Palo Alto Log Ingestion Issues with Security Onion Forward Node #14067
-
Version2.4.110 Installation MethodSecurity Onion ISO image Descriptionconfiguration Installation TypeDistributed Locationon-prem with Internet access Hardware SpecsExceeds minimum requirements CPU64 RAM251G Storage for /558G Storage for /nsm38T Network Traffic Collectiontap Network Traffic Speeds1Gbps to 10Gbps StatusYes, all services on all nodes are running OK Salt StatusNo, there are no failures LogsNo, there are no additional clues DetailHello! I'm running Security Onion in a distributed setup with a manager, forward, and storage node. I'm attempting to ingest logs from my Palo Alto Next-Generation Firewall using the Elastic Integration, specifically targeting my forward node. The Palo Alto integration policy is configured with the forward node's IP address and TCP port. I've also added the forward node's IP to the Security Onion Console under "Administration -> Configuration -> firewall -> hostgroups -> syslog" and the port under "Administration -> Configuration -> firewall -> portgroups -> syslog." I believe I am missing a step or two and I would appreciate any guidance or troubleshooting tips to successfully ingest TCP logs from my Palo Alto firewall to the Security Onion forward node? Thank you. Guidelines
|
Beta Was this translation helpful? Give feedback.
Replies: 1 comment 1 reply
-
|
Try setting the integration policy to 0.0.0.0. You can add the integration to your forward nodes agent policy. You mentioned allowing the traffic through the host firewall, so at that point you should see logs being ingested |
Beta Was this translation helpful? Give feedback.
-
|
Thank you so much! |
Beta Was this translation helpful? Give feedback.
Try setting the integration policy to 0.0.0.0. You can add the integration to your forward nodes agent policy. You mentioned allowing the traffic through the host firewall, so at that point you should see logs being ingested