How to create an alert in SIEM tool for Node failure ( SPN failure )

Kandarp_Desai — Sun, 24 Apr 2022 21:42:55 GMT

Hi Guys,

Is there any way I can create an alert in our SIEM tool for SPN failure? Let's say SPN Europe Central for our environment goes down, then what logs can we track for this?

Re: How to create an alert in SIEM tool for Node failure ( SPN failure )

nikoolayy1 — Fri, 20 May 2022 10:34:18 GMT

Try using the API to send the data to the SIEM:

https://docs.paloaltonetworks.com/prisma/prisma-access/prisma-access-panorama-admin/prisma-access-overview/prisma-access-apis

https://docs.paloaltonetworks.com/prisma/prisma-access/prisma-access-panorama-admin/prisma-access-overview/use-logging-routing-and-edl-information-to-troubleshoot-your-deployment

https://docs.paloaltonetworks.com/prisma/prisma-access/innovation/2-1/prisma-access-panorama-admin/prisma-access-overview/use-logging-routing-and-edl-information-to-troubleshoot-your-deployment

https://docs.paloaltonetworks.com/prisma/prisma-access/prisma-access-panorama-admin/prisma-access-overview/retrieve-ip-addresses-for-prisma-access

Also see if there is an app for you siem like for example Splunk and what information it has:

https://splunkbase.splunk.com/app/2757/

topic How to create an alert in SIEM tool for Node failure ( SPN failure ) in Prisma Access Discussions

How to create an alert in SIEM tool for Node failure ( SPN failure )

Re: How to create an alert in SIEM tool for Node failure ( SPN failure )