Getting Data In

PaloAlto Threat and Traffic logs not being passed to splunk but System and Config logs are.

RichieOl
Explorer

We are testing the log collection from our paloalto firewalls and seem to have come across a snag when trying to monitor the traffic and threat events. We have the PaloAlto addon and app installed and it is working fine as the config and system logs are being processed and added to the dashboard. The datamodel accelaration is on but there is still no data.

When using the search bar i have been looking for all logs coming in through port 514 as the logs are being send through udp. (source=udp:514) and i can see the system and config logs there too but no other types. I am starting to feel like the issue is with the palo side but i want to make sure that i am not missing something on the splunk side to. Ive gone through the log forwarding form the palo side several times and if its sending the system and config fine, why not the rest? KR

0 Karma
1 Solution

RichieOl
Explorer

Found the solution. I had created the forwarding profile for the traffic and threat logs and set the forwarding to the splunk server but i didnt attach it to the security policy i wanted to monitor so i was onyl getting the standard config and systems logs that monitor the fw itself, not the data that is getting passed through.

Here is the knowledge article i found that helped me resolve my issue if anyone has a similar problem in the future.

Tips & Tricks: Forward traffic logs to a syslog server - Knowledge Base - Palo Alto Networks

View solution in original post

RichieOl
Explorer

Found the solution. I had created the forwarding profile for the traffic and threat logs and set the forwarding to the splunk server but i didnt attach it to the security policy i wanted to monitor so i was onyl getting the standard config and systems logs that monitor the fw itself, not the data that is getting passed through.

Here is the knowledge article i found that helped me resolve my issue if anyone has a similar problem in the future.

Tips & Tricks: Forward traffic logs to a syslog server - Knowledge Base - Palo Alto Networks

Get Updates on the Splunk Community!

How to Monitor Google Kubernetes Engine (GKE)

We’ve looked at how to integrate Kubernetes environments with Splunk Observability Cloud, but what about ...

Index This | How can you make 45 using only 4?

October 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with this ...

Splunk Education Goes to Washington | Splunk GovSummit 2024

If you’re in the Washington, D.C. area, this is your opportunity to take your career and Splunk skills to the ...