Where is the documentation that describes Syslog Log types formats for Palo Alto Firewalls?

[SoloSigma]

On my Ubuntu Server I receive syslogs, that may look like this:

<14>Sep 23 20:01:11 PA-440 1,2024/09/23 20:01:11,021201133296,TRAFFIC,end,2561,2024/09/23 20:01:11,10.10.10.103,20.190.177.21,192.168.10.20,22.120.127.11,rule1,,,ssl,vsys1,trust,untrust,ethernet1/2,ethernet1/1,LFP LimaCharlie FW,2024/09/23 20:01:11,121977,1,60637,443,39335,443,0x40041c,tcp,allow,23588,6260,17328,30,2024/09/23 20:00:56,1,any,,7408146363088945002,0x0,10.0.0.0-10.255.255.255,France,,13,17,tcp-fin,0,0,0,0,,PA-440,from-policy,,,0,,0,,N/A,0,0,0,0,a6854971-45bb-499a-86fd-30008807b6e1,0,0,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,2024-09-23T20:01:11.522+02:00,,,encrypted-tunnel,networking,browser-based,4,"used-by-malware,able-to-transfer-file,has-known-vulnerability,tunnel-other-application,pervasive-use",,ssl,no,no,0

I understand that there are different log types that can be sent, including

• Config
• System
• Threat
• Traffic
• URL
• Data
• WildFire
• Tunnel
• Authentication
• User-ID
• HIP Match
• Globalprotect
• Iptag
• Decryption

Are there any documentation that shows me how the different log types are constructed?
I need it in order to create a Regex that will convert syslog into JSON format.

[OtakarKlier]

Hello,

Your SIEM might already be able to do this? I dont have an example that I can share, but its along similar lines of comma separated values. You could setup a simple syslog server to capture a few logs of each and then base it from there?

Here is what is shows in the help file of hte two different types of syslogs the firewall can send.

Select the value that maps to how your Syslog server uses the facility field to manage messages. For details on the facility field, see RFC 3164 (BSD format) or RFC 5424 (IETF format).

Just a few thoughts.

[Brandon_Wertz]

---

@SoloSigma wrote:

On my Ubuntu Server I receive syslogs, that may look like this:

<14>Sep 23 20:01:11 PA-440 1,2024/09/23 20:01:11,021201133296,TRAFFIC,end,2561,2024/09/23 20:01:11,10.10.10.103,20.190.177.21,192.168.10.20,22.120.127.11,rule1,,,ssl,vsys1,trust,untrust,ethernet1/2,ethernet1/1,LFP LimaCharlie FW,2024/09/23 20:01:11,121977,1,60637,443,39335,443,0x40041c,tcp,allow,23588,6260,17328,30,2024/09/23 20:00:56,1,any,,7408146363088945002,0x0,10.0.0.0-10.255.255.255,France,,13,17,tcp-fin,0,0,0,0,,PA-440,from-policy,,,0,,0,,N/A,0,0,0,0,a6854971-45bb-499a-86fd-30008807b6e1,0,0,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,2024-09-23T20:01:11.522+02:00,,,encrypted-tunnel,networking,browser-based,4,"used-by-malware,able-to-transfer-file,has-known-vulnerability,tunnel-other-application,pervasive-use",,ssl,no,no,0

I understand that there are different log types that can be sent, including

• Config
• System
• Threat
• Traffic
• URL
• Data
• WildFire
• Tunnel
• Authentication
• User-ID
• HIP Match
• Globalprotect
• Iptag
• Decryption

Are there any documentation that shows me how the different log types are constructed?
I need it in order to create a Regex that will convert syslog into JSON format.

---

Maybe this is what you're looking for?  The LEEF fields?

https://docs.paloaltonetworks.com/strata-logging-service/log-reference/network-logs/network-traffic-...

[SoloSigma]

My SIEM tool is LimaCharlie, and it does not parse Palo Alto logs out of the box. Because of this I will have to create some Regex to convert Syslogs to JSON format.

[Raido_Rattameister · Accepted solution]

https://docs.paloaltonetworks.com/pan-os/11-0/pan-os-admin/monitoring/use-syslog-for-monitoring/sysl...

https://docs.paloaltonetworks.com/pan-os/11-0/pan-os-admin/monitoring/use-syslog-for-monitoring/sysl...