Palo Alto logs to Cloudwatch logs possible?

Announcements

Changes to the LIVEcommunity experience are coming soon... Here's what you need to know.

Reply
chrisjin
L0 Member

Palo Alto logs to Cloudwatch logs possible?

I'm looking to see if we're able to push Palo Alto VM's syslogs and traffic logs to AWS CloudWatch logs.

 

Just to be clear, I'm not looking to monitor Palo Alto metrics using CloudWatch but need to push logs from the firewall to CloudWatch logs.

 

Is this possible at all?

 

Thanks.


Accepted Solutions
BPry
Cyber Elite

@chrisjin,

Officially I don't think this is supported at all, as CloudWatch doesn't really expose an easy way to injest logs outside of an instance with the agent installed. That being said, you can rig CloudWatch to look at /var/log/messages and configure an EC2 instance to accept your syslog messages and pass them to that location to get them into CloudWatch. 

View solution in original post


All Replies
BPry
Cyber Elite

@chrisjin,

Officially I don't think this is supported at all, as CloudWatch doesn't really expose an easy way to injest logs outside of an instance with the agent installed. That being said, you can rig CloudWatch to look at /var/log/messages and configure an EC2 instance to accept your syslog messages and pass them to that location to get them into CloudWatch. 

View solution in original post

Sagar_D
L0 Member

Hi,

You need to have a IAM Role associated with the Palo Alto EC2 instance.

 

AWSTemplateFormatVersion: 2010-09-09
Resources:
IAM-NPD-INT-PAFWMON:
Type: 'AWS::IAM::Role'
Properties:
AssumeRolePolicyDocument:
Version: 2012-10-17
Statement:
- Effect: Allow
Principal:
Service:
- ec2.amazonaws.com
Action:
- sts:AssumeRole
Policies:
- PolicyName: PAFWMON_Policy
PolicyDocument:
Version: 2012-10-17
Statement:
- Effect: Allow
Action: cloudwatch:PutMetricData
Resource: '*'
RootInstanceProfile:
Type: "AWS::IAM::InstanceProfile"
Properties:
Path: "/"
Roles:
-
Ref: "IAM-NPD-INT-PAFWMON"

glynn
L2 Linker

One of the AWS SAs blogged about this:

 

https://aws.amazon.com/blogs/apn/monitoring-your-palo-alto-networks-vm-series-firewall-with-a-syslog...

 

I found that it lends itself well to containerization as well.

Like what you see?

Show your appreciation!

Click Like if a post is helpful to you or if you just want to show your support.

Click Accept as Solution to acknowledge that the answer to your question has been provided.

The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!

These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the LIVEcommunity as a whole!

The LIVEcommunity thanks you for your participation!