XSIAM logs from Palo Alto Firewall using syslog

bridgetlitt — Fri, 21 Aug 2026 05:33:34 GMT

https://cortex-docs.paloaltonetworks.com/cortex-xsiam/configure-cortex-xsiam/cortex-xsiam-data-sources/palo-alto-networks-integrations/next-generation-firewall/ingest-next-generation-firewall-logs-using-the-syslog-collector

Why does the official guide only highlight Custom Formats for Traffic, Threat, URL, and File data logs? What about other NGFW/panorama log types, such as System logs where can I find the format for those?

Does Cortex XSIAM fail to parse remaining CEF logs properly, or does this mean other log categories are unsupported?

Re: XSIAM logs from Palo Alto Firewall using syslog

susekar — Wed, 26 Aug 2026 01:59:19 GMT

Hello @bridgetlitt ,

Greetings for the day.

-Cortex XSIAM’s standard CEF/Syslog ingestion officially supports only four NGFW log types: Traffic, Threat, URL, and File Data. These are automatically parsed into their respective datasets.

-Other logs such as System, Authentication, GlobalProtect, Tunnel, and User-ID are not officially supported through the standard CEF method and may not parse correctly.

Note: For collecting the full range of NGFW logs, CLCS / Strata Logging Service is the recommended approach, as it provides native parsing for these additional log types.Also, avoid using PANW/PALO as the vendor or NGFW_CEF as the product for unsupported log types, as these are reserved for the built-in parser.

------------------------------------

Through CLCS, XSIAM natively supports and parses a broader spectrum of NGFW/Panorama log types into dedicated datasets, including:

System Logs: panw_ngfw_system_raw
Authentication Logs: panw_ngfw_auth_raw
GlobalProtect Logs: panw_ngfw_globalprotect_raw
HIP Match Logs: panw_ngfw_hipmatch_raw
User-ID Logs: panw_ngfw_userid_raw
Traffic, Threat, URL, and File Data Logs

If you feel this has answered your query, please let us know by clicking like and on "mark this as a Solution".

Thanks & Regards,
S. Subashkar Sekar

topic Re: XSIAM logs from Palo Alto Firewall using syslog in Cortex XSIAM Discussions

XSIAM logs from Palo Alto Firewall using syslog

Re: XSIAM logs from Palo Alto Firewall using syslog