fix(addon): Optomize type field for CIM compliance

Update log field from type to log_type

Author: paulmnguyen

Splunk_TA_paloalto/default/props.conf

@@ -87,6 +87,7 @@ FIELDALIAS-fwcloud_threat = ThreatID as threat
 FIELDALIAS-fwcloud_threat_name = ThreatName as threat_name 
 FIELDALIAS-fwcloud_transport = Protocol as transport
 FIELDALIAS-fwcloud_type = LogType as type
+FIELDALIAS-fwcloud_log_type = LogType as log_type
 EVAL-user = case(SourceUser!="null",'SourceUser',SourceUserName !="null",'SourceUserName',src_user!="null",'src_user',dest_user!="null",'dest_user',recipient!="null",'recipient',sender!="null",'sender',true(),"unknown")
 FIELDALIAS-fwcloud_url = URL as url
 FIELDALIAS-fwcloud_vendor_action = Action as vendor_action
@@ -333,6 +334,8 @@ SHOULD_LINEMERGE = false
 TIME_PREFIX = ^(?:[^,]*,){6}
 MAX_TIMESTAMP_LOOKAHEAD = 32
 REPORT-search = extract_globalprotect
+
+FIELDALIAS-type = log_type as type 
 FIELDALIAS-status_for_results = status as result 
 FIELDALIAS-stage_for_log_subtype = stage as log_subtype 
 EVAL-dvc_name = coalesce(dvc_name, machine_name)
@@ -353,6 +356,7 @@ MAX_TIMESTAMP_LOOKAHEAD = 32
 
 REPORT-search = extract_decryption
 
+FIELDALIAS-type = log_type as type 
 
 [pan_config]
 rename = pan:config
@@ -391,6 +395,7 @@ MAX_TIMESTAMP_LOOKAHEAD = 32
 
 REPORT-search = extract_hipmatch
 
+FIELDALIAS-type                     = log_type as type 
 FIELDALIAS-virtual_system           = vsys as virtual_system
 
 # Field Aliases to map specific fields to the Splunk Common Information Model--Intrusion Detection
@@ -436,6 +441,7 @@ SHOULD_LINEMERGE = false
 TIME_PREFIX = ^(?:[^,]*,){6}
 MAX_TIMESTAMP_LOOKAHEAD = 32
 REPORT-search = extract_userid
+FIELDALIAS-type                        = log_type as type 
 FIELDALIAS-virtual_system              = vsys as virtual_system
 FIELDALIAS-src_for_pan_correlation     = src_ip as src
 FIELDALIAS-dest_ip_for_pan_correlation = src_ip as dest_ip

Splunk_TA_paloalto/default/transforms.conf

@@ -85,20 +85,20 @@ FIELDS = "future_use1","receive_time","serial_number","log_type","log_subtype","
 
 [extract_hipmatch]
 DELIMS = ","
-FIELDS = "future_use1","receive_time","serial_number","type","log_subtype","version","generated_time","src_user","vsys","host_name","os","src_ip","hip_name","hip_count","hip_type","future_use3","future_use4","sequence_number","action_flags","devicegroup_level1","devicegroup_level2","devicegroup_level3","devicegroup_level4","vsys_name","dvc_name","vsys_id","ipv6_system_address"
+FIELDS = "future_use1","receive_time","serial_number","log_type","log_subtype","version","generated_time","src_user","vsys","host_name","os","src_ip","hip_name","hip_count","hip_type","future_use3","future_use4","sequence_number","action_flags","devicegroup_level1","devicegroup_level2","devicegroup_level3","devicegroup_level4","vsys_name","dvc_name","vsys_id","ipv6_system_address"
 
 [extract_correlation]
 DELIMS = ","
 FIELDS = "future_use1","receive_time","serial_number","log_type","log_subtype","version","generated_time","src_ip","src_user","vsys","category","severity","devicegroup_level1","devicegroup_level2","devicegroup_level3","devicegroup_level4","vsys_name","dvc_name","vsys_id","object","object_id","evidence"
 
 [extract_userid]
 DELIMS = ","
-FIELDS = "future_use1","receive_time","serial_number","type","log_subtype","version","generated_time","vsys","src_ip","source_name","event_id","repeat_count","timeout_threshold","src_port","dest_port","source","source_type","sequence_number","action_flags","devicegroup_level1","devicegroup_level2","devicegroup_level3","devicegroup_level4","vsys_name","dvc_name","vsys_id","factor_type","factor_completion_time","factor_number"
+FIELDS = "future_use1","receive_time","serial_number","log_type","log_subtype","version","generated_time","vsys","src_ip","source_name","event_id","repeat_count","timeout_threshold","src_port","dest_port","source","source_type","sequence_number","action_flags","devicegroup_level1","devicegroup_level2","devicegroup_level3","devicegroup_level4","vsys_name","dvc_name","vsys_id","factor_type","factor_completion_time","factor_number"
 
 # GlobalProtect extraction for PAN-OS 9.1.1+
 [extract_globalprotect]
 DELIMS = ","
-FIELDS = "future_use1","receive_time","serial_number","type","future_use2","version","time_generated","vsys","event_id","stage","auth_method","tunnel_type","src_user","src_region","machine_name","public_ip","public_ipv6","private_ip","private_ipv6","host_id","serial_number","client_ver","client_os","client_os_ver","repeat_count","reason","error","opaque","status","location","login_duration","connect_method","error_code","portal","sequence_number","action_flags","event_time","selection_type","response_time","priority","attempted_gateways","gateway","devicegroup_level1","devicegroup_level2","devicegroup_level3","devicegroup_level4","vsys_name","dvc_name","vsys_id"
+FIELDS = "future_use1","receive_time","serial_number","log_type","future_use2","version","time_generated","vsys","event_id","stage","auth_method","tunnel_type","src_user","src_region","machine_name","public_ip","public_ipv6","private_ip","private_ipv6","host_id","serial_number","client_ver","client_os","client_os_ver","repeat_count","reason","error","opaque","status","location","login_duration","connect_method","error_code","portal","sequence_number","action_flags","event_time","selection_type","response_time","priority","attempted_gateways","gateway","devicegroup_level1","devicegroup_level2","devicegroup_level3","devicegroup_level4","vsys_name","dvc_name","vsys_id"
 
 [extract_traps_analytics]
 DELIMS = ","
@@ -114,7 +114,7 @@ FIELDS = "record_type","class","future_user1","log_subtype","event_type","catego
 
 [extract_decryption]
 DELIMS = ","
-FIELDS = "future_use1","receive_time","serial_number","type","log_subtype","version","generated_time","src_ip","dest_ip","src_translated_ip","dest_translated_ip","rule","src_user","dest_user","app","vsys","src_zone","dest_zone","src_interface","dest_interface","log_forwarding_profile","start_time","session_id","repeat_count","src_port","dest_port","src_translated_port","dest_translated_port","flags","IP_PROTOCOL","action","tunnel_id","future_use2","future_use3","src_vm_uuid","dest_vm_uuid","uuid_rule","stage_client_firewall","stage_firewall_client","tls_version","key_exchange_algorithm","encryption_algorithm","hash_algorithm","rule","elliptic_curve","error_index","root_status","chain_status","proxy_type","cert_serial_number","fingerprint","cert_start_time","cert_end_time","cert_version","cert_size","cn_length","issuer_cn_length","root_cn_length","sni_length","cert_flags","subject_cn","issuer_subject_cn","root_subject_cn","server_name","error","container_id","pod_namespace","pod_name","src_edl","dest_edl","src_dag","dest_dag","timestamp","src_dvc_category","src_dvc_profile","src_dvc_model","src_dvc_vendor","src_dvc_os","src_dvc_os_version","src_name","src_mac","dest_dvc_category","dest_dvc_profile","dest_dvc_model","dest_dvc_vendor","dest_dvc_os","dest_dvc_os_version","dest_name","dest_mac","sequence_number","action_flags"
+FIELDS = "future_use1","receive_time","serial_number","log_type","log_subtype","version","generated_time","src_ip","dest_ip","src_translated_ip","dest_translated_ip","rule","src_user","dest_user","app","vsys","src_zone","dest_zone","src_interface","dest_interface","log_forwarding_profile","start_time","session_id","repeat_count","src_port","dest_port","src_translated_port","dest_translated_port","flags","IP_PROTOCOL","action","tunnel_id","future_use2","future_use3","src_vm_uuid","dest_vm_uuid","uuid_rule","stage_client_firewall","stage_firewall_client","tls_version","key_exchange_algorithm","encryption_algorithm","hash_algorithm","rule","elliptic_curve","error_index","root_status","chain_status","proxy_type","cert_serial_number","fingerprint","cert_start_time","cert_end_time","cert_version","cert_size","cn_length","issuer_cn_length","root_cn_length","sni_length","cert_flags","subject_cn","issuer_subject_cn","root_subject_cn","server_name","error","container_id","pod_namespace","pod_name","src_edl","dest_edl","src_dag","dest_dag","timestamp","src_dvc_category","src_dvc_profile","src_dvc_model","src_dvc_vendor","src_dvc_os","src_dvc_os_version","src_name","src_mac","dest_dvc_category","dest_dvc_profile","dest_dvc_model","dest_dvc_vendor","dest_dvc_os","dest_dvc_os_version","dest_name","dest_mac","sequence_number","action_flags"
 
 [extract_threat_id]
 SOURCE_KEY = threat