Integration Palo Alto PAN-OS v7.1.X. using Custom Log Format and improve QRadar (LEEF)

[SOC_CSG]

Hello Everyone!

We have the following devices:

• QRADAR Version 7.2.7
• Palo Alto Firewalls PAN_OS 7.0.9
• Panorama PAN-OS 7.0.9

Palo Alto Custom Log Format LEEF

If I use the "Custom Log Format" for setup my Syslog Server Profile, as you have shown us in the link I put below:

http://www.ibm.com/support/knowledgecenter/SS42VS_7.2.7/com.ibm.dsm.doc/t_dsm_guide_palo_alto_syslog...

and in my "Log Forwarding Profile" In addition to enabling my Syslog, I have also enabled a 'panorama' as it shown in the image I put below:

https://live.paloaltonetworks.com/t5/Configuration-Articles/How-to-Create-a-Profile-to-Forward-Logs-...

 

The "Custom Log Format" I used in my Syslog Server Profile, can affect my panorama or the format of my panorama?

Thanks and best regards,

Diego C.

[reaper · Accepted solution]

Hi Diego

not fully sure what you want to know, but the 'panorama' flag will forward logs in PANW proprietary format to panorama, and in addition will send a copy in your custom log format to your syslog server

the syslog setting does not affect panorama logging

[SOC_CSG]

Thanks

I have searched for information about this Because I am interested this topic, but I have not found anything.
But your answer it seems me correct. Thanks again.

[reaper]

Hi Diego

my pleasure!

just for the record: all 4 log forwarding profiles (panorama, snmp, email and syslog) have their own log format output and none interfere with each other