Palo Alto Prisma Access is a cloud-delivered Secure Access Service Edge (SASE) platform. It secures remote workforces, branch offices, and applications by combining firewall-as-a-service, Zero Trust Network Access (ZTNA), and threat prevention into a globally scaled cloud network.
More information can be found here.
Integration Method: Data Collector (syslog)
Tables: DNS Activity (4003), Authentication (3002), Detection Finding (2004), Network Activity (4001)
This integration supports the following events.
Event | Description |
|---|---|
DNS Telemetry Response | DNS query and response activity from Prisma Access logs. |
GlobalProtect Authentication | GlobalProtect user authentication and VPN login events. |
Threat URL | URL threat detection alerts and policy actions from Prisma Access threat logs. |
Threat Vulnerability | Vulnerability threat detections and enforcement actions from Prisma Access threat logs. |
Traffic Activity | Network traffic session events (deny, drop, end) from Prisma Access traffic logs. |
Prerequisites
Access to Palo Alto Prisma Access environment.
The user should have a compatible version of the system in which the Data Collector is installed.
The user should have access to DataBee console.
Configuration Overview
Configure the Data Collector.
Prisma Access SLS Log forwarder configuration.
Configure Prisma Access feed in DataBee console.
Data Collector Configuration
To install Data Collector, please follow the steps mentioned here.
Please ensure that the Port configured during the onboarding process is open and accepting incoming data from Palo Alto Prisma Access server.
Syslog Forwarder Configuration
Rsyslog configuration is updated to expose logs on specific port. Make these changes on rsyslog where the Data Collector is installed.
Login to the syslog machine where data collector is installled.
Edit rsyslog.conf as a super user. Run the command sudo nano /etc/rsyslog.conf with admin privileges.
Add *.* @@127.0.0.1:2222 at the end of the file to expose logs to 2222 port. This port will be used for feed configuration in DataBee UI.
Save and close the file.
Run the following command to restart syslog service sudo service rsyslog restart.
Prisma Access Configuration
Login into your Prisma Access environment and navigate to System Setting > Strata Logging Service > Log Forwarding
In the Log Forwarding window click on Add New Syslog Profile.
Step1: Configure the Syslog Forwarding Profile by entering the required information and click Next.
Step2: Define Payload for Syslog Profile. Under Format select JSON.
Under the Filters select Add Filter.
A window with New Syslog Filter will open. Please click on the drop down as highlighted in the screenshot below.
Select Network/GlobalProtect. Also, you can configure the time filter as highlighted below.
After you have selected the required filter please click Save.
Similarly, you can also add additional filter for LOGTYPE. After you are done adding all the required Filters, please click on the Save button.
DataBee Configuration
Login to the DataBee UI, navigate to Data > Data Feeds and click the Add New Data Feed button.
Search for Palo Alto Prisma Access and click it as shown below.
Click on the Data Collector for collection method.
Click on the Syslog.
Enter feed contact information and select data collector created from the previous step and scroll down.
In Configure Input confirm the following:
Format: Json
Mode: TCP
Port: Fill port configured in syslog forwarder configuration step
Add filters if any
Once you have confirmed all the details, scroll down and click Submit.
Click Submit & Deploy to Production.
Troubleshooting Tips
If you encounter any issues regarding log forwarding, refer to the DataBee troubleshooting document for detailed guidance.