Does Panorama Forward These Events to External SIEMs via Syslog by Default?

[austinsaint278]

Hi everyone,

We're currently integrating Palo Alto logs (via Panorama) into our SIEM solution (Wazuh) using syslog, and I wanted to confirm the log types that are forwarded by default or require additional configuration.

Specifically, does Panorama forward the following events out-of-the-box via syslog?

• Malware/Spyware detections

• Command and Control (C2) communications

• CVE exploit attempts

• High/Critical severity IPS alerts

• DNS tunneling or other evasion behaviors

• Blocked or suspicious URL category access attempts

• DLP events or sensitive data exfiltration

• Abnormal login behavior or access to uncommon ports

• GlobalProtect VPN anomalies (e.g., connection failures, logins from new or suspicious locations)

If some of these aren’t forwarded by default, what additional steps (custom syslog filters, log forwarding profiles, threat signatures, etc.) are needed to ensure these logs are exported properly?

Thanks in advance for any clarification or guidance!

Best regards,
Austin

[mshekh]

Hi @austinsaint278 ,

Yes you can configure the log forwarding profile and send logs to syslog/SIEM solution. Please refer the below KB related to configuration.

How to Forward Threat Logs to Syslog Server

https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA10g000000ClFfCAK

[PavelK]

Hello @austinsaint278

thanks for post!

I am going to break down your question into more details.

After logs are forwarded to Panorama's log collector, you will have to set log forwarding from log collector to SIEM. Here is documentation with instructions how to do it: Configure Log Forwarding from Panorama to External Destinations. After you complete the configuration do not forget to commit changes and push changes to log collectors. In the Syslog profile you can customize log format, however unless you have specific requirement you can leave it in default. Unless you configure filtering based on log severity or filter builder all logs regardless of log category will be forwarded to SIEM.

When it comes to specific events you mentioned in your post:

Malware/Spyware detections
Command and Control (C2) communications
CVE exploit attempts
High/Critical severity IPS alerts
DNS tunneling or other evasion behaviors

The above logs will be presented in Threat logs. You do not need additional configuration on Panorama side to allow logs forwarding to SIEM except of setting log forwarding profile described at the beginning of the post, however you have to make sure that you have security profile attached to every security policy with threat profile set to block/alert based on severity: Internet Gateway Best Practice Security Policy Also, to allow Firewall inspect traffic, you will have to enable decryption.

For below portion:

Blocked or suspicious URL category access attempts

you will have to enable action alert or deny URL filtering: URL Filtering Profiles to see logs, then you will have to enable URL log forwarding in Panorama. Here are all log fields: URL Filtering Log Fields. URL logs are not part of Threat logs.

For this portion:

DLP events or sensitive data exfiltration

For Data Leak Prevention logs, you will have to enable DLP logging in Firewalls and make sure that DLP logs are configured in Panorama for log forwarding. Here are DLP log fields: Data Filtering Log Fields.

For this portion:

Abnormal login behavior or access to uncommon ports

you will have to enable traffic log forwarding. It is tricky to give good answer to this point. As log as you have enabled log at session end: Session Log Best Practices you will have all traffic log, however you will have to categorize what uncommon ports mean in your organization and reflect it in security policies, then have a rule in SIEM to have detection for those events. Here are all traffic log fields: Traffic Log Fields. 

For this portion:

GlobalProtect VPN anomalies (e.g., connection failures, logins from new or suspicious locations)

you will have to enable Global Protect logs: GlobalProtect Log Fields and ideally also HIP Match logs: HIP Match Log Fields. Firewall will not be able to recognize what suspicious location means in your business context and where your GP clients are usually connecting from. I have seen this function to be facilitated by Identity Protection solution or SIEM. By quick search it looks like Wazuh has anomaly detection feature, however I do not have any experience to judge whether it can fulfill your expectations.    

Good luck with your setup and threat hunting!

Kind Regards

Pavel