Getting Data In

Palo Alto new log category help

LynneEss
Engager

I have no idea what I need to do here (if anything), and the guy who has dealt with getting data in previously is on holiday for a while so any advice is much appreciated

We upgraded our Palo Alto firewall to a newer version which has moved the VPN logs from the system category to a separate one for GlobalProtect (more info here )

When I noticed we weren’t receiving the VPN logs anymore, we got the firewall guys to forward the new log category to us and our Splunk guy assured me that we wouldn’t need to do anything else

However, the logs are supposedly being forwarded to us now but Splunk isn’t showing them, at least not in the index we have for the Palo Alto logs. Is our Splunk guy wrong and we do actually have to manually set up the new sourcetype? Or have the firewall guys messed up (harder to check due to language barriers and time differences)

I am pretty clueless about this so apologies if this is a silly question

Labels (2)
0 Karma

PickleRick
SplunkTrust
SplunkTrust

It's not clear how you're receiving the logs and what's your configuration. Unless you're actively filtering the event categories the data should land somewhere if it is within the same syslog stream as the events you can see.

Did you confirm (tcpdump? some debug on your syslog layer if you use some intermediate solution) that the events are really getting sent?

0 Karma
Get Updates on the Splunk Community!

Technical Workshop Series: Splunk Data Management and SPL2 | Register here!

Hey, Splunk Community! Ready to take your data management skills to the next level? Join us for a 3-part ...

Spotting Financial Fraud in the Haystack: A Guide to Behavioral Analytics with Splunk

In today's digital financial ecosystem, security teams face an unprecedented challenge. The sheer volume of ...

Solve Problems Faster with New, Smarter AI and Integrations in Splunk Observability

Solve Problems Faster with New, Smarter AI and Integrations in Splunk Observability As businesses scale ...