on 02-22-2023 11:35 AM - edited on 02-22-2023 11:37 AM by jforsythe
This Nominated Discussion Article is based on the post "Palo Alto integration with Azure Sentinel" by @ShailUpadhyay Read on to see Cyber Elite @PavelK's recommendation!
Hi All,
We are currently working on setting up the Azure Sentinel for our environment and Integration of PA firewalls with Sentinel is our top most priority.
However we need to understand what will be the best approach for integration.
Should we integrate independent firewalls with Azure Sentinel or Panorama with Azure Sentinel or both firewalls and Panorama with Azure Sentinel ? Also what factors drive this decision. Any leads will be helpful
Thank you
Recommendation:
Hello @ShailUpadhyay
in our case, we have been using following scenario for about 3 years:
Logs are sent from Firewalls to Panorama, then from Panorama to logstash, then from logstash to Sentinel. We never really run into any issue. The only issue we came across once was we started to see a log loss between Firewalls and Panorama which naturally resulted missing logs in Sentinel. This was eventually resolved by adding additional log collectors in log collector group.
Personally, I believe that having all Firewalls to send logs to Panorama and then let Panorama to send all logs to Sentinel has many benefits. For example: ease of management or ease of troubleshooting as you have only one place to look into.
On the other hand if you have many firewalls with a high log volume, then you might hit ingestion rate limitation of Panorama where Panorama would be a bottleneck (This of course depends on Panorama model and log collector design). In this case having Firewalls to send logs directly to Sentinel would be a better option.
Having both Firewalls as well as Panorama to send logs to Sentinel would be the last choice that I would preferably avoid. You will end up with log duplication.
Kind Regards
Pavel
