Palo Alto logs to Cloudwatch logs possible?

[chrisjin]

I'm looking to see if we're able to push Palo Alto VM's syslogs and traffic logs to AWS CloudWatch logs.

Just to be clear, I'm not looking to monitor Palo Alto metrics using CloudWatch but need to push logs from the firewall to CloudWatch logs.

Is this possible at all?

Thanks.

[BPry · Accepted solution]

@chrisjin,

Officially I don't think this is supported at all, as CloudWatch doesn't really expose an easy way to injest logs outside of an instance with the agent installed. That being said, you can rig CloudWatch to look at /var/log/messages and configure an EC2 instance to accept your syslog messages and pass them to that location to get them into CloudWatch. 

[Sagar_D]

Hi,

You need to have a IAM Role associated with the Palo Alto EC2 instance.

AWSTemplateFormatVersion: 2010-09-09
Resources:
IAM-NPD-INT-PAFWMON:
Type: 'AWS::IAM::Role'
Properties:
AssumeRolePolicyDocument:
Version: 2012-10-17
Statement:
- Effect: Allow
Principal:
Service:
- ec2.amazonaws.com
Action:
- sts:AssumeRole
Policies:
- PolicyName: PAFWMON_Policy
PolicyDocument:
Version: 2012-10-17
Statement:
- Effect: Allow
Action: cloudwatch:PutMetricData
Resource: '*'
RootInstanceProfile:
Type: "AWS::IAM::InstanceProfile"
Properties:
Path: "/"
Roles:
-
Ref: "IAM-NPD-INT-PAFWMON"

[glynn]

One of the AWS SAs blogged about this:

https://aws.amazon.com/blogs/apn/monitoring-your-palo-alto-networks-vm-series-firewall-with-a-syslog...

I found that it lends itself well to containerization as well.