Frequently encountered problems in Onboarding AIOps

[svenkatarama]

Problems with activating the Free tier of AIOps? In general, it is due to something trivial that has been overlooked. Based on our beta program, these were the top 3 reasons customers usually had issues in standing up an instance of the Free tier of AIOps.

1. During AIOps activation flow, there is no CDL tenant in the drop-down list to point to.

If the customer is not already a Cortex Data Lake (CDL) logging service customer, a new telemetry-only CDL instance is created for them when telemetry from the first firewall appears. Telemetry generation and sending on the device's side is a batch process, and it may take as much as 2 hours from the time the user turns on telemetry on the PAN-OS 10.0+ device for the CDL instance to be created. Please check back in a little while to see if the instance exists.

2. The "Activate" button is missing on the Hub (https://apps.paloaltonetworks.com) for the user.

This hub requires the user to have App Admin privileges to enable the instantiation of the AIOps app. Please use the gear icon on the top right, under Manage Permissions to assign the user App Admin privileges to instantiate AIOps

3. The firewall data is not showing up in the App.

A few things could be happening here - we have seen customers hit these issues -

• The user is not on the PAN-OS 10.0 or later.
• The user thinks they have started the telemetry process, but the commit did not complete. Check the UI on the firewall (Device>Setup>Telemetry) to see if it is reporting success/error messages
• There is a firewall/proxy upstream that blocks the telemetry traffic. Check the app-ids and FQDNs required for device telemetry here and enable them on the upstream device
  • https://docs.paloaltonetworks.com/aiops/aiops-for-ngfw/get-started-with-aiops/fqdns.html
  • https://docs.paloaltonetworks.com/cortex/cortex-data-lake/cortex-data-lake-getting-started/get-start...

[Jason_Lieberman]

I am seeing a new error where it says that telemetry data is not being sent for the past week but when I look at activity/log viewer, the logs are current.