A few Panorama-questions

[mikand]

Hi all!

Got a few question related to Panorama which I hope you can help me with?

1) Whats the FR id regarding having Panorama to be able to forward received logs?

That is PA-device -> Panorama -> SEIM/Syslogarchive.

2) For which version is this feature expected to show up, and any ETA for when we will see this version available in the download section (that is version and date)?

3) If you log towards an ArcSight installation you can use the CEF-format in the PA-devices. However the CEF format has an overhead of approx 220 bytes (or so) per msg. Which gives that during a burst of say 100.000 msgs/sec the overhead is approx 176 Mbit/s on the line.

Do there exist a more efficient way of transmitting logs from PA to ArcSight other than CEF?

I mean did PA (or HP?) create a custom flexconnector or such to read native format of PA or is CEF the only available option unless I want to create a flexconnector on my own?

4) Speaking of CEF, any ETA (version and date) for when we will see panos version as a variable?

[rmonvon · Accepted solution]

Hi...The FR ID is 782.  If you have a customer who wants this feature, please submit the customer's name to your local SE and the SE can add to the FR.  This feature is coming soon.

For ArcSight, there was a FlexConnector developed several years ago and HP (ArcSight) is responsible for it.  You should check with HP to see if they still offer it. Otherwise, CEF format is supported as you have pointed out.

Thanks.