https://community.splunk.com/t5/Getting-Data-In/How-to-get-URL-filtering-logs-from-Palo-Alto-into-Splunk/m-p/162657#M33016 <P>I don't use the profile Block List text box, so can't really answer for that specific use. Usually setting the action to block should send a syslog message</P> <P>If it doesn't log using the block list text box in the URL profile, you could try creating a custom category and add that to the URL profile.</P> Mon, 22 Dec 2014 23:16:14 GMT mbenwell 2014-12-22T23:16:14Z https://community.splunk.com/t5/Getting-Data-In/How-to-get-URL-filtering-logs-from-Palo-Alto-into-Splunk/m-p/162653#M33012 <P>Hello,<BR /> I am trying to find out how to get URL filtering logs from a Palo Alto into Splunk.</P> <P>I do not see a URL filter log option in the "Log Forwarding Profile"</P> <P>I have the Palo Alto plug-in installed in Splunk.</P> <P>If it matters, I am using Splunk 6.1.</P> <P>Thanks!</P> Fri, 19 Dec 2014 20:27:56 GMT https://community.splunk.com/t5/Getting-Data-In/How-to-get-URL-filtering-logs-from-Palo-Alto-into-Splunk/m-p/162653#M33012 craigmueller 2014-12-19T20:27:56Z https://community.splunk.com/t5/Getting-Data-In/How-to-get-URL-filtering-logs-from-Palo-Alto-into-Splunk/m-p/162654#M33013 <P>Hi @craigmueller</P> <P>By "Palo Alto plug-in", are you referring to the Splunk for Palo Alto Networks app (<A href="https://apps.splunk.com/app/491/">https://apps.splunk.com/app/491/</A> ) or the TA-paloalto for the Splunk App for Enterprise Security (<A href="https://apps.splunk.com/app/263/">https://apps.splunk.com/app/263/</A> )?</P> Fri, 19 Dec 2014 20:42:44 GMT https://community.splunk.com/t5/Getting-Data-In/How-to-get-URL-filtering-logs-from-Palo-Alto-into-Splunk/m-p/162654#M33013 ppablo 2014-12-19T20:42:44Z https://community.splunk.com/t5/Getting-Data-In/How-to-get-URL-filtering-logs-from-Palo-Alto-into-Splunk/m-p/162655#M33014 <P>You don't need to do anything special with the Palo Splunk App</P> <P>Assuming you have the appropriate security policy configured for url filtering, and that same policy is configured to forward syslog messages correctly. </P> <P>There are a couple of things to look at. Most of the url logs are informational events. Check your syslog profile is set to send informational events.</P> <P>Also in the URL filtering configuration (Objects&gt;security profiles&gt;URL filtering). Set the desired categories to an action of 'alert' and it will syslog them out. </P> <P>Then in splunk they will appear as a sourcetype of "pan_threat"</P> <P>There is also an option to 'log container page only' which will not log all content. Uncheck that and you should get everything.</P> Sat, 20 Dec 2014 02:33:19 GMT https://community.splunk.com/t5/Getting-Data-In/How-to-get-URL-filtering-logs-from-Palo-Alto-into-Splunk/m-p/162655#M33014 mbenwell 2014-12-20T02:33:19Z https://community.splunk.com/t5/Getting-Data-In/How-to-get-URL-filtering-logs-from-Palo-Alto-into-Splunk/m-p/162656#M33015 <P>@mbenwell</P> <P>I know this is more of a PA question but, can you set up alerting for URLs on the URL Filtering Profile block list?</P> Mon, 22 Dec 2014 16:59:20 GMT https://community.splunk.com/t5/Getting-Data-In/How-to-get-URL-filtering-logs-from-Palo-Alto-into-Splunk/m-p/162656#M33015 craigmueller 2014-12-22T16:59:20Z https://community.splunk.com/t5/Getting-Data-In/How-to-get-URL-filtering-logs-from-Palo-Alto-into-Splunk/m-p/162657#M33016 <P>I don't use the profile Block List text box, so can't really answer for that specific use. Usually setting the action to block should send a syslog message</P> <P>If it doesn't log using the block list text box in the URL profile, you could try creating a custom category and add that to the URL profile.</P> Mon, 22 Dec 2014 23:16:14 GMT https://community.splunk.com/t5/Getting-Data-In/How-to-get-URL-filtering-logs-from-Palo-Alto-into-Splunk/m-p/162657#M33016 mbenwell 2014-12-22T23:16:14Z