Forward NGFW logs stored in Strata Logging Service to Microsoft Sentinel

[A.Davenport]

I'm trying to forward my NGFW logs that are stored in Strata Logging Service to our SIEM, Microsoft Sentinel. 

This setup is documented in PAN docs linked here: https://docs.paloaltonetworks.com/prisma-access/integration/microsoft-integrations-with-prisma-acces...

The issue we are running into is that for SLS to authenticate and connect to the Azure log analytics workspace (Mentioned in step 3), it requires the workspace ID and key. That is no longer possible to obtain as Microsoft has retired the log analytics agent and has moved to the Azure Monitor Agent. 

How are we able to forward SLS logs to Sentinel? Is there a supported path or are customers on their own to customize a solution?

[PavelK]

Hello @A.Davenport

unfortunately, I am not able to help with this one. Roughly 2 month ago, I still remember to see Workspace ID and Primary/Secondary Key values in Sentinel, however in meanwhile it was removed by Microsoft. I believe they did it because of planned deprecation of Data Collection API in favor of Log Ingestion API that is DCR based. A few weeks ago, I opened a TAC ticket asking whether there is a plan to change log ingestion method on Strata Logging Service to new DCR based ingestion method in Sentinel. Answer from TAC was negative. I have requested my account manager to submit a feature request for this. I have not heard back yet. 

Kind Regards

Pavel