We have multiple firewalls and different locations and each location we have syslog collector server and its forward the logs to splunk indexer.
Pan: traffic count 27,644,629 83%
Pan:threat count 3,224,543 9.77%
Pan:firewall_cloud 2,034,183 6.18%
last one hour data. it looks like over utilization, so we want to validate receiving logs are legitimate or not?
Planning to reduce consumption of firewall logs.
Please guide me how can i validate firewall logs we are reciving correct logs or any excessive or not needed?
