I cannot integrate System Logs for Global Protect Authentication to ArcSight

[aolapade1]

Please I am having difficulties integrating Authentication Logs for Global Protect to ArcSight. I can see the logs on the firewall dashboard (under System Logs) but these logs are not integrated to ArcSight.

Traffic & Threat logs are currently integrated on ArcSight but I need to see login authentication logs for Global Protect.

Please assist me.

[saraya]

Auth logs forwarding can be also configured as Traffic & Threat logs from Objects > Log Forwarding. Just select Log Type 'auth'.

For System logs, you will want to configure this from Device > Log settings > System. 

Note: If you also enable Panorama/Logging Service as the 'Forward Method', you must configure log forwarding to Panorama.

.

.