topic Re: Integration Palo Alto PAN-OS v7.1.X. using Custom Log Format and improve QRadar (LEEF) in General Topics

Integration Palo Alto PAN-OS v7.1.X. using Custom Log Format and improve QRadar (LEEF)

SOC_CSG — Mon, 19 Sep 2016 14:37:56 GMT

Hello Everyone!

We have the following devices:

QRADAR Version 7.2.7
Palo Alto Firewalls PAN_OS 7.0.9
Panorama PAN-OS 7.0.9

Palo Alto Custom Log Format LEEF

If I use the "Custom Log Format" for setup my Syslog Server Profile, as you have shown us in the link I put below:

http://www.ibm.com/support/knowledgecenter/SS42VS_7.2.7/com.ibm.dsm.doc/t_dsm_guide_palo_alto_syslog_dest.html

and in my "Log Forwarding Profile" In addition to enabling my Syslog, I have also enabled a 'panorama' as it shown in the image I put below:

https://live.paloaltonetworks.com/t5/Configuration-Articles/How-to-Create-a-Profile-to-Forward-Logs-to-Panorama/ta-p/54038

The "Custom Log Format" I used in my Syslog Server Profile, can affect my panorama or the format of my panorama?

Thanks and best regards,

Diego C.

Re: Integration Palo Alto PAN-OS v7.1.X. using Custom Log Format and improve QRadar (LEEF)

reaper — Mon, 19 Sep 2016 14:45:35 GMT

Hi Diego

not fully sure what you want to know, but the 'panorama' flag will forward logs in PANW proprietary format to panorama, and in addition will send a copy in your custom log format to your syslog server

the syslog setting does not affect panorama logging

Re: Integration Palo Alto PAN-OS v7.1.X. using Custom Log Format and improve QRadar (LEEF)

SOC_CSG — Mon, 19 Sep 2016 15:40:57 GMT

Thanks

I have searched for information about this Because I am interested this topic, but I have not found anything.
But your answer it seems me correct. Thanks again.

Re: Integration Palo Alto PAN-OS v7.1.X. using Custom Log Format and improve QRadar (LEEF)

reaper — Tue, 20 Sep 2016 08:36:13 GMT

Hi Diego

my pleasure!

just for the record: all 4 log forwarding profiles (panorama, snmp, email and syslog) have their own log format output and none interfere with each other