log forwarding

cancel
Showing results for 
Show  only  | Search instead for 
Did you mean: 
Palo Alto Networks Approved
Palo Alto Networks Approved
Community Expert Verified
Community Expert Verified

log forwarding

L1 Bithead

Team,

 

Have few questions on log forwarding ..

 

1. Is there any best option to check what are the policy rules doesn't configured with log forwarding from Panoroma or any other tools ?

 

2.How to enforce users to specific custom  log forwarding profile 

 

3. is there any alert system we can configure if user configure policy without log forwarding profile .

 

Thx

Srini

3 REPLIES 3

Cyber Elite
Cyber Elite

Hello,

Here are my replies:

1. If you set the log forwarding profile name to 'default', then every policy should be setup with it:

https://docs.paloaltonetworks.com/pan-os/9-0/pan-os-admin/monitoring/configure-log-forwarding

2. Not entirely sure what you are asking, could you expand on your question?

3. I think this is what you are looking for: You can setup email alerts to alert for specific things, e.g. when a configuration change is made: https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA10g000000ClGjCAK

 

Hope this helps. 

1. i have 200+ policy rules on environment ,how can i check one by one policy if fwd profile configured or not ? is there simple option to validate compliance [ if someone missed add fwd profile on rule]? 

2.  i mean , take example i have multiple fwd profile [defult ,fwd_1,fwd_2 etc] on panorama but want  make restrictions like user should always use fwd_2 profile otherwise they cant configure policy rule.

3. email notification im looking more if someone missed to add fwd profile ,how to enable email for that ?

 

Cyber Elite
Cyber Elite

Hello,

All very good questions, however not sure its possible for questions 2 and 3. For question 1. You can filter the security policies to see which ones have for dont have log policies:

OtakarKlier_0-1654272907591.png

Just put an n in front of the eq ( example (log-setting neq 'Logforwarding')) if logfrowarding was the name of the profile.

 

Regards,

Like what you see?

Show your appreciation!

Click Like if a post is helpful to you or if you just want to show your support.

Click Accept as Solution to acknowledge that the answer to your question has been provided.

The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!

These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the LIVEcommunity as a whole!

The LIVEcommunity thanks you for your participation!