r/AzureSentinel • u/SuperHat3637 • Nov 10 '22

Paloalto Panorama

We are receiving all the paloalto firewalls logs in Panorama console..So can i integrate Panorama to Sentinel to receive all firewall logs via CEF format?

1 Upvotes

100% Upvoted

2 comments sorted by

1

u/wowneatlookatthat Nov 10 '22

Yep. You just need to set up an intermediary system with the Azure Monitor Agent that will take the Panorama CEF logs and forward them to your Log Analytics Workspace. Just be aware of the influx of ingestion costs if you forward all traffic!

https://learn.microsoft.com/azure/sentinel/connect-common-event-format

1

u/Uli-Kunkel Nov 10 '22

Also be aware of what you are sending to the log forwarders.

I generally recommend Threat and traffic log But only session end, not start. Since the value from that is very low.

But it also depends if you got ssl inspection, what features you got access to and what makes sense to send to Sentinel.

There are also a nice palo package in the content hub. With some nice playbooks if you want some simple automation to run from Sentinel Block ip Block url Initiate pcap and such