topic Re: Palo Alto logs to Cloudwatch logs possible? in VM-Series in the Public Cloud

Palo Alto logs to Cloudwatch logs possible?

chrisjin — Fri, 09 Aug 2019 14:39:40 GMT

I'm looking to see if we're able to push Palo Alto VM's syslogs and traffic logs to AWS CloudWatch logs.

Just to be clear, I'm not looking to monitor Palo Alto metrics using CloudWatch but need to push logs from the firewall to CloudWatch logs.

Is this possible at all?

Thanks.

Re: Palo Alto logs to Cloudwatch logs possible?

BPry — Sun, 11 Aug 2019 00:13:46 GMT

@chrisjin,

Officially I don't think this is supported at all, as CloudWatch doesn't really expose an easy way to injest logs outside of an instance with the agent installed. That being said, you can rig CloudWatch to look at /var/log/messages and configure an EC2 instance to accept your syslog messages and pass them to that location to get them into CloudWatch.

Re: Palo Alto logs to Cloudwatch logs possible?

Sagar_D — Tue, 01 Dec 2020 14:13:09 GMT

Hi,

You need to have a IAM Role associated with the Palo Alto EC2 instance.

AWSTemplateFormatVersion: 2010-09-09
Resources:
IAM-NPD-INT-PAFWMON:
Type: 'AWS::IAM::Role'
Properties:
AssumeRolePolicyDocument:
Version: 2012-10-17
Statement:
- Effect: Allow
Principal:
Service:
- ec2.amazonaws.com
Action:
- sts:AssumeRole
Policies:
- PolicyName: PAFWMON_Policy
PolicyDocument:
Version: 2012-10-17
Statement:
- Effect: Allow
Action: cloudwatch:PutMetricData
Resource: '*'
RootInstanceProfile:
Type: "AWS::IAM::InstanceProfile"
Properties:
Path: "/"
Roles:
-
Ref: "IAM-NPD-INT-PAFWMON"

Re: Palo Alto logs to Cloudwatch logs possible?

glynn — Tue, 01 Dec 2020 16:38:13 GMT

One of the AWS SAs blogged about this:

https://aws.amazon.com/blogs/apn/monitoring-your-palo-alto-networks-vm-series-firewall-with-a-syslog-sidecar/

I found that it lends itself well to containerization as well.