Log Forwarding Articles

PAN-OS 8.0 HTTP Log Integration with Slack   This document assumes that you have already created a Slack team. This sample integration was done with a free Slack account.    Once you have created your Slack team, login to your slack account and add an “Incoming Webhooks” custom integration on the slack website.  During that configuration, you will select the channel where the message will be broadcast (#general in this example).  You will also receive a Webhook URL, and an opportunity to customize the Name and Icon for the source of the message.    Here’s a screenshot of the Incoming Webhooks configuration on the slack website:         Next, configure an HTTP Server Profile in PAN-OS 8.0.  Use the first part of the Webhooks URL in the “Address” field.  In this example, it is “hooks.slack.com” using HTTPS on 443 with the POST HTTP method.  Username/Password are not required for this particular integration.     Personally, I was interested in specific “system” events, so this document focuses on the system-level logs.  Similar integrations could easily be done with traffic, threat, and/or URL logs.     This is what the System format looks like:     In the URI Format box, provide the URI portion of the Slack-provided Incoming Webhooks URL, beginning with /service   The content-type must be application/json   Leave the Parameters field blank.   The Payload input box accepts the default Slack-preferred JSON format as documented here:  https://api.slack.com/incoming-webhooks   No additional escaping is required to add the PAN-OS provided variables to the payload.  In this example, I’m using a rich-formatted “attachments” message from Slack, although the basic format works perfectly as well.    Here are two samples that you should be able to cut&paste:   Rich Format Message:   {     "attachments": [         {             "fallback": "$time_generated $device_name reports $severity $subtype event:\n $opaque\n--------",             "text": "$time_generated: <https://pa0.example.com|pa0> reports $severity $subtype event:\n$opaque",             "color": "danger"         }     ] }     Simple Format Message:   {     "text": "$time_generated $device_name reports $severity $subtype event:\n $opaque\n--------" }   Since I was mainly interested in system-level events, I tied it all together in the Device / Log Settings tab.  I haven’t narrowed-down exactly what I want to see in the slack channel, but for the purposes of this test, I wanted to see non-informational ha or crypto events, so used the following system log filter:   (( subtype eq ha ) or (subtype eq crypto)) and ( severity neq informational )   I matched that with the “Slack System Event 1” created earlier.  The configuration looks like this:   Here’s what I see on my desktop in the Slack app when I initiate a manual HA state change via the PAN-OS GUI:       Looks good on the phone too: Created by Jared Valentine - Systems Engineer
View full article
rkemburu a week ago
11,695 Views
9 Replies
6 Likes
For this example I am using HTTP log forwarding along with IFTTT to get a push notification on my iPhone every time there is a Critical Threat event.   Step 1 Install IFTTT and sign up for an account on your desktop at ifttt.com Once you are logged in through your browser, go to https://ifttt.com/maker and connect Maker to your account.  Next, click on the settings icon, and follow the link to your Maker URL Take note of the example URL, as it contains your API key.   Step 2 Create a new IFTTT applet   Click on the My Applets menu item, then click the New Applet button.  The first half of the applet is If This – click on “+this” and search for the Maker service.  Under the Maker service, select the Web Request Trigger and configure it as shown below   Complete your applet by setting the action to a Notification Step 3   Configure the firewall log forwarding settings   Create a new HTTP log server profile.  Add a new server, setting the Address to maker.ifttt.com.  Configure the server to use either HTTP or HTTPS, and set the HTTP Method to POST.  Under Payload Format, edit the Threat format as shown below     The URL format should be set to: trigger/Critical_Threat/with/key/<<YOUR KEY HERE>>   Note – this is from the URL you got from the Maker service settings in step 1.   Set the Payload to: value1="$device_name"&value2="$threatid"&value3="$receive_time"   Then send a Test log – your IFTTT app should notify you at this point.       Step 4 Configure a log profile for critical threats to use the push service   Create a new log forwarding profile, or edit your existing one to forward Threat logs with the Filter set to (severity eq critical), then add your new HTTP server under forwarding method.  Apply this log forwarding profile to any security policies with Threat Prevention to trigger push notifications automatically.     Created by Darren Rogers.
View full article
rkemburu ‎08-08-2017 04:14 PM
3,692 Views
0 Replies
2 Likes
Disclaimer This document is intended as an easy example on how to leverage action oriented and selective log forwarding in PAN-OS 8.0, not as a comprehensive solution document.   Goal In this document I’ll summarize the information and relevant steps to integrate Palo Alto Networks Next Generation Firewalls with Twilio to send SMS mssages based on something detected by the firewall (use of an application, access to a honeypot, C&C, vulnerability exploits, etc).   Action‐Oriented Log Forwarding using HTTP To enable better integration between your firewall and IT infrastructure, PAN‐OS 8.0 gives you the ability to trigger an action or initiate a workflow to an external HTTP‐based service, when a log is generated on the firewall. You can now forward logs from the firewall or Panorama to an HTTP(S) destination to accomplish the following task more easily. Send an HTTP‐based API request directly to a third‐party service to trigger an action based on the attributes in a firewall log. You can configure the firewall to work with any HTTP‐based service that exposes an API, and modify the URL, HTTP header, parameters, and the payload in the HTTP request to meet your integration needs. This capability when used with the Selective Log Forwarding Based on Log Attributes allows you to forward logs that match a defined criteria so that you can automate a workflow or an action; you do not need to rely on an external system to convert syslog messages or SNMP traps to an HTTP request. 
   Getting Started with Twilio Twilio allows you to add capabilities like voice, video and messaging to our applications. Through a native REST API, Twilio can send messages that we generate from our firewall to network adminstrators.   First, sign up with an account on twilio.com.   Under “Which product do you plan to use first?” choose SMS.   Under “Choose your language” choose Python.   Under “What are you building?” choose IT Service Alerts.   Under monthly interactions choose “Not a production app”.                     Once you have completed the signup page, Twilio will now prompt you to enter your phone number. Make sure this is a number that can receive text messages.     Once you have completed the sign-up, your screen should now look like this.     Select “Get a number” or if that’s not available, go to this URL: https://www.twilio.com/console/phone-numbers/trial-number/modal?capability[]=sms   Twilio will suggest a number for you, if you don’t like it, click “Search for a different number”.   Once you have your number, note it down. In this guide, I’ll be using my number +16693337828, but whenever you see that number replace it with yours.   Note that Twilio starts you off with a trial account with $14.50 in credit. While you are on a trial account, Twiio can only send messages to numbers verified on Twilio. In addition, Twilio prepends all messages sent by trial accounts with “Sent from your Twilio trial account - ”.   In your twilio console, navigate to the dashboard (https://www.twilio.com/console/sms/dashboard). Here’s how mine looks:       If you can’t see your API credentials don’t worry! On the top right, below the black bar, click “Show API Credentials”.   Click the eye to unhide your Auth Token. Now your console should display both your SID and your Auth Token, here’s how mine looks.             Note both of these down. By now you should have stored your Account SID, Auth Token, and Twilio Phone Number somewhere safe.   Palo Alto Networks Next Generation Firewall Configuration Steps - Follow the firewall quick start guide to get a working environment where traffic from users is traversing the firewall and logs are being generated. Create a HTTP Server Profile, use address “api.twilio.com”, protocol “HTTPS”, port “443” and HTTP Method “POST”. Use your account sid and auth token for username and password respectively. Test Server Connection should return “https://api.twilio.com:443 succeeded”. Define the payload format for whichever logs you’d like to forward. I want to forward threat logs to Twilio so, I’ll just edit the Threat Log Payload. In URI format, copy and paste the following string “/2010-04-01/Accounts/{YOUR SID}/Messages”, except where it says YOUR SID, post the SID you got from Twilio before. For example, my SID was “AC4e43865b1e0e705950b7600686135898” so my URL becomes:   /2010-04-01/Accounts/AC4e43865b1e0e705950b7600686135898/Messages   Next, in Payload, copy and paste:   To="YOUR NUMBER"&From="TWILIO NUMBER"&Body=”Body Format Here"   except replace YOUR NUMBER with your personal number and TWILIO NUMBER with the number Twilio gave you. Note that you must prepond the numbers with +1, otherwise this won’t work. In the body, you can choose what you want Twilio to send, here I just want to send the sequence number of the log. Here’s how my completed Payload looks like:   To="+14692345456"&From="+16693337828"&Body="$seqno"   Here are some payload formats you can use for each log type:   Note: Change the {RECEIVER} with your phone number(prepend 1), ex: +14669134345 Change the {TWILIO#} with your twilio number(prepend 1), ex: +15421341368   System To=“{RECEIVER}”&From=“{TWILIO#}”&Body="$time_generated $severity $module $opaque”   Threat To=“{RECEIVER}”&From=“{TWILIO#}”&Body="$time_generated $severity $threatid $thr_category From: $src $srcuser To:$dst"   Traffic: To=“{RECEIVER}”&From=“{TWILIO#}”&Body="$time_generated From: $src $srcuser To: $dst $app"   URL To=“{RECEIVER}”&From=“{TWILIO#}”&Body="$time_generated $category $url_idx From $src $srcuser To: $dst $dstuser with $app"   Data To=“{RECEIVER}”&From=“{TWILIO#}”&Body="$time_generated $category $filedigest $filetype From: $src $srcuser To:$dst $app"   Wildfire To=“{RECEIVER}”&From=“{TWILIO#}”&Body="$time_generated $severity $action $filedigest From:$src To:$dst $dstuser thru: $app"   Once this is all finished, click ok and commit this to panorama. Once it’s finished committing, go back to the HTTP profile you created, select the log type you were just editing in Payload Format. Your URI and payload should pop up. Click “Send Test Log”. If everything was set up correctly, you can expect a text message on your phone!   Now you can create a Log Forwarding Profile with a match list and select the HTTP server profile(in my case “Twilio”) created earlier.   Create a filter and assign it to the Log Forwarding Profile. I used a URL match to simplify the testing. Once it is working you can define an appropriate filter to match what is required on your environment.   Apply the log forwarding profile to the rule/s you want.
View full article
rkemburu ‎08-08-2017 01:49 PM
3,512 Views
0 Replies
Ask Questions Get Answers Join the Live Community
Labels