Setting up syslog forwarding from Panorama to Microsoft Cloud app security

cancel
Showing results for 
Search instead for 
Did you mean: 

Setting up syslog forwarding from Panorama to Microsoft Cloud app security

L0 Member

Wondering if anybody has gotten the syslog forwarding working from panorama traffic logs to Microsofts Cloud App security.

 

Have followed every guide I can find and I have logs passing to the MS log collector, however the syslog connection drops regularly, and despite getting some traffic showing in Cloud Discovery on the CAS dashboard it's approx.2% of total network traffic. Not from any specific system or source just a random .2%.

 

I feel like it's the formatting of the logs being sent or the handeling on the collector but the vendors just blame each other so it's hard to nail down.

 

anyone with experience getting the two to play nice would be appreciated!

 

 

2 REPLIES 2

L0 Member

Did you ever get this figured out?

L0 Member

We're on v.9.1.8 for Panorama.

I've configured both ways in the MCAS Log collector settings - "PA Series Firewall" & "PA Series Firewall LEEF".

We've built the MCAS Log Collector based on the Ubuntu/Docker.

The Palos are successfully sending to the MCAS-LogCollector server.
The MCAS-LogCollector is successfully sending "message" files upto MCAS, but it's not successfully parsing the file.

 

See the sample logs that M$ provides with each of these - that I've attached here.
These don't match our formats.   

Looks like we'll need to build a Custom Format on the Palo side???

 

 

https://docs.microsoft.com/en-us/cloud-app-security/custom-log-parser

https://docs.paloaltonetworks.com/pan-os/9-1/pan-os-admin/monitoring/use-syslog-for-monitoring.html

https://techcommunity.microsoft.com/t5/microsoft-defender-for-cloud/configure-palo-alto-panorama-for...

Like what you see?

Show your appreciation!

Click Like if a post is helpful to you or if you just want to show your support.

Click Accept as Solution to acknowledge that the answer to your question has been provided.

The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!

These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the LIVEcommunity as a whole!

The LIVEcommunity thanks you for your participation!