Overview 

Our primary objective is to achieve optimal visibility into our client's environment. The incorporation of Palo Alto with Cognna platform enhances our ability to obtain a thorough perspective on your infrastructure's security. This integration empowers us to efficiently analyze and triage events related to firewall.

To achieve this integration, we will configure the FW to push the logs to the collector server that you created earlier

1. Head to the PaloAlto firewall interface, once we have logged in, Select Device>Server Profiles>Syslog 

1. Click Add and enter the Name for the profile, IP of the collector server, port, format, and facility as will be mentioned in the following table

This figure is for demonstration purposes only. Please fill the cells as mentioned in the following table.

Click OK to save the server profile.

1. Configure syslog forwarding for Traffic, Threat, and WildFire Submission logs
2. 1. Select Objects > Log Forwarding
   2. Click Add, enter a Name to identify the profile then click Add, a new window will appear, within this window insert the name, description, log type (X), and filter(All logs), then choose Syslog as forwarding method.
   3. Repeat step 2 for each log type Traffic, Threat, and WildFire  

Make sure to repeat tis for each log type Traffic, Threat, WildFire 

1. Assign the log forwarding profile to security rules.
2. 1. Select Policies > Security
   2. Click the policy in which you want to configure log forwarding
   3. Select Actions
   4. select the profile to which the logs to be forwarded in Log Forwarding dropdown list.
   5. Click OK 

1. Configure syslog forwarding for System, Config, HIP Match, and Correlation logs
2. 1. Select Device > Log Settings.
   2. For System and Correlation logs, click each Severity level, select the Syslog server profile, and click OK.(Exclude the informational level)
   3. For Config, HIP Match, and Correlation logs, edit the section, select the Syslog server profile, and click OK
   4. Click OK to save your changes.

Frequently Asked Questions

Q1. What details must be gathered prior to commencing setup?

Before proceeding with the configuration of your firewall, ensure you have gathered the following parameters:

• Collector Host: The IP address belonging to the collector server (note: you should prepare the log collector machine at your end).
• Syslog Port: Designated Syslog port (typically 9013) as indicated by Cognna.
• Transport Protocol: The designated transport layer protocol: UDP or TCP, as arranged with us.
• Traffic Allowance: Confirmation that traffic flow from the firewall (Management or Dataplane interface) to the destination host is permitted.
• Log Classification: Identification of necessary log types and event classifications for security oversight.

Core Integration Requirements

• Agentless Architecture: Leverages standard native Syslog transmission directly from the security appliance; no additional software deployment is needed.
• Connection Parameters: Requires the Collector IP, destination Syslog Port (default: 9012), and Transport Protocol (UDP/TCP) shared by Cognna.
• Logging Scope: Configure Syslog targets under Device > Server Profiles > Syslog, and enable selected event types via Objects > Log Forwarding. Enabling full logging maximizes environmental visibility.
• Network Routing: Confirm that network access controls, static routing, and Service Route Configuration (if sending logs via a dataplane interface instead of the management interface) allow traffic to reach the collector server.

Verification & Diagnostic CLI Commands

• Step 1a (Firewall Egress via Management Interface): To confirm outbound packet generation if Syslog egresses via the management interface (default), execute:
• tcpdump filter "host <COLLECTOR_IP> and port <PORT>"
• Step 1b (Firewall Egress via Dataplane Interface): If Syslog routes via a dataplane interface, use the packet-diag filter:
• debug dataplane packet-diag set filter match destination <COLLECTOR_IP> destination-port <PORT> debug dataplane packet-diag set filter on show counter global filter delta yes
• Step 2 (Server Ingress): From the Linux collector host, verify incoming traffic arrival:
• sudo tcpdump -ni any 'host <FIREWALL_IP> and port <PORT>'
• Step 3 (Platform Parsing): Ensure the target service is listening, local firewalls permit the port, and reach out to Cognna to confirm log processing.

Diagnostic Matrix

For more information, you can refer to Palo Alto Configure Syslog Monitoring