Syslog - Palo Alto Firewall

TEAM: Huntress Managed Security Information and Event Management (SIEM)
PRODUCT: Firewall Syslog
ENVIRONMENT: Palo Alto
SUMMARY: Configuration Guide for Palo Alto firewalls

Vendor Information

Device Configuration Checklist

Example Log Messages

 

This page only covers the device-specific configuration, you'll still need to read Huntress Managed SIEM Firewall guide to complete the Huntress Managed SIEM setup as well as opening a port in Microsoft Defender Firewall.

Vendor Information

Please note that Huntress provides third party vendor instructions as a best effort to expedite onboarding. Vendor documentation and versions frequently change and so it may be necessary to find the appropriate documentation for syslog logging for your version of the vendor software or service.

Please note the link in the Vendor Links above to the latest documentation at the time of this writing.

Device Configuration Checklist

1. Configure a Syslog server profile
   1. From the Palo Alto Console, select Device > Server Profiles > Syslog
   2. Click Add and enter a Name for the profile. For example, Huntress-SIEM.
2. Add a Syslog Server (Huntress Agent) to the Server Profile
   1. In the Syslog Server Profile click Add and provide the following information:
      1. Name - Name or IP of Huntress Agent host
      2. Syslog Server - Internal IP or FQDN of the Huntress Agent
      3. Transport - UDP  (please note that Huntress SIEM is not compatible with SSL (TLS) or encrypted syslogs.
      4. Port - 514
      5. Format - IETF
      6. Facility - LOG_USER (default)
   2. Click OK to save the server profile
3. Configure syslog forwarding for Traffic, Threat, Wildfire Submission, URL Filtering, Data Filtering, Tunnel and Authentication logs.
   1. Create the Syslog Forwarding Profile
      1. From the Palo Alto Console, select Objects > Log Forwarding
      2. Click Add and enter a Name for the Log Forwarding Profile.
         1. If it is desired that this profile be assigned to all new security rules and zones, enter “default”. If this is not desired or you don’t want to override the default profile, enter a unique name.
      3. For each Severity and Wildfire Verdict select the Syslog Server Profile created above in the Syslog column
      4. Click OK
   2. Assign the Syslog Forwarding Profile to the Security Policy
      1. From the Palo Alto Console, select Policies > Security
      2. For each rule in the Security Policy do the following:
         1. Click on the rule name
         2. Go to the Actions tab
         3. Check the box for “Log at Session End”
         4. Under Log Setting and Log Forwarding, choose the Syslog Forwarding Profile created above
4. Configure syslog forwarding for System, Configuration, Correlation, GlobalProtect, HIP Match, and User-ID logs.
   1. From the Palo Alto Console, select Device > Log Settings
   2. For System and Correlation logs, click each Severity level, select the Syslog Server Profile created above, and click OK.
   3. For Config, HIP Match, and Correlation logs, edit the section, select the Syslog Server Profile created above, and click OK.
5. Commit changes.
   1. Click Commit to push config changes.