Palo Alto Prisma Access

<div class="condensed-table">
| | |
| --- | --- |
| Version | 1.3.0 (View all) |
| Compatible Kibana version(s) | 8.13.0 or higher |
| Supported Serverless project types
What’s this? | Security
Observability |
| Subscription level
What’s this? | Basic |
| Level of support
What’s this? | Elastic |

</div>

Palo Alto Prisma Access is a Secure Access Service Edge (SASE) platform that enables organizations to provide protected connectivity to their network and applications for branches, retail locations, and remote users. It’s designed to ensure secure access to the cloud, SaaS, and internet for users, regardless of their location. Prisma Access uses a cloud-delivered infrastructure to connect users to applications, delivering both network security and a seamless user experience.

Use the Palo Alto Prisma Access integration to collect and parse data from the Syslog server. Then visualize that data in Kibana.

This module has been tested against the latest Palo Alto Prisma Access version 5.0.

The Palo Alto Prisma Access integration collects 16 types of event types:

• https://docs.paloaltonetworks.com/strata-logging-service/log-reference/network-logs/network-authentication-log[Authentication] - Auth logs contain information about authentication events seen by the next-generation firewall.
• https://docs.paloaltonetworks.com/strata-logging-service/log-reference/network-logs/network-dns-security-log[DNS Security] - DNS Security logs contain information that the DNS Security service collects, such as server response and request information based on your firewall security policy rules, associated action, and the DNS query details when performing domain lookups.
• https://docs.paloaltonetworks.com/strata-logging-service/log-reference/network-logs/network-decryption-log[Decryption] - By default, decryption logs display entries for unsuccessful TLS handshakes.
• https://docs.paloaltonetworks.com/strata-logging-service/log-reference/network-logs/network-file-log[File] - File logs represents a file transfer across the network.
• https://docs.paloaltonetworks.com/strata-logging-service/log-reference/network-logs/network-globalprotect-log[GlobalProtect] - GlobalProtect logs identify network traffic between a GlobalProtect portal or gateway, and GlobalProtect apps.
• https://docs.paloaltonetworks.com/strata-logging-service/log-reference/network-logs/network-hip-match-log[HIP Match] - HIP Match logs capture information about the security status of the endpoints accessing a network (such as whether they have disk encryption enabled).
• https://docs.paloaltonetworks.com/strata-logging-service/log-reference/network-logs/network-iptag-log[IPtag] - IPtag logs display how and when a source IP address is registered or unregistered with the next-generation firewall, and what tag the firewall applied to the address.
• https://docs.paloaltonetworks.com/strata-logging-service/log-reference/network-logs/network-sctp-log[SCTP] - SCTP logs are written at the end of every SCTP network session, as well as optionally at the start of every such session.
• https://docs.paloaltonetworks.com/strata-logging-service/log-reference/network-logs/network-threat-log[Threat] - Threat logs contain entries for when network traffic matches one of the security profiles attached to a next-generation firewall security rule.
• https://docs.paloaltonetworks.com/strata-logging-service/log-reference/network-logs/network-traffic-log[Traffic] - Traffic logs contain entries for the end of each network session, as well as (optionally) the start of a network session.
• https://docs.paloaltonetworks.com/strata-logging-service/log-reference/network-logs/network-tunnel-log[Tunnel] - Tunnel logs are written whenever a next-generation firewall is handling GTP traffic.
• https://docs.paloaltonetworks.com/strata-logging-service/log-reference/network-logs/network-url-log[URL] - URL logs are written by next-generation firewalls whenever network traffic matches a URL Filtering Profile attached to one or more security rules.
• https://docs.paloaltonetworks.com/strata-logging-service/log-reference/network-logs/network-userid-log[UserID] - User-ID logs are generated whenever a user authentication event occurs using a resource to which the firewall has visibility.
• https://docs.paloaltonetworks.com/strata-logging-service/log-reference/common-logs/common-system-log[System] - System logs are used to record system events that occur within the writing entity.
• https://docs.paloaltonetworks.com/strata-logging-service/log-reference/common-logs/common-configuration-log[Configuration] - Configuration logs are used to record changes made to the writing entity.
• https://docs.paloaltonetworks.com/strata-logging-service/log-reference/endpoint-logs/endpoint-globalprotect-app-troubleshooting-log[GlobalProtect App Troubleshooting] - GlobalProtect App troubleshooting logs contain information about the GlobalProtect client and its host to help app users resolve issues.

Elastic Agent must be installed. For more details and installation instructions, please refer to the Elastic Agent Installation Guide.

There are several options for installing and managing Elastic Agent:

With this approach, you install Elastic Agent and use Fleet in Kibana to define, configure, and manage your agents in a central location. We recommend using Fleet management because it makes the management and upgrade of your agents considerably easier.

With this approach, you install Elastic Agent and manually configure the agent locally on the system where it’s installed. You are responsible for managing and upgrading the agents. This approach is reserved for advanced users only.

You can run Elastic Agent inside a container, either with Fleet Server or standalone. Docker images for all versions of Elastic Agent are available from the Elastic Docker registry, and we provide deployment manifests for running on Kubernetes.

Please note, there are minimum requirements for running Elastic Agent. For more information, refer to the Elastic Agent Minimum Requirements.

For step-by-step instructions on how to forward logs to syslog server from your Palo Alto Prisma Access instance, see the Forward Logs to a Syslog Server guide.

1. In Kibana navigate to Management > Integrations.
2. In "Search for integrations" top bar, search for Palo Alto Prisma Access.
3. Select the "Palo Alto Prisma Access" integration from the search results.
4. Select "Add Palo Alto Prisma Access" to add the integration.
5. Add all the required integration configuration parameters according to the enabled input type.
6. Click on "Save and continue" to save the integration.

This is the Event dataset.

{
    "@timestamp": "2019-07-25T23:30:12.000-05:00",
    "agent": {
        "ephemeral_id": "cbff23b6-6c63-45bd-9fec-4d5ca3d75727",
        "id": "7b106bd2-a2ca-4877-9577-96012c934f32",
        "name": "docker-fleet-agent",
        "type": "filebeat",
        "version": "8.13.0"
    },
    "cloud": {
        "account": {
            "id": [
                "xxxxxxxxxxxxx"
            ]
        }
    },
    "data_stream": {
        "dataset": "prisma_access.event",
        "namespace": "44529",
        "type": "logs"
    },
    "destination": {
        "user": {
            "domain": [
                "globex.org"
            ],
            "id": [
                "12345"
            ],
            "name": [
                "col-34"
            ]
        }
    },
    "ecs": {
        "version": "8.11.0"
    },
    "elastic_agent": {
        "id": "7b106bd2-a2ca-4877-9577-96012c934f32",
        "snapshot": false,
        "version": "8.13.0"
    },
    "event": {
        "action": "commit-all",
        "agent_id_status": "verified",
        "category": [
            "configuration"
        ],
        "created": "2021-03-01T20:35:54.000Z",
        "dataset": "prisma_access.event",
        "id": "xxxxxxxxxxxxx",
        "ingested": "2024-07-29T07:37:02Z",
        "kind": "event",
        "original": "Mar 1 20:35:56 81.2.69.142 928 <14>1 2021-03-01T20:35:56.500Z stream-logfwd20-587718190-02280003-lvod-harness-mjdh logforwarder - panwlogs - CEF:0|Palo Alto Networks|LF|2.0|CONFIG|config|3|ProfileToken=xxxxx dtz=UTC rt=Mar 01 2021 20:35:54 deviceExternalId=xxxxxxdfrrxx PanOSEventTime=Jul 25 2019 23:30:12 duser=col-34 dntdom=globex.org duid=12345 PanOSEventDetails=change before issuer validity expires PanOSIsDuplicateLog=false PanOSIsPrismaNetwork=false PanOSIsPrismaUsers=false cat=xxxxx PanOSLogExported=false PanOSLogSource=firewall PanOSLogSourceTimeZoneOffset=-05:00 PanOSSeverity=warn PanOSTenantID=xxxxxxxxxxxxx PanOSVirtualSystemID=0 src=81.2.69.144 cs3=vsys2 cs3Label=VirtualLocation act=commit-all duser0=Panorama-admin destinationServiceName=dns PanOSEventResult=retrievd msg=uploaded details externalId=xxxxxxxxxxxxx PanOSDGHierarchyLevel1=0 PanOSDGHierarchyLevel2=0 PanOSDGHierarchyLevel3=0 PanOSDGHierarchyLevel4=0 PanOSVirtualSystemName=<{xwo X dvchost=PA-VM PanOSEventDescription=\\r_IYytr PanOSTimeGeneratedHighResolution=Jul 25 2019 23:30:12",
        "timezone": "-05:00",
        "type": [
            "info"
        ]
    },
    "input": {
        "type": "tcp"
    },
    "log": {
        "level": "warn",
        "source": {
            "address": "192.168.240.7:60494"
        }
    },
    "message": "uploaded details",
    "observer": {
        "hostname": "PA-VM",
        "product": "Prisma Access",
        "serial_number": [
            "xxxxxxdfrrxx"
        ],
        "type": "firewall",
        "vendor": "Palo Alto Networks"
    },
    "prisma_access": {
        "event": {
            "cef": {
                "device": {
                    "product": "LF",
                    "vendor": "Palo Alto Networks",
                    "version": "2.0"
                },
                "name": "config",
                "severity": 3,
                "version": "0"
            },
            "class_id": "CONFIG",
            "d_user_0": "Panorama-admin",
            "data": {
                "description": "\r_IYytr",
                "details": "change before issuer validity expires",
                "result": "retrievd",
                "time": "2019-07-25T23:30:12.000-05:00"
            },
            "destination": {
                "nt_domain": "globex.org",
                "service_name": "dns",
                "user": {
                    "id": "12345",
                    "name": "col-34"
                }
            },
            "device": {
                "action": "commit-all",
                "event": {
                    "category": "xxxxx"
                },
                "external_id": "xxxxxxdfrrxx",
                "host_name": "PA-VM",
                "receipt_time": "2021-03-01T20:35:54.000Z",
                "time_zone": "UTC"
            },
            "dg_hierarchy": {
                "level1": 0,
                "level2": 0,
                "level3": 0,
                "level4": 0
            },
            "external_id": "xxxxxxxxxxxxx",
            "is_duplicate": {
                "log": false
            },
            "is_prisma": {
                "network": false,
                "users": false
            },
            "label": {
                "cs3": "VirtualLocation"
            },
            "log": {
                "exported": false,
                "source": {
                    "timezone_offset": "-05:00",
                    "value": "firewall"
                }
            },
            "message": "uploaded details",
            "profile": {
                "token": "xxxxx"
            },
            "severity": "warn",
            "source": {
                "address": {
                    "value": "81.2.69.144"
                }
            },
            "tenant_id": "xxxxxxxxxxxxx",
            "time": {
                "generated_high_resolution": "2019-07-25T23:30:12.000Z"
            },
            "virtual": {
                "location": "vsys2",
                "system": {
                    "id": "0",
                    "name": "<{xwo X"
                }
            }
        }
    },
    "related": {
        "hosts": [
            "PA-VM"
        ],
        "ip": [
            "81.2.69.144"
        ],
        "user": [
            "12345",
            "col-34"
        ]
    },
    "source": {
        "ip": [
            "81.2.69.144"
        ]
    },
    "tags": [
        "preserve_original_event",
        "preserve_duplicate_custom_fields",
        "forwarded",
        "prisma_access-event"
    ]
}