send BOTNET event realtime Logging to Log receiver

[Mark-Nakrop]

Does PAN has any solution to send BOTNET event to Log receiver for example; SYSLOG?

[mikand]

I could only find the report feature of the botnet function in the manual so I guess the answer to your request is: Currently it cannot but you can contact your sales engineer to file this as a feature request (unless someone from PAN who lurks in here have a different answer to provide? 😉

[bspilde]

They do have a feature request category on their support ticket system as well.

From: mikand <live@paloaltonetworks.com<mailto:live@paloaltonetworks.com>>

Reply-To: live <live@paloaltonetworks.com<mailto:live@paloaltonetworks.com>>

To: Brad Spilde <brad.spilde@daktronics.com<mailto:brad.spilde@daktronics.com>>

Subject: Re: send BOTNET event realtime Logging to Log receiver

I could only find the report feature of the botnet function in the manual so I guess the answer to your request is: Currently it cannot but you can contact your sales engineer to file this as a feature request (unless someone from PAN who lurks in here have a different answer to provide?

[Mark-Nakrop]

Can we did XML API to send CSV log of Botnet by the way.

[SRA]

There are no Botnet logs, just predefined Botnet reports that run daily. You can use the XML API to get the botnet report (from PAN-OS 4.1.3) as :http(s)://firewall/api/?type=report&reporttype=predefined&reportname=botnet