Understanding Syslog: Strata vs Panorama

sushant1601 — Wed, 29 Jan 2025 09:54:22 GMT

Hello,

I am part of an MSSP, and we ingest data from multiple clients. Some clients forward logs from Panorama, while others use Strata Logging Service.

I would like to understand how we can differentiate logs based on their source—whether they were forwarded from Panorama or Strata.

Is there a specific identifier or static keyword in the logs that indicates they originated from Panorama?

Last year also I tried to look into it but no response. https://live.paloaltonetworks.com/t5/prisma-access-discussions/understanding-prisma-access-syslog-header-amp-messages/td-p/584750

Any help would be appreciated.

Thank you.

Re: Understanding Syslog: Strata vs Panorama

Brandon_Wertz — Wed, 29 Jan 2025 20:14:10 GMT

@sushant1601 wrote:

Hello,

I am part of an MSSP, and we ingest data from multiple clients. Some clients forward logs from Panorama, while others use Strata Logging Service.

I would like to understand how we can differentiate logs based on their source—whether they were forwarded from Panorama or Strata.

Is there a specific identifier or static keyword in the logs that indicates they originated from Panorama?

Last year also I tried to look into it but no response. https://live.paloaltonetworks.com/t5/prisma-access-discussions/understanding-prisma-access-syslog-header-amp-messages/td-p/584750

Any help would be appreciated.

Thank you.

Strata Logging Service Panorama

Add this column to your log search while in Panorama:

"Strata Logging Service" = "Cortex Data Lake"

topic Understanding Syslog: Strata vs Panorama in General Topics

Understanding Syslog: Strata vs Panorama

Re: Understanding Syslog: Strata vs Panorama