Forwarding system logs to log collector

[Prodan]

Hello,

Currently we have firewall sending Threat and TRAFFIC log types with CEF format to Sentinel workspace through Linux log collector with omsagent.

We need to send the System log types as well from the firewall to the log collector and then in Sentinel.

In order to do that we followed the steps in highlighted guide:

Azure-Sentinel/Solutions/PaloAlto-PAN-OS/Data Connectors/readme.md at master · Azure/Azure-Sentinel ...

However the log collector does not detect the new log type and there are no system logs into Azure Sentinel.

What kind of additional configuration need to be performed on firewall side in order system logs to be forwarded to the log collector?

How should the system logs look like?

Thank you in advance

[florence023]

---

@Prodan wrote:

Hello,

Currently we have firewall sending Threat and TRAFFIC log types with CEF format to Sentinel workspace through Linux log collector with omsagent.  hpinstantink

We need to send the System log types as well from the firewall to the log collector and then in Sentinel.

In order to do that we followed the steps in highlighted guide:

Azure-Sentinel/Solutions/PaloAlto-PAN-OS/Data Connectors/readme.md at master · Azure/Azure-Sentinel ...

However the log collector does not detect the new log type and there are no system logs into Azure Sentinel.

What kind of additional configuration need to be performed on firewall side in order system logs to be forwarded to the log collector?

How should the system logs look like?

Thank you in advance

---

Hello,

To configure your Palo Alto Networks firewall to send System logs (in addition to Threat and TRAFFIC logs) to the log collector and Azure Sentinel, follow these steps:

Syslog Server Profile:
Log in to your Palo Alto Networks device.
Navigate to Device > Server Profiles > Syslog and click Add.
Create a Syslog destination by specifying the name, server IP address, port, and facility for your QRadar system (which acts as the Syslog server).
Assign Syslog Profile to Log Settings:
For each log type (Threat, TRAFFIC, and now System), assign the Syslog server profile you created.
Go to Device > Log Settings and select the severity level for the system logs you want to forward.
Associate the appropriate email profile (if needed) for email alerts related to critical system logs.
System Logs Format:
System logs include entries for changes to the firewall configuration.
Each entry contains details such as the date, administrator username, IP address of the change source, client type (Web, CLI, or Panorama), executed command type, command status (succeeded or failed), configuration path, and values before and after the change.
Remember to verify the configuration and ensure that the Syslog server profile is correctly set up on your firewall.

Hope this will help you.
Best regards,
florence023

[PavelK]

Hello @Prodan

did you configure in syslog profile under Custom Log Format the CEF style log format? Please refer to: pan-os 10.0 cef configuration (Scroll down to page No.10 for System logs).

Also, OMS agent will be end of life on 31st August 2024: azure-monitor-agent-migration.

Kind Regards

Pavel