Web proxy data not tagged correctly about splunk-apps

[btorresgil]

Hello, thanks for opening an issue. Are you using Add-on version 3.7.0, or a different version?

Since the firewall is not technically a proxy, it was recommended to us to only tag as web. But I'm interested to hear how this affects your data. Can you help me understand what is missing by not having the proxy tag?

[automine]

Yes, it isn't technically a proxy, however, c'mon, how many of your customers are using it to replace a proxy? :)

It behaves a lot like a proxy, in that it accepts/blocks web traffic, and logs that information. If it wasn't performing the blocking action, I could see making it more like web logging.

In terms of what is missing, really I'm being selfish as I use the Web.Proxy data model here: https://github.com/automine/web_proxies

Edit: yes, I believe this was 3.7

[btorresgil]

Fair enough, we'll do some research and consider this for Add-on 3.7.1. Will let you know here either way. Thanks for the input!

[shadeflayer]

I concur with Automine. PA Sales sold the proxy capability as a basic proxy solution, thereby convincing my organization to skip Websense/Forcepoint and use PA instead. In testing the PA's do provide most of the same basic functionality. Maybe not all the bells and whistles, but in a hard core, practical environment those are not necessary to protect the environment. So I am looking forward to significant improvements in this app to provide more robust proxy dashboards. One thing I really need to see is what a user is doing with their time, and the amount of time by category, and subcategory. Hint Hint...

FYI - Check out the App for Web Proxies on Splunkbase for some ideas. The developer assisted me in getting the app going using the PA logs. Looks sexy I must say :)

[btorresgil]

@shadeflayer Thanks for the comments and the tip on the Web Proxy App. I will definitely check that out and make sure our logs fit well.

[shadeflayer]

@btorresgil - I emailed you yesterday and this morning. Not sure if you have seen it yet. Need assistance with the core PA app. Odd behavior post Splunk 6.5 upgrade.

[bogeybit]

We also made the changes in our environment that @automine suggested to work with the Web.Proxy data model. In our case we do use URL filtering as a proxy even though it technically is not a "proxy", the usage and log event format is very similar.

[Kevin-Manson]

+1 On this issue, we have been adding the proxy tab to all of our clients.

[btorresgil]

Resolved in Add-on 6.0.0