topic Re: Amazon WAF Log Ingestion in Cortex XDR Management Console in Cortex XDR Discussions

Amazon WAF Log Ingestion in Cortex XDR Management Console

Vinothkumar_SBA — Tue, 28 Nov 2023 13:55:42 GMT

Dear Team,

I kindly request confirmation regarding the feasibility of integrating Cortex XDR with Amazon WAF logs. If possible, could you provide guidance on how to proceed with this integration? Additionally, please share any related documents or resources that could be helpful in this process.

Re: Amazon WAF Log Ingestion in Cortex XDR Management Console

nsinghvirk — Thu, 30 Nov 2023 12:27:04 GMT

Hello @Vinothkumar_SBA ,

Thanks for reaching out on LiveCommunity!

One of the way by which you can ingest logs from any third party firewall is through syslog collector applet on broker vm. Syslog collector allow you to ingest logs in any of these logs format CEF, LEEF, CISCO, CORELIGHT, or RAW. Please follow below guide to activate and config syslog collector to ingest firewall logs.

https://docs-cortex.paloaltonetworks.com/r/Cortex-XDR/Cortex-XDR-Pro-Administrator-Guide/Activate-the-Syslog-Collector

One more possible solution is through Cloudwatch integration. XDR provide direct integration to Cloudwatch. Hence if you can forward WAF logs to Cloudwatch, those logs can be ingested to XDR. Below is the documentation for Cloudwatch integration.

https://docs-cortex.paloaltonetworks.com/r/Cortex-XDR/Cortex-XDR-Pro-Administrator-Guide/Ingest-Logs-from-Amazon-CloudWatch

Re: Amazon WAF Log Ingestion in Cortex XDR Management Console

Vinothkumar_SBA — Sat, 02 Dec 2023 04:50:02 GMT

Hi Nsinghvirk,

Thank you for the information. We have another query: How can a Palo Alto firewall integrate with Cortex XDR?

One method involves forwarding Palo Alto firewall logs to the Cortex data lake. Are there any other possible methods?