Skip to main content
Sumo Logic

Collect Logs for PCI Compliance for Palo Alto Networks 10

Learn how to collect logs for the PCI Compliance for Palo Alto Networks 10 app.

This page provides instructions for configuring log collection for the Sumo Logic app for PCI Compliance for Palo Alto Networks 10, as well as sample log messages and a query example from an app dashboard.

Collection process overview

Configuring log collection for PCI Compliance for Palo Alto Networks 10 includes the following tasks:

  1. Create a hosted collector with a Cloud Syslog source
  2. Define the destination for the logs.
  3. Configure syslog forwarding
  4. Verify logs in Palo Alto Networks

Step 1. Create a hosted collector and Cloud Syslog source

In this step you configure a hosted collector with a Cloud Syslog source that will act as Syslog server to receive logs and events from Palo Alto Networks devices.

To configure a hosted collector with a Cloud Syslog source, do the following:

  1. Log in to Sumo Logic and create a Hosted Collector.
  2. Create a Cloud Syslog Source on the hosted collector, specifying the following:
    1. Enter a Source Name.
    2. Provide a Source Category: NW/PAN/V10
  3. Click Save.
  4. Copy the Token, host URL and TCP TLS Port to a safe place. You will need this information in the tasks that follow.

Step 2. Define the destination for the logs

In this step you create a server profile where you can define the log destination. This will be the host name, port and protocol (TLS) of the Sumo Logic Cloud Syslog source.

To create a server profile specifying  the log destination, do the following:

  1.  Login to the Palo Alto Networks Web interface as an administrative user.
  2. Select Device tab > Server Profiles > Syslog.
  3. Click Add at the bottom of the screen and provide endpoint details and a profile name, such as Sumo_Logs_Profile01.
  4. In the Syslog Server Profile window, select the Servers tab and click Add.
  5. In the Servers window, specify the following information:
    1. Name. Sumo_CloudSyslog_EndPoint01
    2. Syslog Server. URL from Step 1
    3. Transport. SSL
    4. Port. Port from Step 1
    5. Format. IETF
    6. Facility. LOG_USER
  6. In the Syslog Server Profile window, select the Custom Log Format tab, and use the following custom format for the Traffic log type:

    ,$receive_time,$serial,$type,$subtype,,$time_generated,$src,$dst,$natsrc,$natdst,$rule,$srcuser,$dstuser,$app,$vsys,$from,$to,$inbound_if,$outbound_if,$logset,,$sessionid,$repeatcnt,$sport,$dport,$natsport,$natdport,$flags,$proto,$action,$bytes,$bytes_sent,$bytes_received,$packets,$start,$sec,$category,,$seqno,$actionflags,$srcloc,$dstloc,,$pkts_sent,$pkts_received,$session_end_reason,$dg_hier_level_1,$dg_hier_level_2,$dg_hier_level_3,$dg_hier_level_4,$vsys_name,$device_name,$action_source,$src_uuid,$dst_uuid,$tunnelid/$imsi,$monitortag/$imei,$parent_session_id,$parent_start_time,$tunnel,$assoc_id,$chunks,$chunks_sent,$chunks_received,$rule_uuid,$http2_connection <Token from Step 1>
  7. Click OK.
  8. Commit the changes.

Step 3. Configure syslog forwarding

To configure syslog forwarding for each Traffic logs, follow the steps to Configure Log Forwarding as described in the Palo Networks documentation.

Step 4. Verify logs in Palo Alto Networks

In this step, you view logs using the Palo Alto Network Web interface to confirm the logs are generated on the firewall.

To verify the logs in Palo Alto Networks, do the following:

  1. In the Palo Alto Networks UI, select Monitor > Logs.
  2. Once the setup is done, log in to Sumo Logic.
  3. To validate that the logs are flowing to Sumo Logic, run a query using the source category you configured during Step 1, such as:
    _sourceCategory = NW/PAN/V10

Sample logs

The PCI Compliance for Palo Alto Networks 10 App uses Traffic logs. 

Oct 09 10:19:15 1,2019/10/09 10:19:15,001234567890002,TRAFFIC,drop,2304,2019/10/09 10:19:15,,,,,InternalServer,,,not-applicable,vsys1,inside,z1-FW-Transit,ethernet1/2,,All traffic,2019/10/09 10:19:15,0,1,63712,443,0,0,0x0,udp,deny,60,60,0,1,2019/10/09 10:19:15,0,any,0,0123456789,0x0,Netherlands,,0,1,0,policy-deny,0,0,0,0,,SumPunFw07,from-policy,,,0,,0,,N/A,0,0,0,0,1202585d-b4d5-5b4c-aaa2-d80d77ba456e,0

Query example

This example query is from the Allowed Network Activity by Direction panel of the Accepted and Rejected Traffic dashboard. 

_sourceCategory = Labs/PaloAltoNetworksv10 TRAFFIC allow
| csv _raw extract 1 as f1, 2 as Receive_Time, 3 as serialNum, 4 as type, 5 as subtype, 6 as f2, 7 as LogGenerationTime, 8 as src_ip, 9 as dest_ip, 10 as NAT_src_ip, 11 as NAT_dest_ip, 12 as ruleName, 13 as src_user, 14 as dest_user, 15 as app, 16 as vsys, 17 as src_zone, 18 as dest_zone, 19 as inbound_interface, 20 as outbound_interface, 21 as LogAction, 22 as f3, 23 as SessonID, 24 as RepeatCount, 25 as src_port, 26 as dest_port, 27 as NAT_src_port, 28 as NAT_dest_port, 29 as flags, 30 as protocol, 31 as action, 32 as bytes, 33 as bytes_sent, 34 as bytes_recv, 35 as Packets, 36 as StartTime, 37 as ElapsedTime, 38 as Category, 39 as f4, 40 as seqNum, 41 as ActionFlags, 42 as src_Country, 43 as dest_country, 44 as f5, 45 as pkts_sent, 46 as pkts_received, 47 as session_end_reason, 48 as Device_Group_Hierarchy_l1, 49 as Device_Group_Hierarchy_l2, 50 as Device_Group_Hierarchy_l3, 51 as Device_Group_Hierarchy_l4, 52 as vsys_Name, 53 as DeviceName, 54 as action_source, 55 as Source_VM_UUID, 56 as Destination_VM_UUID, 57 as Tunnel_ID_IMSI, 58 as Monitor_Tag_IMEI, 59 as Parent_Session_ID, 60 as parent_start_time, 61 as Tunnel, 62 as SCTP_Association_ID, 63 as SCTP_Chunks, 64 as SCTP_Chunks_Sent, 65 as SCTP_Chunks_Received, 66 as UUIDforrule, 67 as HTTP2Connection, 68 as AppFlapCount ,69 as PolicyID ,70 as LinkSwitches ,71 as SDWANCluster ,72 as SDWANDeviceType ,73 as SDWANClusterType ,74 as SDWANSite ,75 as DynamicUserGroupName ,76 as XFFAddress ,77 as SourceDeviceCategory ,78 as SourceDeviceProfile ,79 as SourceDeviceModel ,80 as SourceDeviceVendor ,81 as SourceDeviceOSFamily ,82 as SourceDeviceOSVersion ,83 as SourceHostname ,84 as SourceMACAddress ,85 as DestinationDeviceCategory ,86 as DestinationDeviceProfile ,87 as DestinationDeviceModel ,88 as DestinationDeviceVendor ,89 as DestinationDeviceOSFamily ,90 as DestinationDeviceOSVersion ,91 as DestinationHostname ,92 as DestinationMACAddress ,93 as ContainerID ,94 as PODNamespace ,95 as PODName ,96 as SourceExternalDynamicList ,97 as DestinationExternalDynamicList ,98 as HostID ,99 as UserDeviceSerialNumber ,100 as SourceDynamicAddressGroup ,101 as DestinationDynamicAddressGroup ,102 as SessionOwner ,103 as HighResolutionTimestamp ,104 as ASliceServiceType ,105 as ASliceDifferentiator
| where type = "TRAFFIC" and action="allow"
| where ((compareCIDRPrefix("", src_ip, toInt(12)) or compareCIDRPrefix("", src_ip, toInt(16)) or compareCIDRPrefix("", src_ip, toInt(8)) and (!compareCIDRPrefix("", dest_ip, toInt(12)) and !compareCIDRPrefix("", dest_ip, toInt(16)) and !compareCIDRPrefix("", dest_ip, toInt(8)))) or 
(compareCIDRPrefix("", dest_ip, toInt(12)) or compareCIDRPrefix("", dest_ip, toInt(16)) or compareCIDRPrefix("", dest_ip, toInt(8)) and (!compareCIDRPrefix("", src_ip, toInt(12)) and !compareCIDRPrefix("", src_ip, toInt(16)) and !compareCIDRPrefix("", src_ip, toInt(8)))))
| if (compareCIDRPrefix("", src_ip, toInt(12)) or compareCIDRPrefix("", src_ip, toInt(16)) or compareCIDRPrefix("", src_ip, toInt(8)), "outbound","inbound") as direction
| timeslice 5m
| count by _timeslice, direction | transpose row _timeslice column direction