--- title: "Palo Alto Prisma Access" slug: "paloaltoprismaaccess-syslog" updated: 2026-10-30T01:43:48Z published: 2026-10-30T01:43:48Z canonical: "docs.databee.buzz/paloaltoprismaaccess-syslog" --- > ## Documentation Index > Fetch the complete documentation index at: https://docs.databee.buzz/llms.txt > Use this file to discover all available pages before exploring further. # Palo Alto Prisma Access **Palo Alto Prisma Access** is a cloud-delivered Secure Access Service Edge (SASE) platform. It secures remote workforces, branch offices, and applications by combining firewall-as-a-service, Zero Trust Network Access (ZTNA), and threat prevention into a globally scaled cloud network. More information can be found [here](https://www.paloaltonetworks.com/sase/access). **Integration Method:** Data Collector (syslog) **Tables**: DNS Activity (4003), Authentication (3002), Detection Finding (2004), Network Activity (4001) This integration supports the following events. | **Event** | **Description** | | --- | --- | | DNS Telemetry Response | DNS query and response activity from Prisma Access logs. | | GlobalProtect Authentication | GlobalProtect user authentication and VPN login events. | | Threat URL | URL threat detection alerts and policy actions from Prisma Access threat logs. | | Threat Vulnerability | Vulnerability threat detections and enforcement actions from Prisma Access threat logs. | | Traffic Activity | Network traffic session events (deny, drop, end) from Prisma Access traffic logs. | ## Prerequisites - Access to Palo Alto Prisma Access environment. - The user should have a [compatible version](https://docs.databee.buzz/docs/data-collector#system-requirements) of the system in which the Data Collector is installed. - The user should have access to DataBee console. ## Configuration Overview 1. Configure the [Data Collector](/user-manual/docs/paloaltoprismaaccess-syslog#data-collector-configuration). 2. [Configure syslog forwarder](/user-manual/docs/paloaltoprismaaccess-syslog#syslog-forwarder-configuration). 3. [Prisma Access](/user-manual/docs/paloaltoprismaaccess-syslog#prisma-access-configuration) SLS Log forwarder configuration. 4. [Configure Prisma Access feed](/user-manual/docs/paloaltoprismaaccess-syslog#databee-configuration) in DataBee console. ## Data Collector Configuration 1. To install Data Collector, please follow the steps mentioned [here](https://docs.databee.buzz/docs/data-collector#configure-data-collector-in-databee). 2. Please ensure that the Port configured during the onboarding process is open and accepting incoming data from Palo Alto Prisma Access server. ## Syslog Forwarder Configuration Rsyslog configuration is updated to expose logs on specific port. Make these changes on rsyslog where the Data Collector is installed. 1. Login to the syslog machine where data collector is installled. 2. Edit rsyslog.conf as a super user. Run the command **sudo nano /etc/rsyslog.conf** with admin privileges. 3. Add ***.* @@127.0.0.1:2222** at the end of the file to expose logs to 2222 port. This port will be used for feed configuration in DataBee UI. ![](https://cdn.document360.io/04e48772-4346-44a4-aa69-043eca42257c/Images/Documentation/palo_alto_prisma_access---syslog-image-8umk4dvw.png?sv=2026-02-06&spr=https&st=2026-10-30T11%3A03%3A59Z&se=2026-10-30T12%3A03%3A59Z&sr=c&sp=r&sig=ZJS%2BjmVkvAhhrZVLK9kCc9sPR01YaxkeA74r%2Bw2KxJQ%3D) 4. Save and close the file. 5. Run the following command to restart syslog service **sudo service rsyslog restart**. ## Prisma Access Configuration 1. Login into your Prisma Access environment and navigate to **System Setting** > **Strata Logging Service** > **Log Forwarding** ![](https://cdn.document360.io/04e48772-4346-44a4-aa69-043eca42257c/Images/Documentation/palo_alto_prisma_access---syslog-image-mzoq9aan.png?sv=2026-02-06&spr=https&st=2026-10-30T11%3A03%3A59Z&se=2026-10-30T12%3A03%3A59Z&sr=c&sp=r&sig=ZJS%2BjmVkvAhhrZVLK9kCc9sPR01YaxkeA74r%2Bw2KxJQ%3D) 2. In the Log Forwarding window click on **Add New Syslog Profile**. ![](https://cdn.document360.io/04e48772-4346-44a4-aa69-043eca42257c/Images/Documentation/palo_alto_prisma_access---syslog-image-amdqam47.png?sv=2026-02-06&spr=https&st=2026-10-30T11%3A03%3A59Z&se=2026-10-30T12%3A03%3A59Z&sr=c&sp=r&sig=ZJS%2BjmVkvAhhrZVLK9kCc9sPR01YaxkeA74r%2Bw2KxJQ%3D) 3. Step1: Configure the Syslog Forwarding Profile by entering the required information and click **Next**. ![](https://cdn.document360.io/04e48772-4346-44a4-aa69-043eca42257c/Images/Documentation/palo_alto_prisma_access---syslog-image-rf534ncw.png?sv=2026-02-06&spr=https&st=2026-10-30T11%3A03%3A59Z&se=2026-10-30T12%3A03%3A59Z&sr=c&sp=r&sig=ZJS%2BjmVkvAhhrZVLK9kCc9sPR01YaxkeA74r%2Bw2KxJQ%3D) 4. Step2: Define Payload for Syslog Profile. Under **Format** select **JSON**. Under the **Filters** select **Add Filter**. ![](https://cdn.document360.io/04e48772-4346-44a4-aa69-043eca42257c/Images/Documentation/palo_alto_prisma_access---syslog-image-a5d1yatd.png?sv=2026-02-06&spr=https&st=2026-10-30T11%3A03%3A59Z&se=2026-10-30T12%3A03%3A59Z&sr=c&sp=r&sig=ZJS%2BjmVkvAhhrZVLK9kCc9sPR01YaxkeA74r%2Bw2KxJQ%3D) 5. A window with **New Syslog Filter** will open. Please click on the drop down as highlighted in the screenshot below. ![](https://cdn.document360.io/04e48772-4346-44a4-aa69-043eca42257c/Images/Documentation/palo_alto_prisma_access---syslog-image-977aqwzd.png?sv=2026-02-06&spr=https&st=2026-10-30T11%3A03%3A59Z&se=2026-10-30T12%3A03%3A59Z&sr=c&sp=r&sig=ZJS%2BjmVkvAhhrZVLK9kCc9sPR01YaxkeA74r%2Bw2KxJQ%3D) 6. Select **Network/GlobalProtect**. Also, you can configure the time filter as highlighted below. ![](https://cdn.document360.io/04e48772-4346-44a4-aa69-043eca42257c/Images/Documentation/palo_alto_prisma_access---syslog-image-l2ba1bfn.png?sv=2026-02-06&spr=https&st=2026-10-30T11%3A03%3A59Z&se=2026-10-30T12%3A03%3A59Z&sr=c&sp=r&sig=ZJS%2BjmVkvAhhrZVLK9kCc9sPR01YaxkeA74r%2Bw2KxJQ%3D) 7. After you have selected the required filter please click **Save**. ![](https://cdn.document360.io/04e48772-4346-44a4-aa69-043eca42257c/Images/Documentation/palo_alto_prisma_access---syslog-image-89jmqaax.png?sv=2026-02-06&spr=https&st=2026-10-30T11%3A03%3A59Z&se=2026-10-30T12%3A03%3A59Z&sr=c&sp=r&sig=ZJS%2BjmVkvAhhrZVLK9kCc9sPR01YaxkeA74r%2Bw2KxJQ%3D) 8. Similarly, you can also add additional filter for LOGTYPE. After you are done adding all the required Filters, please click on the **Save** button. ![](https://cdn.document360.io/04e48772-4346-44a4-aa69-043eca42257c/Images/Documentation/palo_alto_prisma_access---syslog-image-jxfhglhc.png?sv=2026-02-06&spr=https&st=2026-10-30T11%3A03%3A59Z&se=2026-10-30T12%3A03%3A59Z&sr=c&sp=r&sig=ZJS%2BjmVkvAhhrZVLK9kCc9sPR01YaxkeA74r%2Bw2KxJQ%3D) ## DataBee Configuration 1. Login to the DataBee UI, navigate to **Data** > **Data Feeds** and click the **Add New Data Feed** button. ![](https://cdn.document360.io/04e48772-4346-44a4-aa69-043eca42257c/Images/Documentation/palo_alto_prisma_access---syslog-image-f05xyl6l.png?sv=2026-02-06&spr=https&st=2026-10-30T11%3A03%3A59Z&se=2026-10-30T12%3A03%3A59Z&sr=c&sp=r&sig=ZJS%2BjmVkvAhhrZVLK9kCc9sPR01YaxkeA74r%2Bw2KxJQ%3D) 2. Search for **Palo Alto Prisma Access** and click it as shown below. ![](https://cdn.document360.io/04e48772-4346-44a4-aa69-043eca42257c/Images/Documentation/palo_alto_prisma_access---syslog-image-q1yrl5zo.png?sv=2026-02-06&spr=https&st=2026-10-30T11%3A03%3A59Z&se=2026-10-30T12%3A03%3A59Z&sr=c&sp=r&sig=ZJS%2BjmVkvAhhrZVLK9kCc9sPR01YaxkeA74r%2Bw2KxJQ%3D) 3. Click on the **Data Collector** for collection method. ![](https://cdn.document360.io/04e48772-4346-44a4-aa69-043eca42257c/Images/Documentation/palo_alto_prisma_access---syslog-image-3synbg6c.png?sv=2026-02-06&spr=https&st=2026-10-30T11%3A03%3A59Z&se=2026-10-30T12%3A03%3A59Z&sr=c&sp=r&sig=ZJS%2BjmVkvAhhrZVLK9kCc9sPR01YaxkeA74r%2Bw2KxJQ%3D) 4. Click on the **Syslog**. ![](https://cdn.document360.io/04e48772-4346-44a4-aa69-043eca42257c/Images/Documentation/palo_alto_prisma_access---syslog-image-mbcw9jdr.png?sv=2026-02-06&spr=https&st=2026-10-30T11%3A03%3A59Z&se=2026-10-30T12%3A03%3A59Z&sr=c&sp=r&sig=ZJS%2BjmVkvAhhrZVLK9kCc9sPR01YaxkeA74r%2Bw2KxJQ%3D) 5. Enter feed contact information and select data collector created from the previous step and scroll down. ![](https://cdn.document360.io/04e48772-4346-44a4-aa69-043eca42257c/Images/Documentation/palo_alto_prisma_access---syslog-image-t59zn10p.png?sv=2026-02-06&spr=https&st=2026-10-30T11%3A03%3A59Z&se=2026-10-30T12%3A03%3A59Z&sr=c&sp=r&sig=ZJS%2BjmVkvAhhrZVLK9kCc9sPR01YaxkeA74r%2Bw2KxJQ%3D) 6. In **Configure Input** confirm the following: - **Format:** Json - **Mode:** TCP - **Port**: Fill port configured in syslog forwarder configuration step - **Add filters** if any 7. Once you have confirmed all the details, scroll down and click **Submit**. ![](https://cdn.document360.io/04e48772-4346-44a4-aa69-043eca42257c/Images/Documentation/palo_alto_prisma_access---syslog-image-i6qir6w5.png?sv=2026-02-06&spr=https&st=2026-10-30T11%3A03%3A59Z&se=2026-10-30T12%3A03%3A59Z&sr=c&sp=r&sig=ZJS%2BjmVkvAhhrZVLK9kCc9sPR01YaxkeA74r%2Bw2KxJQ%3D) 8. Click **Submit & Deploy to Production**. ![](https://cdn.document360.io/04e48772-4346-44a4-aa69-043eca42257c/Images/Documentation/palo_alto_prisma_access---syslog-image-lhtw8fa6.png?sv=2026-02-06&spr=https&st=2026-10-30T11%3A03%3A59Z&se=2026-10-30T12%3A03%3A59Z&sr=c&sp=r&sig=ZJS%2BjmVkvAhhrZVLK9kCc9sPR01YaxkeA74r%2Bw2KxJQ%3D) ## Troubleshooting Tips - If you encounter any issues regarding log forwarding, refer to the [DataBee troubleshooting document](https://docs.databee.buzz/docs/troubleshooting) for detailed guidance.