Palo Alto firewalls alerts

[PA-NewBie]

Hello,

Recently we have started working on enabling email alerts for our Palo Alto firewalls. One of the alert is for interface and HA status change alerts. Could you please let me know what can I do to enable same? Do I need any external tool for it? Any sort of help would be appreciated. 

[PavelK · Accepted solution]

Thank you for the post @PA-NewBie

Interface and HA status related events are recorded in system logs. Below is a KB describing how to enable email alerts for system logs:

https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA10g000000ClGjCAK

Enabling email alert for system logs can be noise especially if you enable all severities. If you want to narrow down only HA logs, then you can use this filter: ( subtype eq ha ) in the system log setting:

Kind Regards

Pavel

[PA-NewBie]

Thank you Pavel. This is helpful.
So basically if I want to add same alert for interface status change also then need to put that event under filter right?

I would give a try the way you have mentioned and update you. Thank you 

[PA-NewBie]

Hi Pavel,

Thanks again! I was able to set alerts for HA state change.