topic how to forward global protect logs to SIEM in GlobalProtect Discussions

how to forward global protect logs to SIEM

JingKai — Tue, 18 Oct 2022 05:46:14 GMT

Hi All,

May i know is it possile to forward global protect logs to SIEM?

The current version is 8.1.23-h1

I found the below KB but is for 9.1 and higher.

https://docs.paloaltonetworks.com/globalprotect/10-1/globalprotect-admin/logging-for-globalprotect-in-pan-os/forward-globalprotect-logs-to-an-external-service-in-pan-os

May i know if there is any KB for version 8.1.X?

Re: how to forward global protect logs to SIEM

aleksandar.astardzhiev — Sun, 27 Nov 2022 22:30:41 GMT

Hi @JingKai ,

With PanOS 9.1 all log related to GlobalProtect were moved to dedicated log type, which made it easier to search and filter.

Before that GP logs were subtype of System logs.

So on your 8.1 you should be able to forward GP logs by creating System logs forwarding profile, which is using filter and have your SIEM collector. Something like that: