Enhanced Security Measures in Place: To ensure a safer experience, we’ve implemented additional, temporary security measures for all users.
06-13-2024 01:17 AM
Hello,
Currently we have firewall sending Threat and TRAFFIC log types with CEF format to Sentinel workspace through Linux log collector with omsagent.
We need to send the System log types as well from the firewall to the log collector and then in Sentinel.
In order to do that we followed the steps in highlighted guide:
However the log collector does not detect the new log type and there are no system logs into Azure Sentinel.
What kind of additional configuration need to be performed on firewall side in order system logs to be forwarded to the log collector?
How should the system logs look like?
Thank you in advance
07-25-2024 12:28 AM - edited 07-25-2024 09:47 PM
@Prodan wrote:
Hello,
Currently we have firewall sending Threat and TRAFFIC log types with CEF format to Sentinel workspace through Linux log collector with omsagent. hpinstantink
We need to send the System log types as well from the firewall to the log collector and then in Sentinel.
In order to do that we followed the steps in highlighted guide:
However the log collector does not detect the new log type and there are no system logs into Azure Sentinel.
What kind of additional configuration need to be performed on firewall side in order system logs to be forwarded to the log collector?
How should the system logs look like?
Thank you in advance
Hello,
To configure your Palo Alto Networks firewall to send System logs (in addition to Threat and TRAFFIC logs) to the log collector and Azure Sentinel, follow these steps:
Syslog Server Profile:
Log in to your Palo Alto Networks device.
Navigate to Device > Server Profiles > Syslog and click Add.
Create a Syslog destination by specifying the name, server IP address, port, and facility for your QRadar system (which acts as the Syslog server).
Assign Syslog Profile to Log Settings:
For each log type (Threat, TRAFFIC, and now System), assign the Syslog server profile you created.
Go to Device > Log Settings and select the severity level for the system logs you want to forward.
Associate the appropriate email profile (if needed) for email alerts related to critical system logs.
System Logs Format:
System logs include entries for changes to the firewall configuration.
Each entry contains details such as the date, administrator username, IP address of the change source, client type (Web, CLI, or Panorama), executed command type, command status (succeeded or failed), configuration path, and values before and after the change.
Remember to verify the configuration and ensure that the Syslog server profile is correctly set up on your firewall.
Hope this will help you.
Best regards,
florence023
07-29-2024 03:37 PM
Hello @Prodan
did you configure in syslog profile under Custom Log Format the CEF style log format? Please refer to: pan-os 10.0 cef configuration (Scroll down to page No.10 for System logs).
Also, OMS agent will be end of life on 31st August 2024: azure-monitor-agent-migration.
Kind Regards
Pavel
Click Accept as Solution to acknowledge that the answer to your question has been provided.
The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!
These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the LIVEcommunity as a whole!
The LIVEcommunity thanks you for your participation!
