Palo Alto 9.x Content Pack

The following content pack is available for use with a Graylog Illuminate license and Graylog Enterprise or Graylog Security. Contact sales to learn more about obtaining Illuminate.

Warning: This content pack has been deprecated and is scheduled for removal in Illuminate 8.0.0. All supported content has been migrated to the Palo Alto 11 content pack.

Palo Alto Networks next-generation firewalls provide real-time threat prevention, application visibility, and user-based policy enforcement. This technology pack processes Palo Alto PAN-OS 9.1+ logs, providing normalization and enrichment of common events of interest.

Supported Versions

• PAN-OS 9.1+

• PAN-OS 10.x

Requirements

• A Palo Alto device sending logs to the Graylog input Palo Alto Networks TCP (PAN-OS v9+).

Stream Configuration

This technology pack includes 1 stream:

• "Illuminate:Palo Alto Messages"

Hint: If this stream does not exist prior to the activation of this pack then it is created and configured to route messages to this stream and the associated index set. There should not be any stream rules configured for this stream.

Index Set Configuration

This technology pack includes 1 index set definition:

• "Palo Alto Log Messages"

Hint: If this index set is already defined, then nothing is changed. If this index set does not exist, then it is created with retention settings of a daily rotation and 90 days of retention. These settings can be adjusted as required after installation.

Log Collection

Palo Alto devices forward logs to Graylog via syslog using the dedicated PAN-OS v9+ input.

Configure the Graylog Input

1. In Graylog, navigate to System > Inputs and launch a Palo Alto Networks TCP (PAN-OS v9+) input.

2. Note the port number and save the input.

Configure the Palo Alto Device

1. On your Palo Alto firewall, navigate to Device > Server Profiles > Syslog and create a new syslog server profile.

2. Set the server IP address to your Graylog server IP and the port to match the Graylog input port.

3. Set the transport to TCP and the format to BSD.

4. Navigate to Device > Log Settings and assign the syslog server profile to the log types you wish to forward (Threat, Traffic, GlobalProtect).

5. Commit the configuration.

Hint: Refer to the Palo Alto syslog monitoring guide for detailed device configuration steps.

Log Format Examples

PAN-OS syslog messages are delivered in BSD syslog format with a CSV-encoded payload, parsed by the Graylog PAN-OS v9+ input.

GlobalProtect Log

<14>1 2021-03-08T14:10:27.137432Z PYTHON_TEST_SENDER - - - - 1,2020/04/01 10:49:58,015351000040055,13,0x0,GLOBALPROTECT,0,2305,2020/04/01 10:49:58,vsys1,portal-auth,login,Local Database,,phillip.price,192.168.0.0-192.168.255.255,WIN-VAL4395SQ3L,192.168.45.33,0.0.0.0,0.0.0.0,0.0.0.0,2c2ec970-de09-444c-b84f-2c0be75e13cd,,Browser,Windows,"Microsoft Windows 7 Service Pack 1, 64-bit",1,,Invalid username or password,"",failure,,0,user-logon,1,gp-portal

Threat Log (Spyware / Vulnerability)

<14>1 2021-03-08T14:08:28.296051Z PYTHON_TEST_SENDER - - - - 1,2020/05/19 07:37:34,007200002536,THREAT,spyware,2305,2020/05/19 07:37:34,10.154.229.167,77.254.254.254,,,General Business Apps,pancademo\andy.miller,,unknown-udp,vsys1,L3-TAP,L3-TAP,ethernet1/2,ethernet1/2,,2020/05/19 07:37:34,140539,1,1024,1024,0,0,0x2000,udp,drop-all-packets,"ZeroAccess.Gen Command and Control Traffic(13235)",13235,critical,server-to-client,6684613427694591054,0x0,10.0.0.0-10.255.255.255,10.0.0.0-10.255.255.255,0,1589874840,0,0,0,,us1,,,, 0,,0,,N/A,spyware,

Threat Log (URL Filtering)

<14>1 2021-03-08T13:35:29.030447Z PYTHON_TEST_SENDER - - - - 1,2020/05/19 07:37:25,007200002536,THREAT,url,2305,2020/05/19 07:37:25,10.154.172.203,74.125.224.99,,,General Web Infrastructure,pancademo\shane.long,,google-analytics,vsys1,L3-TAP,L3-TAP,ethernet1/2,ethernet1/2,ToUS1RAMA,2020/05/19 07:37:25,50003,1,56776,80,0,0,0x0,tcp,block-url,"analytics.google.com/analytics/r/collect (9999)",9999,informational,client-to-server,6684613427694591000,0x0,10.0.0.0-10.255.255.255,United States,0,1589874840,0,0,0,,us1,,,,0,,0,,N/A,computer-and-internet-info low-risk,

Traffic Log

<14>1 2021-03-08T14:09:00.000000Z PYTHON_TEST_SENDER - - - - 1,2020/05/19 07:38:00,007200002536,TRAFFIC,end,2305,2020/05/19 07:38:00,10.154.229.167,77.254.254.254,10.154.229.167,77.254.254.254,General Business Apps,pancademo\andy.miller,,web-browsing,vsys1,L3-TAP,L3-TAP,ethernet1/2,ethernet1/2,ToUS1RAMA,2020/05/19 07:38:00,140540,1,1024,443,0,0,0x400000,tcp,allow,4096,2048,2048,10,2020/05/19 07:37:50,10,any,,6684613427694591055,0x0,10.0.0.0-10.255.255.255,United States,,5,0,n/a,0,0,0,0,,us1,from-policy,

What is Provided

• Parsing and normalization rules for Palo Alto PAN-OS 9.1+ logs.

• Graylog Information Model (GIM) event type categorization for Traffic, Threat, URL Filtering, and GlobalProtect events.

Events Processed by This Technology Pack

This content pack supports the following PAN-OS log types:

• GlobalProtect - portal authentication events (portal-auth).

• Threat - intrusion detection alerts including spyware and vulnerability subtypes.

• Threat (URL Filtering) - URL filtering block and alert events.

• Traffic - network session events.

GIM Categorization

GIM event type categorization is provided for the following message types:

Field Normalization

Fields extracted and normalized for each PAN-OS 9.x log type. The Graylog PAN-OS v9+ input pre-parses the CSV payload; pipeline rules rename and enrich fields to Illuminate standard names.

GlobalProtect Log Fields

Threat Log Fields (Spyware / Vulnerability)

Threat Log Fields (URL Filtering)

Traffic Log Fields