Transit edge devices now send pan:threat. How should analysts find official detections and dashboards for that sourcetype?
Select an answer to reveal the explanation.
Short Explanation
Look up the sourcetype or the CIM model—pan:threat, Intrusion Detection, Malware—not the word transit on Splunkbase. SSE and ES already index content by those keys. Guessing SPL is how the supported searches get missed.
Full Explanation
When transit edge devices now send pan:threat, analysts should find official detections and dashboards by searching Splunk Security Essentials or Enterprise Security content by the pan:threat sourcetype or by the Intrusion Detection and Malware CIM models those events feed. Content catalogs beat guessing SPL from unrelated keywords when onboarding a new civic threat sourcetype onto Enterprise Security.
Guessing SPL on Splunkbase by searching only for the word transit fails to find Palo Alto threat content tied specifically to pan:threat. Writing a Core dashboard XML file and hoping Enterprise Security discovers it as threat content invents unsupported automatic discovery behavior. Opening the license usage report fails because license reports do not list correlation searches by firewall vendor as a usable content catalog.
Exam caveat: new sourcetype discovery should use Security Essentials or ES content search by sourcetype or CIM model, not license reports or keyword guesses.
Operational check: in Security Essentials, filter to pan:threat or Intrusion Detection and Malware models, enable relevant transit-edge detections, confirm CIM fields populate, and validate that a known threat log produces a notable or dashboard row.