Doubt about costomize config log paloalto

[Alpalo]

Hi team

The security auditors ask us if in the Config Log it is possible to have an additional field in the log that links all the events of a rule change with a ticket id external to Palo Alto.

That is to say that in the attached logs an additional field with the Ticket appears in a mandatory way to be able to link the event with the ticket:

any idea?

Regards

[JayGolf]

Hi @Alpalo ,

Unfortunately, you won't be able to add custom fields directly. Sounds like something where you would have to pull config logs via python, append those logs with the ticket#, and import those logs to an external ticketing system/database. 

Good luck! 

[BPry]

@Alpalo,

Couple possible solutions to this:

• Move the configuration into source control - This requires changing how people are used to configuring things, but it does give you the ability to ensure that every single change can be linked to a ticket easily. Requires that people learn new things, but ultimately gives you exactly what you're looking for and a process to review changes quite a bit easier.
• Commit Descriptions - This can solve this issue in a round about aspect as you can tie each commit to the tickets that the change addresses. Still some manual processing but it functions.
• Change in process - Changes to the firewall are only done with a change ticket in whatever your ticket solution is and the security team looks at those tickets instead of firewall logs. Administrators are not allowed to deviate outside of this process without a ticket detailing what is done.

[OwenGray]

Thank you for answering, I will try it.