Palo Alto Networks

All Palo Alto Networks integration capabilities

About

Send the network security record from your Palo Alto Networks firewalls to Sazabi: traffic logs for every session, threat logs for detections, and system logs for firewall events. Palo Alto pushes logs to your intake URL; Sazabi never holds a Palo Alto credential. Each record keeps every forwarded field. Sazabi reads the time from TimeGeneratedHighResolution or TimeGenerated (or the syslog timestamp) and the severity from Severity (or the syslog severity), and copies LogType, Subtype, DeviceName, and DeviceSN to the palo_alto.log_type, palo_alto.subtype, palo_alto.device_name, and palo_alto.device_serial attributes.

Prerequisites

One of: Strata Logging Service with the Log Forwarding add-on license, PAN-OS 9.0 or later on the firewall or Panorama, or a host running Vector that your firewalls can reach
Your Sazabi intake URL, shown above — open the log source and copy the Intake URL from its setup screen (the public key is embedded in the URL)

Set up in the dashboard

Pick one transport per firewall so logs are not stored twice.

Strata Logging Service
PAN-OS HTTP
Syslog through Vector

Strata Logging Service sends gzip-compressed JSON batches of up to 500 logs, which suits high volume. See Palo Alto’s Forward logs to an HTTPS server.

Add an HTTPS profile

In the Strata Logging Service app, open Log Forwarding and click Add in the HTTPS section.

Point it at Sazabi

Set Name to Sazabi, paste your intake URL as the destination URL, and set Client Authorization to None — the intake URL already carries your key.

Choose the log types

Select the firewall Traffic, Threat, and System log types, plus any others you want in Sazabi, then click Save.

The firewall or Panorama posts each log as JSON. Palo Alto documents this transport for low log volumes only and warns that logs may be lost at high volume. See Palo Alto’s Forward logs to an HTTP/S destination.

Add an HTTP server profile

In the PAN-OS web interface, select Device → Server Profiles → HTTP and Add a profile named Sazabi. On Servers, add a row with Address set to your intake URL’s hostname (the URL without https://), Protocol HTTPS, Port 443, TLS Version 1.2, and HTTP Method POST. The dashboard setup screen shows the hostname ready to copy.

Set the payload format

On Payload Format, for each of Traffic, Threat, and System set URI Format to /, add the header Content-Type with value application/json, and paste the matching payload. The $name tokens are PAN-OS log variables the firewall fills in.

Traffic
Threat
System

{"LogType":"TRAFFIC","Subtype":"$subtype","TimeGeneratedHighResolution":"$high_res_timestamp","DeviceName":"$device_name","DeviceSN":"$serial","Rule":"$rule","Action":"$action","Application":"$app","SourceAddress":"$src","DestinationAddress":"$dst","SourcePort":"$sport","DestinationPort":"$dport","Protocol":"$proto","SourceUser":"$srcuser","Bytes":"$bytes","SessionEndReason":"$session_end_reason"}

{"LogType":"THREAT","Subtype":"$subtype","TimeGeneratedHighResolution":"$high_res_timestamp","DeviceName":"$device_name","DeviceSN":"$serial","Severity":"$severity","ThreatID":"$threatid","Direction":"$direction","Rule":"$rule","Action":"$action","Application":"$app","SourceAddress":"$src","DestinationAddress":"$dst","SourcePort":"$sport","DestinationPort":"$dport","SourceUser":"$srcuser"}

{"LogType":"SYSTEM","Subtype":"$subtype","TimeGeneratedHighResolution":"$high_res_timestamp","DeviceName":"$device_name","DeviceSN":"$serial","Severity":"$severity","EventID":"$eventid","Module":"$module","Description":"$opaque"}

Attach the profile and commit

Add the Sazabi profile to the Log Forwarding profile your security policy rules use (Objects → Log Forwarding) for traffic and threat logs, and to Device → Log Settings for system logs, then Commit.

The firewall sends syslog to a Vector collector you run, and Vector posts each message to Sazabi over HTTPS. See Palo Alto’s Configure syslog monitoring and Vector’s syslog source.

Add the Vector pipeline

Add a syslog source and an HTTPS sink to your Vector config. The dashboard setup screen shows this config with your intake hostname filled in; the uri is your intake URL.

vector.yaml

sources:
  palo_alto_syslog:
    type: syslog
    mode: tcp
    address: "0.0.0.0:5514"

sinks:
  sazabi:
    type: http
    inputs: ["palo_alto_syslog"]
    uri: "https://<your intake hostname>"
    method: post
    compression: gzip
    batch:
      max_events: 1000
    encoding:
      codec: json
    framing:
      method: newline_delimited

Restart Vector.

Point PAN-OS syslog at Vector

In the PAN-OS web interface, select Device → Server Profiles → Syslog and add a server with the Vector host’s address, Transport TCP, Port 5514, and Format IETF. Add the profile to your Log Forwarding profile and Device → Log Settings, then Commit.

Set up with the CLI

You can also register the Palo Alto Networks log source with the Sazabi CLI (installed and authenticated — see CLI reference):

sazabi log-sources create palo_alto --mode manual

The command prints the intake URL for the new source — use it in the steps above. Run sazabi log-sources get <log-source-id> at any time to reprint the endpoint.

Verify

Generate traffic through a forwarding firewall, or make a configuration change to produce a system log. Open the Intake page in the Sazabi dashboard and confirm logs from the Palo Alto Networks source appear within a minute or two. From the CLI, sazabi logs ask "How many Palo Alto logs arrived in the last 15 minutes, by palo_alto.log_type?" confirms logs are arriving.

Troubleshooting

Nothing arrives from Strata Logging Service — Confirm the Log Forwarding add-on license is active and the HTTPS profile’s log type filters include the logs you are generating. Nothing arrives from PAN-OS HTTP — Use Test Server Connection on the HTTP server profile, confirm the firewall can reach the intake host on port 443, and confirm the profile is attached to a Log Forwarding profile on a matching rule and committed. Logs show their receive time instead of event time — The PAN-OS payload is missing TimeGeneratedHighResolution. Paste the payload again. Gaps under load with PAN-OS HTTP — Palo Alto documents HTTP forwarding for low volumes only. Move busy firewalls to Strata Logging Service or syslog. Traffic logs have no severity — Expected: Palo Alto traffic logs carry no severity field. Threat and system logs do. Syslog fields are not split into columns — Sazabi keeps the PAN-OS syslog message as one message field. Use Strata Logging Service or PAN-OS HTTP for per-field attributes.

Vector

Ship logs from your own Vector pipelines.

Intake

See per-source ingestion volume and health.

Overview

Get started

Guides

Catalogs

Reference

Security & trust

cve.now

Palo Alto Networks

About

Prerequisites

Set up in the dashboard

Add an HTTPS profile

Point it at Sazabi

Choose the log types

Add an HTTP server profile

Set the payload format

Attach the profile and commit

Add the Vector pipeline

Point PAN-OS syslog at Vector

Set up with the CLI

Verify

Troubleshooting

Further reading

Vector

Intake

​About

​Prerequisites

​Set up in the dashboard

​Add an HTTPS profile

​Point it at Sazabi

​Choose the log types

​Add an HTTP server profile

​Set the payload format

​Attach the profile and commit

​Add the Vector pipeline

​Point PAN-OS syslog at Vector

​Set up with the CLI

​Verify

​Troubleshooting

​Further reading

Vector

Intake

About

Prerequisites

Set up in the dashboard

Add an HTTPS profile

Point it at Sazabi

Choose the log types

Add an HTTP server profile

Set the payload format

Attach the profile and commit

Add the Vector pipeline

Point PAN-OS syslog at Vector

Set up with the CLI

Verify

Troubleshooting

Further reading