About MiteshAgrawal

Hi Team,   We need to capture new VPN administrator creation at our LogRhythm SIEM end. We wanted to know in which log will we get that information.   For Example, for login and logout we get logs in the below ones: GlobalProtect gateway user login succeeded. GlobalProtect gateway user logout succeeded.   Please help with the log pattern for "new VPN administrator creation". Also, whether we get any eventID generated on VPN for this event?   Also, we believe the Palo Alto FW admin users will be admin users for GlobalProtect VPN as well. Do we have any option to give admin access to only VPN and not FW/Proxy modules.   Please help. Thanks in Advance.   Regards, Mitesh Agrawal   ... View more

Hi Team,   We have integrated Palo Alto UTM v8.1 with LogRhythm. We have enabled syslog on UTM and we are receiving logs on LogRhythm.   The issue is not all the fields are getting captured in the logs (we verified this in raw logs received at LogRhythm). Please find the below details which aren't captured.    Threat Logs:        -Threat ID not captured in logs        -Complete URL not captured in logs        - Flags not captured in logs        - Action is captured in Command field        - HTTP methods not captured in logs Configuration Logs:      - Command is not captured in logs      - User Origin is not Captured in logs     - Client details used by User for configuration change is not captured in logs     - Action is captured in logs     - Configuration path is not captured in logs URL filtering logs  :    - Complete URL is not captured in logs    - HTTP methods not captured in logs    -Response codes not captured in logs     Traffic Logs :   -Action is captured in logs field   - Flag is not captured in logs   Request you to help me in getting the proper configurations at Palo Alto end so all these details are captured in the logs.   Regards, Mitesh Agrawal ... View more