Configuration settings for Syslog forwarding in Palo Alto UTM

Reply
L0 Member

Configuration settings for Syslog forwarding in Palo Alto UTM

Hi Team,

 

We have integrated Palo Alto UTM v8.1 with LogRhythm. We have enabled syslog on UTM and we are receiving logs on LogRhythm.

 

The issue is not all the fields are getting captured in the logs (we verified this in raw logs received at LogRhythm). Please find the below details which aren't captured. 

 

Threat Logs:
       -Threat ID not captured in logs
       -Complete URL not captured in logs
       - Flags not captured in logs
       - Action is captured in Command field
       - HTTP methods not captured in logs

Configuration Logs: 
    - Command is not captured in logs 
    - User Origin is not Captured in logs
    - Client details used by User for configuration change is not captured in logs
    - Action is captured in logs
    - Configuration path is not captured in logs

URL filtering logs  :
   - Complete URL is not captured in logs
   - HTTP methods not captured in logs
   -Response codes not captured in logs
   
Traffic Logs :
  -Action is captured in logs field
  - Flag is not captured in logs

 

Request you to help me in getting the proper configurations at Palo Alto end so all these details are captured in the logs.

 

Regards,

Mitesh Agrawal

L7 Applicator

Re: Configuration settings for Syslog forwarding in Palo Alto UTM

Hello,

I have seen some of this in the past as well. Are you using the Palo Alto syslog parser?

clipboard_image_0.png

Its a LogRhythm issue more than a PAN issue unfortunately.

 

Regards,

Like what you see?

Show your appreciation!

Click Like if a post is helpful to you or if you just want to show your support.

Click Accept as Solution to acknowledge that the answer to your question has been provided.

The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!

These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the Live Community as a whole!

The Live Community thanks you for your participation!