Are there way that fw forward url & data filtering logs to ESM system by syslog??

[KiCheon.Lee]

Hello,

I know there are not log type of url & data filtering on syslog server profile.

But my customer want to receive two logs to ESM system by syslog.

Are there ways?

Please let me know it if there are.

And I have a question.

Panorama is received this logs(url , data) from FW.

Why is it able to receive?

Thanks.

[goku123 · Accepted solution]

URL logs are stored as "informational" threat logs on the PA device.

So, in your log forwarding profile, under Threat, enable "informational" severity. This should enable URL log forwarding to your syslog server.

Something similar to your question was discussed in : https://live.paloaltonetworks.com/message/13326#13326

[dreputi]

Like achitwadgi said: If you are receiving URL logs on panorama, then the firewall should have had Log forwarding configured. In GUI:Objects>Log Forwarding Profile, there should have been a profile created with Panorama check box checked for "informational" severity. This profile should then be applied to the security rules.

https://live.paloaltonetworks.com/docs/DOC-2173

[KiCheon.Lee]

Thank you for your answer, achitwadgi and dreputi.

FWs send url logs by threat information severity of syslog. (The value of threat subtype field is url)

Also FWs send file logs by threat low severity of syslog. (The value of threat subtype field is file)

Low severity include alert , allow , forward and deny actions on file log.

Wildfire-upload-skip action is information severity.

Are they right?