topic Re: threat syslog forwarding panorama -> ossim in General Topics

threat syslog forwarding panorama -> ossim

LCMember436 — Wed, 11 Jul 2012 11:55:41 GMT

HI,

I have some problems with forwarding threat syslog events from Panorama to OSSIM.

We have several PA and they forward their threat logs to our Panorama Appliance via SSL

Now we need this Threatlogs at our OSSIM System as well.

Because of, Policy restrictions we can not syslog directly from our PAs to our OSSIM System,

so i want use the Panorama instead.

But the only syslog information i got are general information logs

How do i get my Panorama to forward the threatlogs to our OSSIM System?

thx

Pascal

Re: threat syslog forwarding panorama -> ossim

nayubi — Mon, 16 Jul 2012 19:06:26 GMT

First make sure your device is sending all severities to panorama. Next check to make sure panorama is sending all log forwarding to the configured syslog under the objects tab and log forwarding.

Re: threat syslog forwarding panorama -> ossim

LCMember436 — Tue, 17 Jul 2012 16:12:07 GMT

Under Objects->Log Forwarding-->Log Type->Threat

For all Severenity there ist the Syslog Server and Panorama configured.

So the PA send all Logs to the Panorama and the syslog server, but because of Firewall policies between the PAs and the syslog server it is not allowed to forwoard syslog through the firewall

And the PAs communicate over ssl witch the panorma which is allowed

there are no firewall restrictions between Panorama and the syslog server

So I want the Panorama to forward the threat logs from all our PAs to the syslog server,

but the only syslogs the Panorama forwards are System logs from the Panorama itself but not any of the logs which the PAs send to the Panorama

So my Problem is how to configure the log forwarding of the threatlogs, which where send over ssl to the panorama,

now from the panorama to the syslog server

Re: threat syslog forwarding panorama -> ossim

opiedrah — Wed, 01 Aug 2012 18:25:27 GMT

Bumping this thread. Also interested if anyone has seen this. Thanks.