The tags beginning with firewall.paloalto identify log events generated by the Palo Alto Networks Firewall.
Since there is no facility for applying the Devo tag in the source system, the events should be forwarded to a Devo Relay to be identified, tagged, and forwarded securely to the Devo Cloud.
The full tag must have at least three levels. The first two are fixed as firewall.paloalto. The third level identifies the event's log type and must be one of config, system, threat, or traffic. This will be determined dynamically by the rule you define on the Devo Relay. The fourth element is not used.
Only used with firewall.paloalto.config
This level is used to indicate the parser version. Depending on the Palo Alto firewall version used by each client, some fields can arrive in a different order, so we need to add this tag level to indicate the parser version. The possible values are:
Therefore, the valid tags are:
For more information, read more about Devo tags.
Devo relay rule
You will need to define a relay rule that can correctly identify the event type and apply the corresponding tag. The rule identifies the event's type by the source port that it was received on and by whether it matches a format defined by a regular expression.
When the source conditions are met, the relay will apply a tag that begins with firewall.paloalto. A regular expression in the Source data field describes the format of the event data. Data is extracted from the event and used to create the third tag level.
Define the rule using the following values (the port number can be any free port on your relay):
- Source port → 13004
- Source data → ^[^,]+,[^,]+,[^,]+,([^,]+).*$
- Target tag → firewall.paloalto.\\D1
- Check the Sent without syslog tag checkbox
Definying a relay rule with a tag with four levels
If you need to use a relay rule with a tag that includes the fourth level, you must indicate it in the Target tag field. For example, if you need to indicate v2, the target tag would be firewall.paloalto.\\D1.v2
Palo Alto Firewall configuration
In Pan-OS, you will need to create a Syslog Server Profile for your Devo Relay, as well as the necessary Log Forwarding Profiles and Security Policy Rules. See the vendor documentation for instructions.
If you want to send your Palo Alto firewall events to a Devo relay that resides in a different network, check out the article about sending events to the Devo relay using SSL.