Palo Alto Logs

[Harold-Poling]

Version

2.4.40

Installation Method

Security Onion ISO image

Description

configuration

Installation Type

Standalone

Location

on-prem with Internet access

Hardware Specs

Exceeds minimum requirements

CPU

8

RAM

16

Storage for /

/500 GIG

Storage for /nsm

/500 GIG

Network Traffic Collection

span port

Network Traffic Speeds

more than 10Gbps

Status

Yes, all services on all nodes are running OK

Salt Status

Yes, there are salt failures (please provide detail below)

Logs

Yes, there are additional clues in /opt/so/log/ (please provide detail below)

Detail

Tried to setup Palo Alto logging using the Security Onion video based on pfsense but even though the port says its open using netstat it not open when I try to port query it on port 9001 and I know there is no switch micro-segmentation it's on a virtual switch with a Windows 10 VDI for testing so there is nothing in the way of that. So need assistance please

Guidelines

• I have read the discussion guidelines at Read before posting! #1720 and assert that I have followed the guidelines.

[cm-ops]

In the integration, what is Syslog Host set to? Also, do you see the allowance in iptables for port 9001? Can I also see the output of sudo salt-call pillar.get firewall?