topic Re: XSIAM NGFW Panorama logs onboarding in Cortex XSIAM Discussions

XSIAM NGFW Panorama logs onboarding

bridgetlitt — Sat, 02 Aug 2025 15:21:44 GMT

What is the recommended method to onboard NGFW logs. If the NGFWs are sending the logs to Panorama, how should i get the logs to XSIAM. I did see the "NGFW" integration and there is also syslog through Broker VM. which one is recommended? If I use the "NGFW" integration would it be enough to just connect to Panorama(and it sends all the logs from all the managed NGFWs) or do i need to add each of the firewalls also?

#xsiam

Re: XSIAM NGFW Panorama logs onboarding

PA_nts — Tue, 12 Aug 2025 08:16:17 GMT

Bit late on reply.. but you can ingest directly from panorama to xsiam by enabling the strata logging service, the other alternative is using the Broker-VM also.

more info here:

https://docs-cortex.paloaltonetworks.com/r/Cortex-XSIAM/Cortex-XSIAM-Documentation/Palo-Alto-Networks-integrations

rgds

Re: XSIAM NGFW Panorama logs onboarding

M.Mickoski — Thu, 25 Sep 2025 10:27:28 GMT

Dear @bridgetlitt

Did you manage to on-board Panorama to XSIAM? We have the same case, where NGFWs are sending logs to Panorama. We would like to use Panorama as central point of logging and ingest the logs directly to XSIAM (via data source). For some reason when we on-boarded Panorama to XSIAM, we don't see any logs coming to XSIAM.

Any feedback or sharing your experience would be appreciate it.

Thanks,