topic Can Cortex XDR proactively log Global Protect client debug? in Cortex XDR Discussions

Can Cortex XDR proactively log Global Protect client debug?

palomed — Tue, 17 May 2022 22:28:10 GMT

We have several hundred Global Protect users using Auto VPN. It would be nice to

see their global protect logs, ipconfig /all, netstat -rn information before calling them

back on a filed ticket. Can Cortex collect these logs on a regular basis without

user involvement? What has to be enabled at the GP client and/or PAN to

allow this log collection to occur?

Re: Can Cortex XDR proactively log Global Protect client debug?

jtalton — Fri, 10 Jun 2022 19:03:08 GMT

Hi Palomed,

If you have a Cortex Data Lake license, Global Protect logs can be forwarded to the Cortex Data Lake for stitching from your PAN firewall. Please refer to your PAN-OS TechDocs Documentation for how to configure.

Thanks

Re: Can Cortex XDR proactively log Global Protect client debug?

jtalton — Wed, 13 Jul 2022 18:19:39 GMT

You may forward Global Protect logs to the Cortex Data Lake for stitching from your PANW firewall. If you need assistance with configuring please open a support case.