- Access exclusive content
- Connect with peers
- Share your expertise
- Find support resources
Enhanced Security Measures in Place: To ensure a safer experience, we’ve implemented additional, temporary security measures for all users.
on 01-18-2019 02:22 PM - edited on 08-26-2019 12:41 PM by Retired Member
Confirm you are receiving LEEF log format in QRadar, navigate to the “Log Activity” tab of QRadar and create an advanced search:
SELECT UTF8(payload) FROM events WHERE devicetype=206
No Results
Check log forwarding configurations in the Firewall/Panorama. Refer to the getting started guide on how to setup log forwarding from the Firewall/Panorama.
Results
Double check that the log contains the word LEEF
in the payload.
If LEEF
does not exist in the payload then you have setup log forwarding with standard log format. By default QRadar expects logs to be in LEEF format. Refer to the getting started guide on how to send logs in LEEF format.
NOTE: Make sure you are using LEEF format for PAN-OS v7.0-v8.0+
If LEEF exist in the payload, then there may be an issue with the custom properties.
Confirm each field is being parsed by running this search in the "Log Activity" tab of QRadar.
SELECT "PANW-type", "PANW-subtype", "PANW-category", "PANW-filename", "PANW-threatid", "PANW-vendor-action" from events WHERE "PANW-type"='THREAT'
The columned returned should have values in them. If you are receiving "NA" in the column then there is an issue with the parser.
Navigate to the admin panel and click on "Extensions" and c
onfirm that the "Palo Alto Networks LEEF to Standard log" extension
is NOT installed.
This extension is only required if if logs are being sent in the standard log format. This format is not recommended by QRadar. The recommended log format is LEEF.
LEEF to standard log extension was installed
Uninstall both the App and the extension. Then reinstall only the Palo Alto Networks QRadar App.
LEEF logs are being sent but still receiving "NA" in the columns
You may have setup the older LEEF log format on the Firewall/Panorama. In this case please review the LEEF Log Forwarding Guide and make sure you are using PAN-OS v7.0 - v8.0+ format in the log forwarding profile.
NOTE: Make sure you are using LEEF format for PAN-OS v7.0-v8.0+
For further support please contact qradar@paloaltonetworks.com