MineMeld can analyze PAN-OS syslog messages and match them against live indicators. In case of match, the result of the match (full session info and full details of the indicator) can be sent to a logstash (https://www.elastic.co/products/logstash) instance for forwarding to an external database.
1. Message flow
The following diagram illustrates the message flow of the syslog analysis process.
NOTE: while rsyslog is already installed and configured by the MineMeld loader on the VM, logstash is not installed by default. To save matching results in an external collector logstash must be installed and the syslog should be configured to send results to the logstash instance.
2. Adding a syslog analyzer node
Under CONFIG, click + to add a new node. Select prototype stdlib.localSyslog if you don't need to send results to an external logstash instance, select prototype stdlib.localSyslogToLogstash if you plan to send results to a local logstash instance. Select an aggregator as input.
NOTE: syslog analyzer node supports only one aggregator per type as upstream node. If you have multiple aggregators, you can use multiple syslog analysis nodes or create an additional generic aggregator just for syslog analyzer.
Under NODES, click on the syslog analyzer node. Select STATS in the left menu, and check the counters.
SYSLOG.PROCESSED is the number of syslog messages received from PAN-OS devices and processed. TOTAL_MATCHES is the number of matching indicators found. LOGSTASH.SENT is the number of results sent to the logstash instance (if configured).
5. Evaluating indicators sources
Under NODES, click on the syslog analyzer node. Select SOURCES in the left menu to see the which feeds have produced matching indicators.
6. Configuring logstash (optional)
If at step 2 you have chosen prototype stdlib.localSyslogToLogstash, the syslog analyzer node will send matching results to logstash on port 5514/tcp. Use the following logstash snippet to let logstash listen on port 5514 for messages from MineMeld syslog nodes.