topic Clarification on Strata Logging Service and eDLP Log Forwarding in General Topics

Clarification on Strata Logging Service and eDLP Log Forwarding

sushant1601 — Thu, 01 Oct 2026 14:33:37 GMT

Hi Team,

We are an MSSP and have received a request to support eDLP. Since we do not have access to these devices/services in our environment, we primarily rely on the available documentation to understand and support them.

I have a few questions regarding how Strata Logging Service (SLS) works.

We currently support Prisma Access using SLS. While reviewing the documentation, I noticed that eDLP logs can also be forwarded through SLS. This raised a few questions:

SLS configuration and log differentiation
When configuring SLS, is there any difference in the configuration for Prisma Access versus eDLP?

If SLS can receive and forward logs from Prisma or other services, how can we differentiate the logs at the SLS level when forwarding them? I found some filtering option but not sure how it works. Similarly, when the logs reach the third-party SIEM, is there a specific field, source, channel, or other identifier that can be used to distinguish Prisma Access logs from eDLP logs?
Direct log forwarding to a third-party SIEM
Is there any option to forward eDLP logs directly to a third-party SIEM from the cloud, for example, using an HTTP webhook(HTTP POST), without using SLS? Or is SLS mandatory for forwarding eDLP logs to a third-party SIEM?

It would be greatly appreciated if you could provide some clarity on the overall SLS architecture and workflow—specifically, how Prisma stores and forwards logs through SLS, and how eDLP and other services send their logs through SLS.

This will help us better understand the architecture and determine how we should support eDLP log ingestion into our SIEM.

Thank you.

Re: Clarification on Strata Logging Service and eDLP Log Forwarding

JayGolf — Tue, 06 Oct 2026 04:55:53 GMT

Hi @sushant1601 ,

There are two slightly different logging paths here.

For Prisma Access / NGFW logs, Strata Logging Service is the central logging layer. You can forward specific log types such as Traffic, Threat, Data Filtering, GlobalProtect, etc, and apply filters before sending them to your SIEM.

For Enterprise DLP incident and audit logs, SLS is not required. Enterprise DLP has its own log forwarding configuration and can send those logs directly to a third-party SIEM using syslog.

Re: Clarification on Strata Logging Service and eDLP Log Forwarding

sushant1601 — Thu, 08 Oct 2026 12:44:04 GMT

Hi @jay

Thank you for your response.

Could you please share the steps or documentation for forwarding eDLP logs directly to the SIEM without using SLS? The documentation I found describes forwarding logs via SLS.

Thank you again for your help. Really Appreciate it.

Regards,

Sushant