Free visualisation (NOC screenboards) for PANW firewall performance/monitoring using Elastic Stack

Retired Member — Mon, 22 Jan 2018 09:49:38 GMT

I was looking for ways to provide 'at-a-glance' visualisation of PANW firewall health, including traffic, threat, system & config logs. The stock capabilities, including ACC, are decent but somewhat lacking in providing NOC-style dashboards.

Inspired by other visualisation solutions I've seen around, such as the Splunk App & Graylog dashboards, I spent the last 48 hours tinkering with ElasticStack 6.1 and came up with a series of 9 dashboards (and 66 visualisations) that can be derived from PANW Firewall syslogs.

Dashboard examples here;

There's another 4 dashboards too (Config, Threat [Warning+], URL & Blocked URLs)

The process of spinning up a Linux/Windows VM & installing Elastic Stack is pretty painless. Once done, dropping in the files required to create a syslog instance, ingest the syslogs and output the visualisations/dashboard is quite easy

I've put all the relevant information, including a full tutorial on installing Elastic Stack, up on GitHub: https://github.com/sm-biz/paloalto-elasticstack-viz

If anyone's interested, have a look and provide feedback. Any other types of dashboards that would be useful?

(Note: Wildfire dashboard is still-to-come, I need to generate some sample data)

Re: Free visualisation (NOC screenboards) for PANW firewall performance/monitoring using Elastic Sta

Chander — Tue, 17 Sep 2019 18:18:17 GMT

Can you please post any video tutorial for this ELK + palo alto log monitoring.

Re: Free visualisation (NOC screenboards) for PANW firewall performance/monitoring using Elastic Sta

VincentPresogna — Wed, 18 Sep 2019 20:54:56 GMT

Awesome. Thanks. Took me about a day to get this up and running on Ubuntu 18. The installation of Java 8 has changed, the PPA repo is no longer a viable solution, had to install it manually. The only other thing that tripped me up was the sysylog port, it was 5514 instead of the usual 514. Once I changed that on the syslog forward in the PA, everything started flowing ing in.

topic Free visualisation (NOC screenboards) for PANW firewall performance/monitoring using Elastic Stack in General Topics

Free visualisation (NOC screenboards) for PANW firewall performance/monitoring using Elastic Stack

Re: Free visualisation (NOC screenboards) for PANW firewall performance/monitoring using Elastic Sta

Re: Free visualisation (NOC screenboards) for PANW firewall performance/monitoring using Elastic Sta