> ## Documentation Index
> Fetch the complete documentation index at: https://docs.sazabi.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Palo Alto Networks

> Forward Palo Alto Networks firewall traffic, threat, and system logs to Sazabi from Strata Logging Service HTTPS forwarding, a PAN-OS HTTP server profile, or syslog through a Vector collector.

[All Palo Alto Networks integration capabilities](https://docs.sazabi.com/catalogs/integrations/palo-alto)

## About

Send the network security record from your [Palo Alto Networks](https://www.paloaltonetworks.com/network-security/next-generation-firewall) firewalls to Sazabi: traffic logs for every session, threat logs for detections, and system logs for firewall events. Palo Alto pushes logs to your intake URL; Sazabi never holds a Palo Alto credential.

Each record keeps every forwarded field. Sazabi reads the time from `TimeGeneratedHighResolution` or `TimeGenerated` (or the syslog timestamp) and the severity from `Severity` (or the syslog severity), and copies `LogType`, `Subtype`, `DeviceName`, and `DeviceSN` to the `palo_alto.log_type`, `palo_alto.subtype`, `palo_alto.device_name`, and `palo_alto.device_serial` attributes.

## Prerequisites

* One of: [Strata Logging Service](https://docs.paloaltonetworks.com/strata-logging-service) with the Log Forwarding add-on license, PAN-OS 9.0 or later on the firewall or Panorama, or a host running [Vector](https://vector.dev/) that your firewalls can reach
* Your Sazabi intake URL, shown above — open the log source and copy the **Intake URL** from its setup screen (the public key is embedded in the URL)

## Set up in the dashboard

Pick one transport per firewall so logs are not stored twice.

> [tab] Strata Logging Service
>
> Strata Logging Service sends gzip-compressed JSON batches of up to 500 logs, which suits high volume. See Palo Alto's [Forward logs to an HTTPS server](https://docs.paloaltonetworks.com/strata-logging-service/administration/forward-logs/forward-logs-to-an-https-server).
>
> **Step 1**
>
> ### Add an HTTPS profile
>
> In the [Strata Logging Service app](https://apps.paloaltonetworks.com/), open **Log Forwarding** and click **Add** in the **HTTPS** section.
>
> **Step 2**
>
> ### Point it at Sazabi
>
> Set **Name** to `Sazabi`, paste your intake URL as the destination URL, and set **Client Authorization** to `None` — the intake URL already carries your key.
>
> **Step 3**
>
> ### Choose the log types
>
> Select the firewall Traffic, Threat, and System log types, plus any others you want in Sazabi, then click **Save**.

> [tab] PAN-OS HTTP
>
> The firewall or Panorama posts each log as JSON. Palo Alto documents this transport for low log volumes only and warns that logs may be lost at high volume. See Palo Alto's [Forward logs to an HTTP/S destination](https://docs.paloaltonetworks.com/pan-os/11-1/pan-os-admin/monitoring/forward-logs-to-an-https-destination).
>
> **Step 1**
>
> ### Add an HTTP server profile
>
> In the PAN-OS web interface, select **Device → Server Profiles → HTTP** and **Add** a profile named `Sazabi`. On **Servers**, add a row with **Address** set to your intake URL's hostname (the URL without `https://`), **Protocol** `HTTPS`, **Port** `443`, **TLS Version** `1.2`, and **HTTP Method** `POST`. The dashboard setup screen shows the hostname ready to copy.
>
> **Step 2**
>
> ### Set the payload format
>
> On **Payload Format**, for each of Traffic, Threat, and System set **URI Format** to `/`, add the header `Content-Type` with value `application/json`, and paste the matching payload. The `$name` tokens are PAN-OS log variables the firewall fills in.
>
> > [tab] Traffic
> >
> > ```json theme={"system"}
> > {"LogType":"TRAFFIC","Subtype":"$subtype","TimeGeneratedHighResolution":"$high_res_timestamp","DeviceName":"$device_name","DeviceSN":"$serial","Rule":"$rule","Action":"$action","Application":"$app","SourceAddress":"$src","DestinationAddress":"$dst","SourcePort":"$sport","DestinationPort":"$dport","Protocol":"$proto","SourceUser":"$srcuser","Bytes":"$bytes","SessionEndReason":"$session_end_reason"}
> > ```
>
> > [tab] Threat
> >
> > ```json theme={"system"}
> > {"LogType":"THREAT","Subtype":"$subtype","TimeGeneratedHighResolution":"$high_res_timestamp","DeviceName":"$device_name","DeviceSN":"$serial","Severity":"$severity","ThreatID":"$threatid","Direction":"$direction","Rule":"$rule","Action":"$action","Application":"$app","SourceAddress":"$src","DestinationAddress":"$dst","SourcePort":"$sport","DestinationPort":"$dport","SourceUser":"$srcuser"}
> > ```
>
> > [tab] System
> >
> > ```json theme={"system"}
> > {"LogType":"SYSTEM","Subtype":"$subtype","TimeGeneratedHighResolution":"$high_res_timestamp","DeviceName":"$device_name","DeviceSN":"$serial","Severity":"$severity","EventID":"$eventid","Module":"$module","Description":"$opaque"}
> > ```
>
> **Step 3**
>
> ### Attach the profile and commit
>
> Add the `Sazabi` profile to the Log Forwarding profile your security policy rules use (**Objects → Log Forwarding**) for traffic and threat logs, and to **Device → Log Settings** for system logs, then **Commit**.

> [tab] Syslog through Vector
>
> The firewall sends syslog to a Vector collector you run, and Vector posts each message to Sazabi over HTTPS. See Palo Alto's [Configure syslog monitoring](https://docs.paloaltonetworks.com/pan-os/11-1/pan-os-admin/monitoring/use-syslog-for-monitoring/configure-syslog-monitoring) and Vector's [syslog source](https://vector.dev/docs/reference/configuration/sources/syslog/).
>
> **Step 1**
>
> ### Add the Vector pipeline
>
> Add a syslog source and an HTTPS sink to your Vector config. The dashboard setup screen shows this config with your intake hostname filled in; the `uri` is your intake URL.
>
> ```yaml title="vector.yaml" theme={"system"}
> sources:
>   palo_alto_syslog:
>     type: syslog
>     mode: tcp
>     address: "0.0.0.0:5514"
>
> sinks:
>   sazabi:
>     type: http
>     inputs: ["palo_alto_syslog"]
>     uri: "https://<your intake hostname>"
>     method: post
>     compression: gzip
>     batch:
>       max_events: 1000
>     encoding:
>       codec: json
>     framing:
>       method: newline_delimited
> ```
>
> Restart Vector.
>
> **Step 2**
>
> ### Point PAN-OS syslog at Vector
>
> In the PAN-OS web interface, select **Device → Server Profiles → Syslog** and add a server with the Vector host's address, **Transport** `TCP`, **Port** `5514`, and **Format** `IETF`. Add the profile to your Log Forwarding profile and **Device → Log Settings**, then **Commit**.

## Set up with the CLI

You can also register the Palo Alto Networks log source with the [Sazabi CLI](https://docs.sazabi.com/reference/cli.md) (installed and authenticated — see [CLI reference](https://docs.sazabi.com/reference/cli/log-sources.md)):

```bash theme={"system"}
sazabi log-sources create palo_alto --mode manual
```

The command prints the intake URL for the new source — use it in the steps above. Run `sazabi log-sources get <log-source-id>` at any time to reprint the endpoint.

## Verify

Generate traffic through a forwarding firewall, or make a configuration change to produce a system log. Open the [Intake page](https://docs.sazabi.com/guides/instrument/intake.md) in the Sazabi dashboard and confirm logs from the **Palo Alto Networks** source appear within a minute or two.

From the CLI, `sazabi logs ask "How many Palo Alto logs arrived in the last 15 minutes, by palo_alto.log_type?"` confirms logs are arriving.

## Troubleshooting

**Nothing arrives from Strata Logging Service** — Confirm the Log Forwarding add-on license is active and the HTTPS profile's log type filters include the logs you are generating.

**Nothing arrives from PAN-OS HTTP** — Use **Test Server Connection** on the HTTP server profile, confirm the firewall can reach the intake host on port 443, and confirm the profile is attached to a Log Forwarding profile on a matching rule and committed.

**Logs show their receive time instead of event time** — The PAN-OS payload is missing `TimeGeneratedHighResolution`. Paste the payload again.

**Gaps under load with PAN-OS HTTP** — Palo Alto documents HTTP forwarding for low volumes only. Move busy firewalls to Strata Logging Service or syslog.

**Traffic logs have no severity** — Expected: Palo Alto traffic logs carry no severity field. Threat and system logs do.

**Syslog fields are not split into columns** — Sazabi keeps the PAN-OS syslog message as one `message` field. Use Strata Logging Service or PAN-OS HTTP for per-field attributes.

## Further reading

> [card] [Vector](https://docs.sazabi.com/catalogs/log-sources/send-to-an-endpoint/vector.md)
>
> Ship logs from your own Vector pipelines.

> [card] [Intake](https://docs.sazabi.com/guides/instrument/intake.md)
>
> See per-source ingestion volume and health.


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.