topic Re: Predefined syslog filters list please? in General Topics

Predefined syslog filters list please?

MydisplayNameis3 — Sat, 08 Feb 2014 20:03:53 GMT

Per 6.0's syslog listener feature (pasted below), can you please provide the list of current vendor filters?

" Determine whether there is a pre-defined syslog filter for your particular syslog sender(s).

Palo Alto Networks provides several

pre-defined syslog filters, which are

delivered as Application content updates and are therefore updated dynamically as new filters are developed."

Re: Predefined syslog filters list please?

HULK — Sat, 08 Feb 2014 21:35:08 GMT

Hello Sir,

The Filters will be provided through content updates as they become available. At this time, there are not any pre-defined Filters so you would need to manually create them.

Thanks

Re: Predefined syslog filters list please?

MydisplayNameis3 — Sat, 08 Feb 2014 21:45:00 GMT

So if I understand correctly, you released the feature and documented it yet have yet to develop or release any pre-defined filters? <sigh>

You would have had a day 1 win if you had launched this feature with at least a few pre-defined filters. This is why your customers are so weary of new feature releases - they feel half-baked.

If you're seeking any advice on which predefined filters to create, allow me to selfishly ask for Cisco Wireless Controller (authenticated users), Cisco ASA (VPN users), Cisco IOS, Arista network switches, etc.

Re: Predefined syslog filters list please?

HULK — Sat, 08 Feb 2014 21:53:12 GMT

Give me some time to test and i will update you soon.

Thanks

Re: Predefined syslog filters list please?

MydisplayNameis3 — Sat, 08 Feb 2014 22:09:00 GMT

Great, thanks! Looking forward to it!

Re: Predefined syslog filters list please?

rmonvon — Sun, 09 Feb 2014 03:03:03 GMT

Hopefully this helps. App Content version 418 or higher is needed. Thanks.

Re: Predefined syslog filters list please?

MydisplayNameis3 — Mon, 10 Feb 2014 00:18:12 GMT

Thanks, it does! Now just hoping for CIsco Wireless Controller to be added..... but a great start!

Re: Predefined syslog filters list please?

dpenhall — Tue, 11 Feb 2014 06:19:22 GMT

Any chance you can supply those as filter updates in a format that the 6.0 UserID agent can use ? We are a long way off updating to 6.0.0 on the gateways so getting this feature in the UserID agent is great...its just getting it to work is a problem.

Cisco ISE filters would be great as well .

Re: Predefined syslog filters list please?

MydisplayNameis3 — Tue, 11 Feb 2014 15:54:31 GMT

Has APP content 418 been released yet? I clicked "checked now" on a PAN 6.0 and it shows 417.

Re: Predefined syslog filters list please?

HULK — Tue, 11 Feb 2014 16:01:49 GMT

Content version 418 is not yet released. Most probably, it will be available before today EOD.

Thanks

Re: Predefined syslog filters list please?

sraghunandan — Tue, 11 Mar 2014 18:44:39 GMT

version 418 has been released and the filters are now available under Device > User Identification > User Mapping

Re: Predefined syslog filters list please?

dmaynard — Tue, 11 Mar 2014 22:25:46 GMT

Cisco Wireless controller does not send username and ip information via syslog. Can send information via SNMP trap or collect information snmp walk.

See cisco document regarding getting information from wireless controller.

Cisco WLC SNMP Historical User Statistics Monitoring (w/ Syslog or Splunk) | Cisco Technical Support Forum

Re: Predefined syslog filters list please?

pulukas — Wed, 12 Mar 2014 01:48:40 GMT

There is also now a official tech document on the configuration of Predefined syslog filters.

How to Locate the Predefined Syslog Filters in PAN-OS