topic Re: Palo Alto integration with Azure Sentinel in General Topics

Palo Alto integration with Azure Sentinel

ShailUpadhyay — Fri, 17 Feb 2023 08:22:40 GMT

Hi All,

We are currently working on setting up the Azure Sentinel for our environment and Integration of PA firewalls with Sentinel is our top most priority.

However we need to understand what will be the best approach for integration.

Should we integrate independent firewalls with Azure Sentinel or Panorama with Azure Sentinel or both firewalls and Panorama with Azure Sentinel ? Also what factors drive this decision. Any leads will be helpful

Thank you

Re: Palo Alto integration with Azure Sentinel

PavelK — Sat, 18 Feb 2023 02:48:45 GMT

Hello @ShailUpadhyay

in our case, we have been using following scenario for about 3 years:

Logs are sent from Firewalls to Panorama, then from Panorama to logstash, then from logstash to Sentinel. We never really run into any issue. The only issue we came across once was we started to see a log loss between Firewalls and Panorama which naturally resulted missing logs in Sentinel. This was eventually resolved by adding additional log collectors in log collector group.

Personally, I believe that having all Firewalls to send logs to Panorama and then let Panorama to send all logs to Sentinel has many benefits. For example: ease of management or ease of troubleshooting as you have only one place to look into.

On the other hand if you have many firewalls with a high log volume, then you might hit ingestion rate limitation of Panorama where Panorama would be a bottleneck (This of course depends on Panorama model and log collector design). In this case having Firewalls to send logs directly to Sentinel would be a better option.

Having both Firewalls as well as Panorama to send logs to Sentinel would be the last choice that I would preferably avoid. You will end up with log duplication.

Kind Regards

Pavel

Re: Palo Alto integration with Azure Sentinel

ShailUpadhyay — Mon, 20 Feb 2023 10:25:08 GMT

Thank you Pavel.

So, I can assume that by integrating Panorama with Sentinel will not result in any loss / miss of logs compare to integrating individual firewalls.

Re: Palo Alto integration with Azure Sentinel

PavelK — Wed, 22 Feb 2023 00:14:34 GMT

Hello @ShailUpadhyay

thank you for reply.

It should not cause any issue. In our case we at some point were hitting the maximum log collector ingestion rate. Unless you are in the high traffic log environment you should not worry.

Kind Regards

Pavel