MineMeld can analyze PAN-OS syslog messages and match them against live indicators. In case of match, the result of the match (full session info and full details of the indicator) can be sent to a logstash (https://www.elastic.co/products/logstash) instance for forwarding to an external database.
The following diagram illustrates the message flow of the syslog analysis process.
NOTE: while rsyslog is already installed and configured by the MineMeld loader on the VM, logstash is not installed by default. To save matching results in an external collector logstash must be installed and the syslog should be configured to send results to the logstash instance.
Under CONFIG, click + to add a new node. Select prototype stdlib.localSyslog if you don't need to send results to an external logstash instance, select prototype stdlib.localSyslogToLogstash if you plan to send results to a local logstash instance. Select an aggregator as input.
NOTE: syslog analyzer node supports only one aggregator per type as upstream node. If you have multiple aggregators, you can use multiple syslog analysis nodes or create an additional generic aggregator just for syslog analyzer.
Please refer to the PAN-OS Administration guide for instructions on how to configure log forwarding to a syslog server on PAN-OS (https://www.paloaltonetworks.com/documentation/70/pan-os/pan-os/monitoring/configure-log-forwarding....). By defeault the syslog server on the VM listens for PAN-OS syslog messages on port tcp/13514.
Under NODES, click on the syslog analyzer node. Select STATS in the left menu, and check the counters.
SYSLOG.PROCESSED is the number of syslog messages received from PAN-OS devices and processed. TOTAL_MATCHES is the number of matching indicators found. LOGSTASH.SENT is the number of results sent to the logstash instance (if configured).
Under NODES, click on the syslog analyzer node. Select SOURCES in the left menu to see the which feeds have produced matching indicators.
If at step 2 you have chosen prototype stdlib.localSyslogToLogstash, the syslog analyzer node will send matching results to logstash on port 5514/tcp. Use the following logstash snippet to let logstash listen on port 5514 for messages from MineMeld syslog nodes.
port => 5514
host => '127.0.0.1'
codec => 'json_lines'
NOTE: logstash is not installed by default on the VM. Please refer to the following link for instructions on how to install logstash and an ELK stack on the VM or on an external VM:
- official site https://www.elastic.co/
- step by step tutorial from DigitalOcean community https://www.digitalocean.com/community/tutorials/how-to-install-elasticsearch-logstash-and-kibana-el...
Kibana view of the matching results: