firewall change event monitor

cancel
Showing results for 
Show  only  | Search instead for 
Did you mean: 

firewall change event monitor

L1 Bithead

Hello Guy's

1. Add allow any/any rule:- If adding any new policies any/any rules in our environment. How I can forward/analyze logs to the Syslog server?
2. Added administrator account:- If any new admin account is added in Palo Alto locally. How can see the logs in the Syslog server?
3. Add authentication method:- We have SAML authentication in our environment. Do we have any other method to do that without using the SAML authentication method? How can we see the authentication logs in the Syslog server?

 

Regards,

Sunildutt

1 accepted solution

Accepted Solutions

Cyber Elite
Cyber Elite

Hello @SunilduttJ

 

1.

All the configurations logs can be found under: Monitor > Logs > Configuration. You can send all the configuration logs to syslog server from: Device > Log Settings > Configuration > Add, then select syslog server from drop down list. If you are interested only in sending security policy creation logs, then you can use this filter: ( full-path contains '/rulebase/security/' ). Unless the name of the policy includes some indication that it is "any" policy, I do not think there is another way to send selectively forward only logs related to "any/any" policy. 

 

PavelK_0-1672113447394.png

 

2.

For the second point, these logs are in the configuration logs as well. You can setup the same forwarding. You can narrow down only add new account related logs by using this filter: ( full-path contains '/users/entry' ) and ( cmd eq set ).

 

3.

Some of the authentication logs are located under: Monitor > Logs > Authentication and some under System. You can forward these logs to syslog server. If you are searching only logs related to admin adding authentication method, then this will be recorded in the configuration logs. Would it be possible to elaborate more what information would you like to capture from SAML logs?

 

Kind Regards

Pavel

Help the community: Like helpful comments and mark solutions.

View solution in original post

2 REPLIES 2

Cyber Elite
Cyber Elite

Hello @SunilduttJ

 

1.

All the configurations logs can be found under: Monitor > Logs > Configuration. You can send all the configuration logs to syslog server from: Device > Log Settings > Configuration > Add, then select syslog server from drop down list. If you are interested only in sending security policy creation logs, then you can use this filter: ( full-path contains '/rulebase/security/' ). Unless the name of the policy includes some indication that it is "any" policy, I do not think there is another way to send selectively forward only logs related to "any/any" policy. 

 

PavelK_0-1672113447394.png

 

2.

For the second point, these logs are in the configuration logs as well. You can setup the same forwarding. You can narrow down only add new account related logs by using this filter: ( full-path contains '/users/entry' ) and ( cmd eq set ).

 

3.

Some of the authentication logs are located under: Monitor > Logs > Authentication and some under System. You can forward these logs to syslog server. If you are searching only logs related to admin adding authentication method, then this will be recorded in the configuration logs. Would it be possible to elaborate more what information would you like to capture from SAML logs?

 

Kind Regards

Pavel

Help the community: Like helpful comments and mark solutions.

L1 Bithead

Hello Pavel,

Thank you for the suggestion pavel.!

  • 1 accepted solution
  • 1420 Views
  • 2 replies
  • 0 Likes
Like what you see?

Show your appreciation!

Click Like if a post is helpful to you or if you just want to show your support.

Click Accept as Solution to acknowledge that the answer to your question has been provided.

The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!

These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the LIVEcommunity as a whole!

The LIVEcommunity thanks you for your participation!