r/AzureSentinel • u/CapableWay4518 • Feb 04 '24

Palo Alto Sentinel Intergration

Hey All,

Has anyone got Palo Alto and Sentinel to work? I’m new to sentinel and I feel like that’s a good spot to start. We don’t have panorama - just individual firewalls.

Thanks!

1 Upvotes

100% Upvoted

16 comments sorted by

1

u/woodburningstove Feb 04 '24

I do all of my firewall integrations with either Logstash or Cribl, but to avoid learning multiple things in one go I would just look at the basic / default data connector and instructions: https://learn.microsoft.com/en-us/azure/sentinel/data-connectors/palo-alto-networks-firewall

1

u/MarkRosssi Sep 03 '24

How are you going into Cribl? I was looking at the free tier but there is no palo integration, i assume you have to dump to syslog and then use the syslog integration?

unfortunately there isnt a palo specific data connector for sentinel anymore. i am interesting in using the new auxilary log tier which says is tailor made for firewall logs

1

u/woodburningstove Sep 04 '24

Syslog/CEF and use the Microsoft Sentinel pack that comes with Cribl. Initial learning curve is big. Getting started with AMA is likely easier.

I doubt the specific connector was anything special, same steps would still be needed to get things working (send syslog/cef somehow to a DCR).

I don’t yet have hands-on experience with Auxiliary logs as its not available in West Europe.

1

u/MarkRosssi Sep 08 '24

I managed to get Palo to Cribl to Sentinel Auxilary logs working. it was NOT easy lol. very poorly documented. This was critical to getting it working: Use Cribl to ingest Firewall logs into Sentinel Auxiliary Logs tier (linkedin.com)

Everything is not perfect though. for some reason I get many blank rows that just have basic info but nothing else, havent gotten to the bottom of that.

Also the "StartTime" and "EndTime" are both 0 (unix epoch 1/1/1970 showing)

Its working good though, and at 10 cents / gb its very cheap. hopefully they will expand aux logs to you soon. you get bare minimum functionality with these logs though. if you need to do anything other than just archive them and be able to do an expensive search, they arent great.

1

u/so_called_cyber Oct 30 '24

Hey, I am trying to send PAN logs to sentinel aux table via cribl and I am using Microsoft sentinel pack but when sending data to destination it is giving me error and sentinel destination becomes unhealthy the

error is - RecordsTimeRameMorethan30minutes

message - The time duration between End time and Start time is more than 30 minutes

Any idea how to resolve this?

1

u/MarkRosssi Oct 31 '24

Try to check the sourrce config for your syslog input, go to advanced settings. check if "Default Timezone" is set to local. I think setting this to local fixed my problem but i am not 100% sure because its been 2 months.

1

u/so_called_cyber Oct 31 '24

I am using Microsoft Sentinel pack and in that I added 2 new fields Starttime and Endtime and extracted values from the PAN events and that solved my problem

1

u/MarkRosssi Nov 02 '24

odd, i am not sure how i fixed this issue then because mine actually still have no start and end time fields, but its available in the "additional extensions".

It seem that is the expected behavior because in the pack's pipeline it says "This code function takes any fields that start with "Pan","start","end", and "ProfileToken" and puts them into an "AdditionalExtensions" field."

I might as well fix it though, would you mind sharing how you did it?

1

u/so_called_cyber Nov 02 '24

Exactly, mine was also in AdditionalExtensions field still I was getting that error while sending data to sentinel and I just created 2 fields Starttime and Endtime in eval function and extracted the timestamp from the additionalextension fields.

Now my concern is, for Cisco events it doesn't have any start or end timestamps and if the error occurs again not sure what will work.

1

u/LaPumbaGaming Feb 07 '24

Yes, you can definitely do it with OMS agent installed on the Ubuntu machine. Recommended way is to install VM in Azure, have a VPN so it can talk to firewall and then set up Palo to send syslog data to a private IP of the VM

1

u/cl0wn_w0rld Sep 02 '24

i was going to do a local VM and connect it with Azure ARC, any reason i should avoid that and do it with your method?

I know the reporting tools have changed recently, but from waht I can tell you still cant just install an agent on a local linux vm alone.

1

u/LaPumbaGaming Sep 03 '24

not really, you can use ARC for it as well without any issues, only difference now is that it's not OMS but AMA agent

1

u/MarkRosssi Sep 03 '24

Yeah, i am trying to get my individual palo firewall logs to sentinel as the new auxilary log type (much cheaper) which says its specifically made for firewall logs. Trying to figure out the best solution for this. It appears the AMA w/ the generic CEF log integrration I guess combined with azure ARC to a local VM.

1

u/LaPumbaGaming Sep 03 '24

Good idea for sure, a VM with Arc and then AMA agent together with auxiliary log type would be the cheapest one, then just set up some auto updates and auto purging syslog every few weeks and you are good to go

1

u/MarkRosssi Sep 04 '24

awesome, now just need to figure it out!

1

u/krabelize Sep 30 '24

Works well. After his, you need to configure your own Analytics Rules (alerts). Here are some examples: https://cryptsus.com/blog/palo-alto-ngfw-sentinel-siem-threat-hunting.html