topic Re: Are there way that fw forward url & data filtering logs to ESM system by syslog?? in General Topics

Are there way that fw forward url & data filtering logs to ESM system by syslog??

KiCheon.Lee — Wed, 24 Jul 2013 08:38:12 GMT

Hello,

I know there are not log type of url & data filtering on syslog server profile.

But my customer want to receive two logs to ESM system by syslog.

Are there ways?

Please let me know it if there are.

And I have a question.

Panorama is received this logs(url , data) from FW.

Why is it able to receive?

Thanks.

Re: Are there way that fw forward url & data filtering logs to ESM system by syslog??

goku123 — Wed, 24 Jul 2013 12:27:07 GMT

URL logs are stored as "informational" threat logs on the PA device.

So, in your log forwarding profile, under Threat, enable "informational" severity. This should enable URL log forwarding to your syslog server.

Something similar to your question was discussed in : https://live.paloaltonetworks.com/message/13326#13326

Re: Are there way that fw forward url & data filtering logs to ESM system by syslog??

dreputi — Thu, 25 Jul 2013 03:35:58 GMT

Like achitwadgi said: If you are receiving URL logs on panorama, then the firewall should have had Log forwarding configured. In GUI:Objects>Log Forwarding Profile, there should have been a profile created with Panorama check box checked for "informational" severity. This profile should then be applied to the security rules.

https://live.paloaltonetworks.com/docs/DOC-2173

Re: Are there way that fw forward url & data filtering logs to ESM system by syslog??

KiCheon.Lee — Thu, 01 Aug 2013 09:07:21 GMT

Thank you for your answer, achitwadgi and dreputi.

FWs send url logs by threat information severity of syslog. (The value of threat subtype field is url)

Also FWs send file logs by threat low severity of syslog. (The value of threat subtype field is file)

Low severity include alert , allow , forward and deny actions on file log.

Wildfire-upload-skip action is information severity.

Are they right?