topic Re: Palo Alto firewalls alerts in General Topics

Palo Alto firewalls alerts

PA-NewBie — Mon, 11 Apr 2022 10:52:50 GMT

Hello,

Recently we have started working on enabling email alerts for our Palo Alto firewalls. One of the alert is for interface and HA status change alerts. Could you please let me know what can I do to enable same? Do I need any external tool for it? Any sort of help would be appreciated.

Re: Palo Alto firewalls alerts

PavelK — Mon, 11 Apr 2022 12:24:42 GMT

Thank you for the post @PA-NewBie

Interface and HA status related events are recorded in system logs. Below is a KB describing how to enable email alerts for system logs:

https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA10g000000ClGjCAK

Enabling email alert for system logs can be noise especially if you enable all severities. If you want to narrow down only HA logs, then you can use this filter: ( subtype eq ha ) in the system log setting:

Kind Regards

Pavel

Re: Palo Alto firewalls alerts

PA-NewBie — Tue, 12 Apr 2022 00:18:49 GMT

Thank you Pavel. This is helpful.
So basically if I want to add same alert for interface status change also then need to put that event under filter right?

I would give a try the way you have mentioned and update you. Thank you

Re: Palo Alto firewalls alerts

PA-NewBie — Tue, 12 Apr 2022 08:35:42 GMT

Hi Pavel,

Thanks again! I was able to set alerts for HA state change.