Can Cortex XDR proactively log Global Protect client debug?

[palomed]

We have several hundred Global Protect users using Auto VPN. It would be nice to 

see their global protect logs, ipconfig /all, netstat -rn information before calling them

back on a filed ticket. Can Cortex collect these logs on a regular basis without 

user involvement? What has to be enabled at the GP client and/or PAN to 

allow this log collection to occur?

[jtalton]

Hi Palomed,

If you have a Cortex Data Lake license, Global Protect logs can be forwarded to the Cortex Data Lake for stitching from your PAN firewall. Please refer to your PAN-OS TechDocs Documentation for how to configure. 

Thanks

[jtalton]

You may forward Global Protect logs to the Cortex Data Lake for stitching from your PANW firewall. If you need assistance with configuring please open a support case.