Forwarding system logs to log collector

cancel
Showing results for 
Show  only  | Search instead for 
Did you mean: 

Forwarding system logs to log collector

L0 Member

Hello,

 

Currently we have firewall sending Threat and TRAFFIC log types with CEF format to Sentinel workspace through Linux log collector with omsagent.

We need to send the System log types as well from the firewall to the log collector and then in Sentinel.

In order to do that we followed the steps in highlighted guide:

Azure-Sentinel/Solutions/PaloAlto-PAN-OS/Data Connectors/readme.md at master · Azure/Azure-Sentinel ...

However the log collector does not detect the new log type and there are no system logs into Azure Sentinel.

What kind of additional configuration need to be performed on firewall side in order system logs to be forwarded to the log collector?

How should the system logs look like?

 

Thank you in advance

2 REPLIES 2

L1 Bithead

@Prodan wrote:

Hello,

 

Currently we have firewall sending Threat and TRAFFIC log types with CEF format to Sentinel workspace through Linux log collector with omsagent.  hpinstantink

We need to send the System log types as well from the firewall to the log collector and then in Sentinel.

In order to do that we followed the steps in highlighted guide:

Azure-Sentinel/Solutions/PaloAlto-PAN-OS/Data Connectors/readme.md at master · Azure/Azure-Sentinel ...

However the log collector does not detect the new log type and there are no system logs into Azure Sentinel.

What kind of additional configuration need to be performed on firewall side in order system logs to be forwarded to the log collector?

How should the system logs look like?

 

Thank you in advance


Hello,

To configure your Palo Alto Networks firewall to send System logs (in addition to Threat and TRAFFIC logs) to the log collector and Azure Sentinel, follow these steps:

Syslog Server Profile:
Log in to your Palo Alto Networks device.
Navigate to Device > Server Profiles > Syslog and click Add.
Create a Syslog destination by specifying the name, server IP address, port, and facility for your QRadar system (which acts as the Syslog server).
Assign Syslog Profile to Log Settings:
For each log type (Threat, TRAFFIC, and now System), assign the Syslog server profile you created.
Go to Device > Log Settings and select the severity level for the system logs you want to forward.
Associate the appropriate email profile (if needed) for email alerts related to critical system logs.
System Logs Format:
System logs include entries for changes to the firewall configuration.
Each entry contains details such as the date, administrator username, IP address of the change source, client type (Web, CLI, or Panorama), executed command type, command status (succeeded or failed), configuration path, and values before and after the change.
Remember to verify the configuration and ensure that the Syslog server profile is correctly set up on your firewall.

Hope this will help you.
Best regards,
florence023

Cyber Elite
Cyber Elite

Hello @Prodan

 

did you configure in syslog profile under Custom Log Format the CEF style log format? Please refer to: pan-os 10.0 cef configuration (Scroll down to page No.10 for System logs).

 

Also, OMS agent will be end of life on 31st August 2024: azure-monitor-agent-migration.

 

Kind Regards

Pavel 

Help the community: Like helpful comments and mark solutions.
  • 1169 Views
  • 2 replies
  • 0 Likes
Like what you see?

Show your appreciation!

Click Like if a post is helpful to you or if you just want to show your support.

Click Accept as Solution to acknowledge that the answer to your question has been provided.

The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!

These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the LIVEcommunity as a whole!

The LIVEcommunity thanks you for your participation!