topic Re: I cannot integrate System Logs for Global Protect Authentication to ArcSight in GlobalProtect Discussions

I cannot integrate System Logs for Global Protect Authentication to ArcSight

aolapade1 — Sat, 05 Dec 2020 06:03:13 GMT

Please I am having difficulties integrating Authentication Logs for Global Protect to ArcSight. I can see the logs on the firewall dashboard (under System Logs) but these logs are not integrated to ArcSight.

Traffic & Threat logs are currently integrated on ArcSight but I need to see login authentication logs for Global Protect.

Please assist me.

Re: I cannot integrate System Logs for Global Protect Authentication to ArcSight

saraya — Tue, 15 Dec 2020 16:56:47 GMT

Auth logs forwarding can be also configured as Traffic & Threat logs from Objects > Log Forwarding. Just select Log Type 'auth'.

For System logs, you will want to configure this from Device > Log settings > System.

Note: If you also enable Panorama/Logging Service as the 'Forward Method', you must configure log forwarding to Panorama.