Palo alto Strata logging service logs

Splunkers2 — Thu, 03 Apr 2025 07:42:49 GMT

Hi,

I have onboarded palo-alto traffic and threat logs via HEC and SLS (Strata logging service). These logs are JSON logs and as the documentation they should come under sourcetype=pan:firewall_cloud.All our dashboards are set up expecting traffic logs under pan:traffic and threat logs under pan:threat.

Having checked the props.conf and transforms.conf for sourcetype=pan:firewall_cloud, there is no rule to route the logs to pan:threat or pan:traffic.

how is everyone dealing with this situation ? appreciate any workarounds or suggestions in general. This seems to be big issue anyone using SLS (strata logging service).Thanks.

Re: Palo alto Strata logging service logs

Vardhan — Wed, 23 Apr 2025 10:35:47 GMT

Hi ,

If you are sending logs from On prem Panorama consoles to Splunk and using Palo Alto addon. The logs will go to pan:traffic . However, if you are sending logs from Strata console via HEC the logs will be in Json format and the right sourcetype to use is pan:firewall_cloud.

topic Re: Palo alto Strata logging service logs in Getting Data In

Palo alto Strata logging service logs

Re: Palo alto Strata logging service logs