Integrating with Palo Alto Networks Panorama

Overview

Palo Alto Panorama offers easy-to-implement and centralized management features to gain insight into network-wide traffic and threats, and administer your firewalls everywhere.

Panorama enables you to forward logs to external servers, including syslog, email, and SNMP trap servers. By forwarding logs to Blumira’s platform, you can reduce firewall load and provide a reliable approach to log forwarding.

With this configuration, Blumira will be able to provide log aggregation, threat detection, and actionable response for network segments protected by Palo Alto Panorama.

Before you begin

This integration requires a Blumira sensor to be installed before you can complete the steps below. Ensure that you complete the steps in Building a Blumira sensor with Ubuntu before you continue.

Gather the IP address of your Blumira sensor to use when configuring the external service.

To find and copy the IP address of the sensor, do the following:

1. In Blumira, navigate to Settings > Sensors.
2. Click the sensor row to open the details page.
3. In the Overview section, next to Host Details, copy the IP address.

Configuring log forwarding from Palo Alto Networks Panorama

To start sending logs to Blumira:

1. Create a server profile:
   1. Navigate to Panorama > Server Profiles.
   2. Select Syslog.
   3. Configure the server profile, including:
      • the IP address of the Blumira sensor you will use to collect log data
      • port number 514
2. Configure destinations:
   1. Select Panorama > Log Settings.
   2. For System, Correlation, and Threat logs, click each Severity level, select the Syslog server profile you just created for Blumira, and click OK.
   3. For WildFire logs, click each Verdict, select Syslog server profile for Blumira you just created, and click OK.
3. Configure destinations for firewall logs that an M-Series appliance in Panorama or Log Collector mode collects (M-Series appliance only):
   1. Select Panorama > Collector Groups and select the Collector Group that receives the firewall logs.
   2. Click the Collector Log Forwarding tab.
   3. For each log Severity level in the System, Threat, and Correlation tabs, click a cell in the Syslog Profile column, and select the server profile you just created.
   4. In the Config, HIP Match, and Traffic tabs, select the Syslog server profile you just created.
   5. For each Verdict in the WildFire tab, click a cell in the Syslog Profile column, and select the server profile you just created.
   6. Click OK to save your changes to the Collector Group.
4. Commit Changes
   1. Click Commit, set the Commit Type to Panorama, and click Commit again.
   2. Click Commit, set the Commit Type to Device Group.
   3. Select all the device groups of the firewalls from which Panorama collects logs. Include Device and Network Templates and click Commit again.
   4. Click Commit, set the Commit Type to Collector Group.
   5. Select the Collector Group you just configured to forward logs, and click Commit again. (M-Series appliance only)