Palo Alto Syslogs to Sentinel

Question

Hi,&nbsp;We are ingesting Palo Alto firewall logs into Sentinel that seems to be mostly working, however the fields are not populating correctly.&nbsp;There is an additional field called 'AdditionalExtensions' that contains most of the pertinent information within the log in one big text string, such as destip, srcip, user, etc.&nbsp;Has any one had this issue before? Would this issue be caused by configuration on the Firewall itself, the proxy forwarder, or is there something I can do within Sentinel itself?&nbsp;Many thanks for any assistance

clivewatson · Answer

There is a ASIM parser for PaloMain docs:https://docs.microsoft.com/en-us/azure/sentinel/normalizationParsers page:Azure-Sentinel/Parsers/ASimNetworkSession at master · Azure/Azure-Sentinel - https://github.com/and the parser itself, where that field is normalized:Azure-Sentinel/ASimNetworkSessionPaloAltoCEF.yaml at master · Azure/Azure-Sentinel - https://github.com/

Forum Discussion

Palo Alto Syslogs to Sentinel

Share

Resources