What are recommended storage retention thresholds for URL Filter logs to achieve custom detailed date range reporting?

[PotStirrer]

What are recommended storage retention thresholds for URL Filter logs to achieve custom detailed date range reporting?

Depending on the hardware and disk sizes e.g PAN-5020, what are recommended URL Filter logs retention durations.

Most often we'd get requests for 90 day custom date range reports.

Also, what is the groups experience with sending logs to SPLUNK and how often, daily exports etc.?

Thanks in advance

PotStirrer

[HITSSEC]

We are carrying about 6 months of URL logs on Panorama and sending all logs to a syslog server for a retention period of 6 months. Our PA-5020s only have the smaller SSD and we only a week or two of logs on the appliance.  Unless you have low log volumes you will not get 6 months on the appliance.  We have normally run usage reports for brief periods (1 week to 2) to identify a specific user behavior. Running a 90 day report on a user is way too much data normally.  We produce detailed (if needed) by runnung reports run against panorama hosted data or extracted from the syslog server.  We syslog realtime from the PA-5020s in addition to sending the logs to Panorama.   You can tweak the log database allocations on the PA-5020 to maximixe URL log retention.  Alternatively you cn upgrade the SSD to the larger capacity.  Hope this is helpful.

Phil

[PotStirrer]

Thank you. We are reviewing the storage settings on the PANs and our Syslog capacities. Much appreciated.