LEEF Format

AhmedSadek — Tue, 01 Nov 2022 10:25:53 GMT

Dear Team,

Appreciate your feedback as we facing challenges with LEEF format when we configure a Syslog server with a custom log to allow integration with the Qradar SIM solution.

We use the same format as mentioned on the IBM website below,

https://www.ibm.com/docs/en/dsm?topic=panps-creating-syslog-destination-your-palo-alto-pa-series-device

But it is not working with PAN-OS 10.2

So appreciate your feedback, If you have any workaround solution for this format.

Thanks

Re: LEEF Format

BPry — Tue, 01 Nov 2022 17:47:01 GMT

@AhmedSadek,

Don't use QRadar, but it doesn't look like IBM has updated any of this information since PAN-OS 9.1, but that shouldn't be preventing the logs from hitting QRadar. The logs simply wouldn't actually be complete as they wouldn't include any of the new fields, that however shouldn't matter that much unless QRadar is doing some validation on their end and dropping it because it can't extract things properly.

I'd reach out to IBM and let them know that new fields exist and they need to update their integrations to actually account for that. In the meantime, you could always just build out your own extractors.

topic LEEF Format in General Topics

LEEF Format

Re: LEEF Format