topic Re: Where is the documentation that describes Syslog Log types formats for Palo Alto Firewalls? in General Topics

Where is the documentation that describes Syslog Log types formats for Palo Alto Firewalls?

SoloSigma — Mon, 23 Sep 2024 18:06:14 GMT

On my Ubuntu Server I receive syslogs, that may look like this:

<14>Sep 23 20:01:11 PA-440 1,2024/09/23 20:01:11,021201133296,TRAFFIC,end,2561,2024/09/23 20:01:11,10.10.10.103,20.190.177.21,192.168.10.20,22.120.127.11,rule1,,,ssl,vsys1,trust,untrust,ethernet1/2,ethernet1/1,LFP LimaCharlie FW,2024/09/23 20:01:11,121977,1,60637,443,39335,443,0x40041c,tcp,allow,23588,6260,17328,30,2024/09/23 20:00:56,1,any,,7408146363088945002,0x0,10.0.0.0-10.255.255.255,France,,13,17,tcp-fin,0,0,0,0,,PA-440,from-policy,,,0,,0,,N/A,0,0,0,0,a6854971-45bb-499a-86fd-30008807b6e1,0,0,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,2024-09-23T20:01:11.522+02:00,,,encrypted-tunnel,networking,browser-based,4,"used-by-malware,able-to-transfer-file,has-known-vulnerability,tunnel-other-application,pervasive-use",,ssl,no,no,0

I understand that there are different log types that can be sent, including

Config
System
Threat
Traffic
URL
Data
WildFire
Tunnel
Authentication
User-ID
HIP Match
Globalprotect
Iptag
Decryption

Are there any documentation that shows me how the different log types are constructed?
I need it in order to create a Regex that will convert syslog into JSON format.

Re: Where is the documentation that describes Syslog Log types formats for Palo Alto Firewalls?

OtakarKlier — Mon, 23 Sep 2024 19:52:56 GMT

Hello,

Your SIEM might already be able to do this? I dont have an example that I can share, but its along similar lines of comma separated values. You could setup a simple syslog server to capture a few logs of each and then base it from there?

Here is what is shows in the help file of hte two different types of syslogs the firewall can send.

Select the value that maps to how your Syslog server uses the facility field to manage messages. For details on the facility field, see RFC 3164 (BSD format) or RFC 5424 (IETF format).

Just a few thoughts.

Re: Where is the documentation that describes Syslog Log types formats for Palo Alto Firewalls?

Brandon_Wertz — Mon, 23 Sep 2024 20:16:34 GMT

@SoloSigma wrote:

On my Ubuntu Server I receive syslogs, that may look like this:

<14>Sep 23 20:01:11 PA-440 1,2024/09/23 20:01:11,021201133296,TRAFFIC,end,2561,2024/09/23 20:01:11,10.10.10.103,20.190.177.21,192.168.10.20,22.120.127.11,rule1,,,ssl,vsys1,trust,untrust,ethernet1/2,ethernet1/1,LFP LimaCharlie FW,2024/09/23 20:01:11,121977,1,60637,443,39335,443,0x40041c,tcp,allow,23588,6260,17328,30,2024/09/23 20:00:56,1,any,,7408146363088945002,0x0,10.0.0.0-10.255.255.255,France,,13,17,tcp-fin,0,0,0,0,,PA-440,from-policy,,,0,,0,,N/A,0,0,0,0,a6854971-45bb-499a-86fd-30008807b6e1,0,0,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,2024-09-23T20:01:11.522+02:00,,,encrypted-tunnel,networking,browser-based,4,"used-by-malware,able-to-transfer-file,has-known-vulnerability,tunnel-other-application,pervasive-use",,ssl,no,no,0
I understand that there are different log types that can be sent, including

Config

System

Threat

Traffic

URL

Data

WildFire

Tunnel

Authentication

User-ID

HIP Match

Globalprotect

Iptag

Decryption

Are there any documentation that shows me how the different log types are constructed?
I need it in order to create a Regex that will convert syslog into JSON format.

Maybe this is what you're looking for? The LEEF fields?

https://docs.paloaltonetworks.com/strata-logging-service/log-reference/network-logs/network-traffic-log/network-traffic-leef-fields

Re: Where is the documentation that describes Syslog Log types formats for Palo Alto Firewalls?

SoloSigma — Tue, 24 Sep 2024 06:22:34 GMT

My SIEM tool is LimaCharlie, and it does not parse Palo Alto logs out of the box. Because of this I will have to create some Regex to convert Syslogs to JSON format.

Re: Where is the documentation that describes Syslog Log types formats for Palo Alto Firewalls?

Raido_Rattameister — Tue, 24 Sep 2024 12:26:37 GMT

https://docs.paloaltonetworks.com/pan-os/11-0/pan-os-admin/monitoring/use-syslog-for-monitoring/syslog-field-descriptions/threat-log-fields#id83052cb2-4798-4f9c-abf8-e0b929ce7a3b

https://docs.paloaltonetworks.com/pan-os/11-0/pan-os-admin/monitoring/use-syslog-for-monitoring/syslog-field-descriptions/traffic-log-fields#idbe18d2d4-9eb8-4966-bec8-df3a6de70e66