12-04-2024 08:39 AM - edited 12-12-2024 03:01 AM
We enable ELA on our NGFWs, forward logs to SLS, and also ingest the SLS logs into our XDR tenant.
Is there a way to verify in the XDR tenant or SLS that logs have been enriched by ELA?
12-13-2024 10:50 AM
Hi,
Thanks for reaching Live Community.
When you enabled NGFW logging to cortex, you can check the panw_ngfw_traffic_raw dataset on XQL to see all the information you can query from these logs.
For better understanding what ELA activation will enhance these logs, please refer to this doc below:
https://docs.paloaltonetworks.com/pan-os/10-1/pan-os-admin/subscriptions/enhanced-application-logs
If this information solves your inquiry, please mark as solution.
Click Accept as Solution to acknowledge that the answer to your question has been provided.
The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!
These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the LIVEcommunity as a whole!
The LIVEcommunity thanks you for your participation!
