GlobalProtect App Log Collection - Determining Disconnected Agents

[nohash4u]

Is there a way to automate the sending of GlobalProtect app logs to SLS? 

Based on the following I have only found ways to enable the end user to manually send logs to SLS:

• https://docs.paloaltonetworks.com/globalprotect/10-1/globalprotect-admin/globalprotect-app-log-colle... 
• https://www.youtube.com/watch?v=Ik1rXsVdxl4&t=10s 

The ultimate goal is to find a consistent method to determine which specific endpoints have GlobalProtect agents that are not connected. 

Would a tool like Cortex XDR be better equipped for this? 

Cheers, 

Nohash4u

[jmazzeo · Accepted solution]

Hi @nohash4u,

With Cortex XDR and the Host Insight add-on you can have the list of applications installed on every endpoint, and also get the list of services running on them. With that, you can run a custom query to get all the data joined and use it as a good reference for what you are looking for.

If this posts answers your question, please mark it as the solution.

[nohash4u]

Thanks @jmazzeo for the response. I am finding Cortex XDR is better equipped for this solution. I will keep you posted with my final solution. 

Cheers 

[nohash4u]

Update 

I have found the best option is to use Cortex XDR to search all endpoints (Endpoints --> All Endpoints) with the following filter: 

• Endpoint Status = Connected and IP Address != enter_GlobalProtect_subnet_range_here

Naturally, this is contingent on the endpoint having XDR installed and connected to determine the endpoint is functional, but not connected to GlobalProtect. Also, this is based on the understanding that the IP address pool determined by the GlobalProtect portal agent config will appear in the endpoint's ipconfig when it is actively connected to the GlobalProtect gateway. 

Thanks again @jmazzeo!