topic Re: Panorama Query Log Fails in Cortex XSOAR Discussions

Panorama Query Log Fails

r_buchwalder — Wed, 03 Feb 2021 09:13:00 GMT

Hello all

I run into a failure on Playbook Panorama Query Logs.

The failure is:

"Set vsys for firewall or Device group for Panorama"

This happen on the GeneralPolling Playbook and there at the task RunPollingCommand.

I've defined Device Group and asking Panorama - but the failure still occours.

Does anyone have any Idea, what this could be?

thanks

roger

Re: Panorama Query Log Fails

bkatzir — Thu, 04 Feb 2021 13:39:40 GMT

Hey Roger.

I was able to query panorama logs successfully.
Where did you define the `Device Group`?
It should be defined in the instance configuration.

Bar.

Re: Panorama Query Log Fails

r_buchwalder — Thu, 04 Feb 2021 14:21:13 GMT

Hello Bkatzir

I've defined the Device Group in the Integrations (where all the settings are defined for Panorama)

It's name is:

Device group - Panorama instances only (write shared for Shared location)

and there is "shared" in it...

Thank you

roger

Re: Panorama Query Log Fails

bkatzir — Thu, 04 Feb 2021 15:25:42 GMT

Can you upload some screenshots or send them to me?
I'm interested in knowing that you are indeed running the commands/Playbooks from the correctly configured instance.
bkatzir@paloaltonetworks.com

Re: Panorama Query Log Fails

r_buchwalder — Thu, 04 Feb 2021 15:47:57 GMT

Hello bkatzir

I've send you just now an E-Mail

Thank you

roger

Re: Panorama Query Log Fails

bkatzir — Sun, 14 Feb 2021 12:37:48 GMT

For future reference:
After a correct configuration of the integration instance we have been encountering

```
calling panorama_get_traffic_logs(‘32936’,)
Query logs failed. Reason is: Query timed out
```

This error comes from the pan-os. the search query job which we are creating is timing out.
I talked with the pan-os team - there is no way to lengthen the TTL of the job via the API.

A case was created to the pan-os team: 01731887