How to create an alert in SIEM tool for Node failure ( SPN failure )

[Kandarp_Desai]

Hi Guys,

Is there any way I can create an alert in our SIEM tool for SPN failure? Let's say SPN Europe Central for our environment goes down, then what logs can we track for this? 

[nikoolayy1 · Accepted solution]

Try using the API to send the data to the SIEM:

https://docs.paloaltonetworks.com/prisma/prisma-access/prisma-access-panorama-admin/prisma-access-ov...

https://docs.paloaltonetworks.com/prisma/prisma-access/prisma-access-panorama-admin/prisma-access-ov...

https://docs.paloaltonetworks.com/prisma/prisma-access/prisma-access-panorama-admin/prisma-access-ov...

https://docs.paloaltonetworks.com/prisma/prisma-access/innovation/2-1/prisma-access-panorama-admin/p...

https://docs.paloaltonetworks.com/prisma/prisma-access/prisma-access-panorama-admin/prisma-access-ov...

Also see if there is an app for you siem like for example Splunk and what information it has:

https://splunkbase.splunk.com/app/2757/