topic Re: syslog alerting in PAN-OS in General Topics

syslog alerting in PAN-OS

niuk — Sun, 05 Feb 2017 17:44:09 GMT

There is an option for syslog alerting by email in PAN-OS , but even if used only for threats , not traffic, results in way too many emails. I am collecting threat events through Logstash into time series database InfluxDB . My very small program is triggered by Logstash, when rate of metrics exceeds given threshold, to query InfluxDB and send result by email. See my post here

Re: syslog alerting in PAN-OS

kiwi — Mon, 06 Feb 2017 10:01:11 GMT

Hi @niuk,

This flood of unwanted logs being forwarded is fixed with PAN-OS 8.0

In this versions we expanded the log forwarding feature. We moved from the granularity of severity to the granularity of a user defined filter for log forwarding purposes.

Log forwarding profiles now have filters that are similar to the filters you can use in the monitor tab ... so now the flood of unwanted logs is a thing of the past.

Cheers !

-Kim.

Re: syslog alerting in PAN-OS

niuk — Mon, 06 Feb 2017 13:58:54 GMT

Is it possible to aggregate alerts ? So not to alert on single threats but on specific rate

btw , I can't setup PAN-OS 8.0 VM on my ESXi 6.5.

Re: syslog alerting in PAN-OS

RG123 — Tue, 15 Aug 2017 17:08:21 GMT

Hi Niuk,

I would be very interested in your setup for shipping logs to Logstash/Kibana. We have AWS Logging setup and I would like to utilize this existing environment if possible.