11-25-2025 03:40 PM
I'm trying to forward my NGFW logs that are stored in Strata Logging Service to our SIEM, Microsoft Sentinel.
This setup is documented in PAN docs linked here: https://docs.paloaltonetworks.com/prisma-access/integration/microsoft-integrations-with-prisma-acces...
The issue we are running into is that for SLS to authenticate and connect to the Azure log analytics workspace (Mentioned in step 3), it requires the workspace ID and key. That is no longer possible to obtain as Microsoft has retired the log analytics agent and has moved to the Azure Monitor Agent.
How are we able to forward SLS logs to Sentinel? Is there a supported path or are customers on their own to customize a solution?
Click Accept as Solution to acknowledge that the answer to your question has been provided.
The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!
These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the LIVEcommunity as a whole!
The LIVEcommunity thanks you for your participation!
