Palo Alto Networks PA Series

Palo Alto PA DSM Specifications

The following table identifies the specifications for the Palo Alto PA Series DSM:

Table 1: DSM Specifications for Palo Alto PA Series

Specification	Value
Manufacturer	Palo Alto Networks
DSM name	Palo Alto PA Series
RPM file name	DSM-PaloAltoPaSeries-JSA_version-build_number.noarch.rpm
Event format	LEEF for PAN-OS v3.0 to v9.1, and Prisma Access v2.1 CEF for PAN-OS v4.0 to v6.1. (CEF:0 is supported)
JSA recorded log types	Traffic Threat Config System HIP Match Data WildFire Authentication Tunnel Inspection Correlation URL Filtering User-ID SCTP File Data GTP HIP Match IP-Tag Global Protect - Note: To use this log type, you must enable the EventStatus field in Palo Alto. Decryption
Automatically discovered?	Yes
Includes identity?	Yes
Includes custom properties?	No
More information	Palo Alto Networks website

Creating a Syslog Destination on Your Palo Alto PA Series Device

To send Palo Alto PA Series events to JSA, create a Syslog destination (Syslog or LEEF event format) on your Palo Alto PA Series device.

Note:

Palo Alto can send only one format to all Syslog devices. By modifying the Syslog format, any other device that requires Syslog must support that same format.

1. Log in to the Palo Alto Networks interface.

2. On the Device tab, click Server Profiles > Syslog, and then click Add.

3. Create a Syslog destination by following these steps:

   1. In the Syslog Server Profile dialog box, click Add.

   2. Specify the name, server IP address, port, and facility of the JSA system that you want to use as a syslog server.

   3. If you are using Syslog, set the Custom Format column to Default for all log types.

4. Configure LEEF events by following these steps:

   Note:

   Due to formatting issues, copy the text into a text editor, remove any carriage return or line feed characters, and then paste it into the appropriate field.

   1. Click the Config Log Format tab in the Syslog Server Profile dialog.

   2. Click Config, copy the following text and paste it in the Config Log Format column for the Config log type.

      • PAN-OS v3.0 - v6.1--

      • PAN-OS v7.1 - v9.1--

   3. Click System, copy one of the following texts applicable to the version you are using and paste it in the System Log Format field for the System log type. If your version is not listed, omit this step.

      • PAN-OS v3.0 - v6.1--

      • PAN-OS v7.1 - v9.1--

   4. Click Threat, copy one of the following texts applicable to the version you are using, paste it in the Threat Log Format filed for the Threat log type. If your version is not listed, omit this step.

      • PAN-OS v3.0 - v6.1--

      • PAN-OS v7.1--

      • PAN-OS v8.0 - 9.1--

   5. Click Traffic, copy one of the following texts applicable to the version you are using and paste it in the Traffic Log Format field for the Traffic log type. If your version is not listed, omit this step.

      • PAN-OS v3.0 - v6.1--

      • PAN-OS v7.1--

      • PAN-OS v8.0 - 9.1--

   6. If you are using versions other than PAN-OS 3.0 - 6.1, click HIP Match, copy one of the following texts applicable to the version you are using, and paste it in the HIP Match Log Format field for the HIP Match log type.

      • PAN-OS v7.1--

      • PAN-OS v8.0 - 9.1--

   7. If you are using PAN-OS 8.0 - 9.1, copy the following text and paste it in the Custom Format column for the URL Filtering log type.

      PAN-OS v8.0 - 9.1-

   8. If you are using PAN-OS 8.0 - 9.1, copy the following text and paste it in the Custom Format column for the Data log type.

      PAN-OS v8.0 - 9.1--

   9. If you are using PAN-OS 8.0 - 9.1, copy the following text and paste it in the Custom Format column for the Wildfire log type.

      PAN-OS v8.0 - 9.1--

   10. If you are using PAN-OS 8.0 - 9.1, copy the following text and paste it in the Custom Format column for the Authentication log type.

       PAN-OS v8.0 - 9.1--

   11. If you are using PAN-OS 8.0 - 9.1, copy the following text and paste it in the Custom Format column for the User-ID log type.

       PAN-OS v8.0 - 9.1--

   12. If you are using PAN-OS 8.0 - 9.1, copy the following text and paste it in the Custom Format column for the Tunnel Inspection log type.

       PAN-OS v8.0 - 9.1--

   13. If you are using PAN-OS 8.0 - 9.1, copy the following text and paste it in the Custom Format column for the Correlation log type.

       PAN-OS v8.0 - 9.1--

   14. If you are using PAN-OS 8.1 - 9.1, copy the following text, and paste it in the Custom Format column for the SCTP log type.

       PAN-OS v8.1 - 9.1

   15. If you are using PAN-OS 9.x, copy the following text, and paste it in the Custom Format column for the IPTag log type.

5. Click OK.

6. To specify the severity of events that are contained in the Syslog messages, click Log Setting.

   1. For each severity that you want to include in the Syslog message, click the Severity name and select the Syslog destination from the Syslog menu.

   2. Click OK.

7. Click Commit.

To allow communication between your Palo Alto Networks device and JSA, create a forwarding policy. See Creating a forwarding policy on your Palo Alto PA Series device.

Forwarding Palo Alto Cortex Data Lake (Next Generation Firewall) LEEF events to JSA

To send Palo Alto Cortex Data Lake events to JSA, you must add a TLS Syslog log source in JSA and configure Cortex Data Lake to forward logs to a syslog server.

1. Add a log source in JSA by using the TLS Syslog protocol. For more information, see TLS Syslog log source parameters for Palo Alto PA Series.

2. Forward logs from Cortex Data Lake to JSA. For more information, see your Palo Alto documentation.

Note:

• When forwarding logs from Cortex Data Lake, choose the LEEF log format.

• You must enable the cat and EventStatus fields in Palo Alto. The EventStatus field is required to parse Global Protect events in JSA.

Creating a Forwarding Policy on Your Palo Alto PA Series Device

If your JSA Console or Event Collector is in a different security zone than your Palo Alto PA Series device, create a forwarding policy rule.

1. Log in to Palo Alto Networks.

2. On the dashboard, click the Policies tab.

3. Click Policies > Policy Based Forwarding.

4. Click Add.

5. Configure the parameters. For descriptions of the policy-based forwarding values, see your Palo Alto Networks Administrator’s Guide.

Creating ArcSight CEF Formatted Syslog Events on Your Palo Alto PA Series Networks Firewall Device

Configure your Palo Alto Networks firewall to send ArcSight CEF formatted Syslog events to JSA.

1. Log in to the Palo Alto Networks interface.

2. Click the Device tab.

3. Select Server Profiles >Syslog, and then click Add.

4. On the Servers tab, click Add.

5. Specify the name, server IP address, port, and facility of the JSA system that you want to use as a Syslog server:

   1. The Name is the Syslog server name.

   2. The Syslog Server is the IP address for the Syslog server.

   3. The Transport/Port default is 514.

   4. The Faculty default is LOG_USER.

6. To select any of the listed log types that define a custom format, based on the ArcSight CEF for that log type, complete the following steps:

   1. Click the Custom Log Format tab and select any of the listed log types to define a custom format based on the ArcSight CEF for that log type. The listed log types are Config, System, Threat, Traffic, and HIP Match.

   2. Click OK twice to save your entries, then click Commit.

7. To define your own CEF-style formats that use the event mapping table that is provided in the ArcSight document, Implementing ArcSight CEF, you can use the following information about defining CEF style formats:

   The Custom Log Format tab supports escaping any characters that are defined in the CEF as special characters. For example, to use a backslash to escape the backslash and equal characters, enable the Escaping check box, specify \=as the Escaped Characters and \as the Escape Character.

   The following list displays the CEF-style format that was used during the certification process for each log type. These custom formats include all of the fields, in a similar order, that the default format of the Syslogs display.

   Note:

   Due to PDF formatting, do not copy and paste the message formats directly into the PAN-OS web interface. Instead, paste into a text editor, remove any carriage return or line feed characters, and then copy and paste into the web interface.

   • Traffic--

   • Threat--

   • Config--

   • • Optional:--

   • System--

   • HIP Match--

For more information about Syslog configuration, see the PAN-OS Administrator's Guide on the Palo Alto Networks website (https://www.paloaltonetworks.com).

TLS Syslog log source parameters for Palo Alto PA Series

If JSA does not automatically detect the log source, add a Palo Alto PA Series log source on the JSA Console by using the TLS Syslog protocol.

When you use the TLS Syslog protocol, there are specific parameters that you must configure.

The following table describes the parameters that require specific values to collect TLS Syslog events from Palo Alto PA Series:

Table 2: TLS Syslog log source parameters for the Palo Alto PA Series DSM

Parameter	Value
Log Source type	Palo Alto PA Series
Protocol Configuration	TLS Syslog
Log Source Identifier	An IP address or hostname to identify the log source.

For a complete list of TLS Syslog protocol parameters and their values, see TLS Syslog Protocol Configuration Options.

Palo Alto PA Series Sample Event Message

Use these sample event messages as a way of verifying a successful integration with JSA.

Note:

Due to formatting issues, paste the message format into a text editor and then remove any carriage return or line feed characters.

Palo Alto PA Series sample message when you use the Syslog protocol

Sample 1: The following sample event message shows PAN-OS events for a trojan threat event.

Table 3: Highlighted fields in the sample event

JSA field name	Highlighted payload fields
Event ID	The Event ID value is 268198686. Note: Usually the Event ID field from the LEEF header is used. However, for certain event types, more LEEF fields or custom fields such as Subtype, and action might be used to form a unique event ID.
Category	PA Series Threat Note: The value of the cat field is not used directly as the Category of the event. The value of this field is used to determine a predefined set of category values. For certain event types, more LEEF fields or custom fields can be used to form a unique event Category.
Device Time	devTime
Source IP	src
Destination IP	dst
Source Port	srcPort
Destination Port	dstPort
Post NAT Source IP	srcPostNAT
Post NAT Destination IP	dstPostNAT
Post NAT Soure Port	srcPostNATPort
Post NAT Destination Port	dstPostNATPort
Protocol	proto

Sample 2: The following sample event message shows a Prisma event where a session is allowed by a policy.

Table 4: Highlighted fields in the sample event

JSA field name	Highlighted payload fields
Event ID	The Event ID value is allow.
Event Category	PA Series Traffic Note: The value of the cat field is not used directly as the Category of the event. The value of this field is used to determine a predefined set of category values. For certain event types, more LEEF fields or custom fields can be used to form a unique event Category.
Device Time	devTime
Source IP	src
Destination IP	dst
Source Port	srcPort
Destination Port	dstPort
Post NAT Source IP	srcPostNAT
Post NAT Destination IP	dstPostNAT
Post NAT Soure Port	sr
Post NAT Destination Port	dstPostNATPort
Protocol	proto

Palo Alto PA Series sample message when you use the TLS Syslog protocol

The following sample event message shows Next Generation Firewall events for version 10.1.

Table 5: Highlighted fields in the sample event

JSA field name	Highlighted payload fields
Event ID	drop-all (LEEF header Event ID field) Note: Usually the Event ID field from the LEEF header is used. However, for certain event types, more LEEF fields or custom fields such as Subtype, and action might be used to form a unique event ID.
Category	PA Series GTP Note: The value of the cat field is not used directly as the Category of the event. The value of this field is used to determine a predefined set of category values. For certain event types, more LEEF fields or custom fields can be used to form a unique event Category.
Device Time	devTime
Source IPv6	src
Destination IPv6	dst
Source Port	SrcPort
Destination Port	dstPort
Post NAT Source IP	srcPostNAT
Post NAT Destination IP	dstPostNAT
Post NAT Soure Port	srcPostNATPort
Post NAT Destination Port	dstPostNATPort
Protocol	tcp
Username	usrName Note: If a username contains the domain as part of its value, the domain portion is removed and only the actual username portion is used.