT DETECTED",
2255
+ description=(
2256
+ "Detects medium severity correlation events generated by Palo Alto Networks firewall's automated correlation "
2257
+ "engine. "
2258
+ "The correlation engine connects isolated network events and looks for patterns that indicate a more "
2259
+ "significant event. "
2260
+ "This helps identify suspicious traffic patterns and network anomalies which, when correlated, indicate with "
2261
+ "a high probability that a host on the network has been compromised."
2262
+ ),
2263
+ priority=2,
2264
+ config=GraylogAlertProvisionConfig(
2265
+ type="aggregation-v1",
2266
+ query="syslog_type:palo_alto_fw AND event_log_name:CORRELATION AND vendor_alert_severity:medium",
2267
+ query_parameters=[],
2268
+ streams=[],
2269
+ group_by=[],
2270
+ series=[],
2271
+ conditions={"expression": None},
2272
+ search_within_ms=await convert_seconds_to_milliseconds(request.search_within_last),
2273
+ execute_every_ms=await convert_seconds_to_milliseconds(request.execute_every),
2274
+ event_limit=1000,
2275
+ ),
2276
+ field_spec={
2277
+ "ALERT_ID": GraylogAlertProvisionFieldSpecItem(
2278
+ data_type="string",
2279
+ providers=[
2280
+ GraylogAlertProvisionProvider(type="template-v1", template="${source._id}", require_values=True),
2281
+ ],
2282
+ ),
2283
+ "CUSTOMER_CODE": GraylogAlertProvisionFieldSpecItem(
2284
+ data_type="string",
2285
+ providers=[
2286
+ GraylogAlertProvisionProvider(type="template-v1", template="${source.syslog_customer}", require_values=True),
2287
+ ],
2288
+ ),
2289
+ "ALERT_SOURCE": GraylogAlertProvisionFieldSpecItem(
2290
+ data_type="string",
2291
+ providers=[
2292
+ GraylogAlertProvisionProvider(type="template-v1", template="PALOALTO", require_values=True),
2293
+ ],
2294
+ ),
2295
+ "COPILOT_ALERT_ID": GraylogAlertProvisionFieldSpecItem(
2296
+ data_type="string",
2297
+ providers=[
2298
+ GraylogAlertProvisionProvider(type="template-v1", template="NONE", require_values=True),
2299
+ ],
2300
+ ),
2301
+ },
2302
+ key_spec=[],
2303
+ notification_settings=GraylogAlertProvisionNotificationSettings(grace_period_ms=0, backlog_size=None),
2304
+ alert=True,
2305
+ ),
2306
+ )
2307
+ return ProvisionWazuhMonitoringAlertResponse(
2308
+ success=True,
2309
+ message="PaloAlto firewall medium severity correlation event detected monitoring alert provisioned successfully",
2310
+ )
2311
+
2312
+
2313
async def provision_custom_alert(request: CustomMonitoringAlertProvisionModel) -> ProvisionWazuhMonitoringAlertResponse:
2314
"""
2315
Provisions custom monitoring alerts.