How to check ELA(Enhanced Application Logs)

Hisashi_Abe — Thu, 12 Dec 2024 11:01:39 GMT

We enable ELA on our NGFWs, forward logs to SLS, and also ingest the SLS logs into our XDR tenant.
Is there a way to verify in the XDR tenant or SLS that logs have been enriched by ELA?

Re: How to check ELA(Enhanced Application Logs)

mavega — Fri, 13 Dec 2024 18:50:22 GMT

Hi,

Thanks for reaching Live Community.

When you enabled NGFW logging to cortex, you can check the panw_ngfw_traffic_raw dataset on XQL to see all the information you can query from these logs.

For better understanding what ELA activation will enhance these logs, please refer to this doc below:

https://docs.paloaltonetworks.com/pan-os/10-1/pan-os-admin/subscriptions/enhanced-application-logs

If this information solves your inquiry, please mark as solution.

topic How to check ELA(Enhanced Application Logs) in Cortex XDR Discussions

How to check ELA(Enhanced Application Logs)

Re: How to check ELA(Enhanced Application Logs)