Splunk Lookup Not Matching: How to Configure Custom Applications and Overriding Policies

When dealing with custom applications that don't have predefined signatures, configuring Splunk lookup not matching can be a challenging task. In this article, we will explore how to create a custom application in the Palo Alto Networks firewall and set up an Application Override policy.

Step 1: Create a Custom Application

To start, go to Advanced > Defaults and select Port to list all available ports in your application. You may also want to add optional steps such as selecting values for Category, Subcategory, and Technology. Name the application something other than the default name (e.g., Telnet), which is already used.

Step 2: Configure a Custom Application

From the WebGUI, go to Objects > Applications and click Add in the lower left corner. Create a new custom application for the traffic in question. For example, if you are working with Telnet, which uses TCP Port 23, follow these steps:

* Special Note about Content and Threat Inspection: When overriding to a custom application, it will force the firewall to bypass Content and Threat inspection for matching traffic.

* Security Policy that allows the newly created Custom Application through the firewall.

Step 3: Configure an Application Override Policy

To configure an Application Override policy, go to Policies > Application Override in the WebGUI. This is recommended if you have a custom application that uses TCP Port 23 but is identified as temenos-T24 when passing through the firewall.

In such cases, creating an application override can help prevent confusion and provide easier identification and reporting. For these applications, we may not have signatures to properly identify expected behavior or traffic with known applications.

Why Use Application Override?

You might ask why you would ever need to override the normal application identification process. The answer is that once the Application Override policy takes effect, all further App-ID inspection of the traffic is stopped and the session is identified with the custom application.

In summary, configuring Splunk lookup not matching requires creating a custom application in the Palo Alto Networks firewall and setting up an Application Override policy to override normal application identification. By following these steps, you can ensure that your custom applications are properly identified and allow for easier management and reporting.