About tbarnhart

We're on v.9.1.8 for Panorama. I've configured both ways in the MCAS Log collector settings - "PA Series Firewall" & "PA Series Firewall LEEF". We've built the MCAS Log Collector based on the Ubuntu/Docker. The Palos are successfully sending to the MCAS-LogCollector server. The MCAS-LogCollector is successfully sending "message" files upto MCAS, but it's not successfully parsing the file.   See the sample logs that M$ provides with each of these - that I've attached here. These don't match our formats.    Looks like we'll need to build a Custom Format on the Palo side???     https://docs.microsoft.com/en-us/cloud-app-security/custom-log-parser https://docs.paloaltonetworks.com/pan-os/9-1/pan-os-admin/monitoring/use-syslog-for-monitoring.html https://techcommunity.microsoft.com/t5/microsoft-defender-for-cloud/configure-palo-alto-panorama-for-cloud-app-discovery/m-p/1816949 ... View more