topic Re: Does Global Protect support LEEF format on forwarding the log to Qradar in GlobalProtect Discussions

Does Global Protect support LEEF format on forwarding the log to Qradar

Vijaygvasan — Fri, 25 Jun 2021 15:55:08 GMT

Hi Everyone,

Greeting!!

I have a concern regarding the Global protect log forwarding for forwarding the logs to Qradar SIEM Tool.

The concern is about whether Global Protect support for LEEF Format if it does support i want a document that contains the required fields about the Global protect to be sent to the SIEM Tool.

I want to confirm two things whether Global protect does support LEEF format?

If it does support could you please share the required document or the whole details that needs to be in place to forward the log to Qradar from PA devices?

Does Global protect provides public IP address details over the SIEM tool or both public and private address can be shown?

I have also found documents like these but no mentioning of global protect

https://www.ibm.com/docs/en/dsm?topic=SS42VS_DSM/t_dsm_guide_palo_alto_syslog_dest.html

https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA10g000000ClEcCAK

but no where there is a mention for Global protect syslog forwarding to Qradar in LEEF format.

Kindly in need of you assistance guys.

Re: Does Global Protect support LEEF format on forwarding the log to Qradar

Mick_Ball — Fri, 25 Jun 2021 16:58:26 GMT

Some of the details mention the word syslog. This does not literally mean a syslog server but more of an abbreviation of a system logging server of which qrader comes under. Some helpful notes here may be of some assistance..

https://www.ibm.com/docs/en/dsm?topic=SS42VS_DSM/c_dsm_guide_palo_alto_overview.html

Re: Does Global Protect support LEEF format on forwarding the log to Qradar

Vijaygvasan — Sat, 26 Jun 2021 04:20:16 GMT

Hi we have aldready configured for all the fields but we are in need of a global protect LEEF format which is the only one thing that needs to be configured in the syslog server profile.

So im in need of a LEEF format log transfer for Global Protect alone. Kindly share any document regarding the Global protect LEEF format

Thanks for sharing

Re: Does Global Protect support LEEF format on forwarding the log to Qradar

Vijaygvasan — Mon, 28 Jun 2021 02:58:09 GMT

Hi team,

Is there any other related document to use for global protect leef format to integrate logs to Qradar. Kindly share if any docs is available