This website uses Cookies. Click Accept to agree to our website's cookie use as described in our Cookie Policy. Click Preferences to customize your cookie settings.
About DZhang
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
- LIVEcommunity
- About DZhang
03-03-2021
3Posts
0Likes
1Solution
Mar 03, 2021Last Visited
User
Activity
User
Profile
Latest posts by DZhang
| Subject | Views | Posted |
|---|---|---|
| 1941 | 03-03-2021 09:53 AM | |
| 1959 | 03-03-2021 08:39 AM | |
| 2024 | 03-02-2021 10:00 AM |
User Badges
Community Statistics
| Member Since | 12-03-2020 08:34 AM |
| Date Last Visited | 03-03-2021 06:26 PM |
| Posts | 3 |
03-03-2021
09:53 AM
Got it working. I needed to configure the "Data" type in the syslog server profile with a custom CEF format according to this: https://help.sumologic.com/07Sumo-Logic-Apps/22Security_and_Threat_Detection/Palo_Alto_Networks_9/Collect_logs_for_the_Palo_Alto_Networks_9_App
... View more
03-03-2021
08:39 AM
That makes sense. I do have data logs also being sent to syslog and event showing up in data filtering when i'm testing it, but searching through the logs in sumo still only shows Threat and Traffic, but nothing for the data category.
... View more
03-02-2021
10:00 AM
I've configured a data filtering profile and have been testing sending the data filtering detections to syslog, then to Sumologic. From what I've read, these detections are Threat Type, Data subtype in the logs. I have a log forwarding profile created to send all Threat logs regardless of severity or app to syslog and can see types like vulnerability or spyware in Sumologic, but not data even after testing. Is there something else I'm missing?
... View more
- Tags:
- Data Filtering
- syslog
Contact Me
| Online Status |
Offline
|
| Date Last Visited |
03-03-2021
06:26 PM
|
LEGAL NOTICES
Copyright 2007 - 2023 - Palo Alto Networks