syslog alerting in PAN-OS

[niuk]

There is an option for syslog alerting by email in PAN-OS , but even if used only for threats , not traffic, results in way too many emails. I am collecting threat events through Logstash into time series database InfluxDB . My very small program is triggered by Logstash, when rate of metrics exceeds given threshold, to query InfluxDB and send result by email. See my post here 

[kiwi · Accepted solution]

Hi @niuk,

This flood of unwanted logs being forwarded is fixed with PAN-OS 8.0

In this versions we expanded the log forwarding feature.  We moved from the granularity of severity to the granularity of a user defined filter for log forwarding purposes.

Log forwarding profiles now have filters that are similar to the filters you can use in the monitor tab ... so now the flood of unwanted logs is a thing of the past.

Cheers !

-Kim.

[niuk]

Is it possible to aggregate alerts ? So not to alert on single threats but on specific rate 

btw , I can't setup PAN-OS 8.0 VM on my ESXi 6.5. 

[RG123]

Hi Niuk,

I would be very interested in your setup for shipping logs to Logstash/Kibana. We have AWS Logging setup and I would like to utilize this existing environment if possible.