Free visualisation (NOC screenboards) for PANW firewall performance/monitoring using Elastic Stack

[sam_miller]

I was looking for ways to provide 'at-a-glance' visualisation of PANW firewall health, including traffic, threat, system & config logs. The stock capabilities, including ACC, are decent but somewhat lacking in providing NOC-style dashboards.

Inspired by other visualisation solutions I've seen around, such as the Splunk App & Graylog dashboards, I spent the last 48 hours tinkering with ElasticStack 6.1 and came up with a series of 9 dashboards (and 66 visualisations) that can be derived from PANW Firewall syslogs.

Dashboard examples here;

• Overview: https://imgur.com/xxl0XCf

• Traffic: https://imgur.com/xuxsmno

• Applications: https://imgur.com/x7vdEwn

• Threats: https://imgur.com/obE4dIb

• System: https://imgur.com/O3A4p3n

There's another 4 dashboards too (Config, Threat [Warning+], URL & Blocked URLs)

The process of spinning up a Linux/Windows VM & installing Elastic Stack is pretty painless. Once done, dropping in the files required to create a syslog instance, ingest the syslogs and output the visualisations/dashboard is quite easy

I've put all the relevant information, including a full tutorial on installing Elastic Stack, up on GitHub: https://github.com/sm-biz/paloalto-elasticstack-viz

If anyone's interested, have a look and provide feedback. Any other types of dashboards that would be useful?

(Note: Wildfire dashboard is still-to-come, I need to generate some sample data)

[Chander]

Can you please post any video tutorial for this ELK + palo alto log monitoring.

[VincentPresogna]

Awesome. Thanks. Took me about a day to get this up and running on Ubuntu 18. The installation of Java 8 has changed, the PPA repo is no longer a viable solution, had to install it manually. The only other thing that tripped me up was the sysylog port, it was 5514 instead of the usual 514. Once I changed that on the syslog forward in the PA, everything started flowing ing in.