topic Re: send BOTNET event realtime Logging to Log receiver in Automation/API Discussions

send BOTNET event realtime Logging to Log receiver

Mark-Nakrop — Wed, 23 May 2012 12:59:20 GMT

Does PAN has any solution to send BOTNET event to Log receiver for example; SYSLOG?

Re: send BOTNET event realtime Logging to Log receiver

mikand — Wed, 23 May 2012 19:31:22 GMT

I could only find the report feature of the botnet function in the manual so I guess the answer to your request is: Currently it cannot but you can contact your sales engineer to file this as a feature request (unless someone from PAN who lurks in here have a different answer to provide? 😉

Re: send BOTNET event realtime Logging to Log receiver

bspilde — Wed, 23 May 2012 19:34:14 GMT

They do have a feature request category on their support ticket system as well.

From: mikand <live@paloaltonetworks.com<mailto:live@paloaltonetworks.com>>

Reply-To: live <live@paloaltonetworks.com<mailto:live@paloaltonetworks.com>>

To: Brad Spilde <brad.spilde@daktronics.com<mailto:brad.spilde@daktronics.com>>

Subject: Re: send BOTNET event realtime Logging to Log receiver

Re: send BOTNET event realtime Logging to Log receiver

Mark-Nakrop — Thu, 24 May 2012 03:50:20 GMT

Can we did XML API to send CSV log of Botnet by the way.

Re: send BOTNET event realtime Logging to Log receiver

SRA — Thu, 07 Jun 2012 01:22:55 GMT

There are no Botnet logs, just predefined Botnet reports that run daily. You can use the XML API to get the botnet report (from PAN-OS 4.1.3) as :http(s)://firewall/api/?type=report&reporttype=predefined&reportname=botnet