Skip to main content

Palo Alto Networks

Overview​

Palo Alto Networks firewalls generate comprehensive security logs that provide visibility into network traffic, threats, and security events. AlphaSOC processes IP-based network traffic logs from Palo Alto Networks.

By integrating Palo Alto Networks IP logs with AlphaSOC, you can enhance threat detection and gain deeper insights into network behavior and security events.

Prerequisites​

Before integrating Palo Alto Networks with AlphaSOC, ensure you have the following:

  • A Palo Alto Networks firewall.
  • Palo Alto Networks logging configured and operational.
  • Appropriate administrative access to configure log forwarding.

Transportation Methods​

AlphaSOC supports multiple methods for ingesting Palo Alto Networks logs. Choose the transport method that best fits your infrastructure:

Amazon S3 Integration​

If you're using Palo Alto Networks Strata Logging Service, you can forward logs directly to Amazon S3, which AlphaSOC can then ingest.

To configure log forwarding from Palo Alto Networks to Amazon S3:

  1. Follow the official Palo Alto Networks guide: Forward Logs to Amazon S3
  2. Once logs are being forwarded to Amazon S3, configure AlphaSOC to read from your S3 bucket by following the AlphaSOC Amazon S3 transport guide.

Alternative Transport Methods​

In addition to Amazon S3, AlphaSOC supports various other transport methods for ingesting Palo Alto Networks logs. For a complete list of available options, including Azure Blob Storage, Google Cloud Storage, and more, refer to the AlphaSOC Collecting Data overview.

Choose the transport method that aligns with your existing log management infrastructure and organizational requirements.