topic Re: Doubt about costomize config log paloalto in General Topics

Doubt about costomize config log paloalto

Alpalo — Thu, 26 Sep 2024 11:43:30 GMT

Hi team

The security auditors ask us if in the Config Log it is possible to have an additional field in the log that links all the events of a rule change with a ticket id external to Palo Alto.

That is to say that in the attached logs an additional field with the Ticket appears in a mandatory way to be able to link the event with the ticket:

any idea?

Regards

Re: Doubt about costomize config log paloalto

JayGolf — Thu, 26 Sep 2024 20:03:59 GMT

Hi @Alpalo ,

Unfortunately, you won't be able to add custom fields directly. Sounds like something where you would have to pull config logs via python, append those logs with the ticket#, and import those logs to an external ticketing system/database.

Good luck!

Re: Doubt about costomize config log paloalto

BPry — Fri, 27 Sep 2024 17:21:34 GMT

@Alpalo,

Couple possible solutions to this:

Move the configuration into source control - This requires changing how people are used to configuring things, but it does give you the ability to ensure that every single change can be linked to a ticket easily. Requires that people learn new things, but ultimately gives you exactly what you're looking for and a process to review changes quite a bit easier.
Commit Descriptions - This can solve this issue in a round about aspect as you can tie each commit to the tickets that the change addresses. Still some manual processing but it functions.
Change in process - Changes to the firewall are only done with a change ticket in whatever your ticket solution is and the security team looks at those tickets instead of firewall logs. Administrators are not allowed to deviate outside of this process without a ticket detailing what is done.

Re: Doubt about costomize config log paloalto

OwenGray — Thu, 10 Oct 2024 07:16:00 GMT

Thank you for answering, I will try it.