XSIAM NGFW Panorama logs onboarding

[bridgetlitt]

What is the recommended method to onboard NGFW logs. If the NGFWs are sending the logs to Panorama, how should i get the logs to XSIAM. I did see the "NGFW" integration and there is also syslog through Broker VM. which one is recommended? If I use the "NGFW" integration would it be enough to just connect to Panorama(and it sends all the logs from all the managed NGFWs) or do i need to add each of the firewalls also?

#xsiam

[PA_nts]

Bit late on reply.. but you can ingest directly from panorama to xsiam by enabling the strata logging service, the other alternative is using the Broker-VM also.

more info here:

https://docs-cortex.paloaltonetworks.com/r/Cortex-XSIAM/Cortex-XSIAM-Documentation/Palo-Alto-Network...

rgds

[M.Mickoski]

Dear @bridgetlitt 

Did you manage to on-board Panorama to XSIAM? We have the same case, where NGFWs are sending logs to Panorama. We would like to use Panorama as central point of logging and ingest the logs directly to XSIAM (via data source). For some reason when we on-boarded Panorama to XSIAM, we don't see any logs coming to XSIAM.

Any feedback or sharing your experience would be appreciate it.

Thanks,