sending NGFW logs to XSIAM without broker-vm

[PA_nts]

Hi,

I have a xsiam tenant running and a palo vm-100 (11.2.x) in our lab (xsiam / ngfw exists in the same csp account)

trying to find docs on this process.. the xsiam admin guide is pretty vague, it says yes and explains the steps on the xsiam side mostly. however not much on the ngfw side on how to configure the syslog profile / log forwarder.

my data source in xsiam is added and shows as connected to my lab FW.. so i am guessing i need to configure the FW to send logs to the xsiam tenant but not sure how to configure this to point it to the xsiam tenant. i am testing this with the broker-vm option as that will be a last resort.

i dont have an xsiam / cortex license on the ngfw.

any ideas? thanks

[PA_nts]

for those interest on this.. you have to have strata log server licensed on FW and select the cloud logging service in the log option..that way logs will be sent directly to the xsiam via cdl/sls (strata log service)

[afurze]

Hi PA_nts,

Just for clarification, Strata Logging Service is not required, nor is it utilized (unless you are still using the legacy connector) for sending firewall logs to Cortex XSIAM.  Please ensure that you follow the documentation for onboarding firewalls, which will ensure that the firewall receives proper licensing (if the firewalls do not have an SLS license) and are able to send logs.

[PA_nts]

ok thanks. in that case i might be mistaken but its the only way i got it to work.. did go through the doc process but found it did not cover enough on the pan-os side for me.. unless it has changed since then.