topic Re: splunk Cloud with palo alto firewall configuration in Splunk Cloud Platform

Help with splunk Cloud with palo alto firewall configuration

raje1 — Mon, 11 Jul 2022 14:16:59 GMT

Hi,

I have installed a app of palo alto firewall in my splunk cloud. an someone please help me how an i connect splunk and palo alto firewall with each other. what are the steps. I am confused.
which permission do i need to do this configuration.
In splunk cloud documentation, a lots of material is for the splunk enterprise not for splunk cloud.

thanks!

Re: splunk Cloud with palo alto firewall configuration

richgalloway — Thu, 05 Mar 2020 01:59:22 GMT

Palo Alto can't send directly to Splunk Cloud. Direct your PAN logs to a Splunk forwarder (perhaps on a syslog server) that sends the data to Splunk Cloud.

Re: splunk Cloud with palo alto firewall configuration

raje1 — Thu, 05 Mar 2020 20:44:17 GMT

Can you give me instructions how to direct PAN logs to splunk forwarder. I am new in splunk.

Re: splunk Cloud with palo alto firewall configuration

richgalloway — Fri, 06 Mar 2020 13:43:42 GMT

That's not a Splunk question. Consult the instructions for your PAN device to learn how to direct the logs to an external location.

Re: splunk Cloud with palo alto firewall configuration

dkroen17 — Sun, 10 Jul 2022 19:00:09 GMT

Check Panorama documentation and create a syslog destination. You'll need a distinct syslog server. Use Rsyslog or syslog-NG. Install a universal forwarder on the same machine that forwards the collected panorama logs to your Splunk syslog installation. Good Luck!