Go to Settings >> Configuration from the navigation bar and click Normalization Policies.
Click Add.
Enter a Policy Name.
Select the Compiled Normalizers for Palo Alto Network Firewall.
Click Submit.
Adding a Normalization Policy¶
Go to Settings >> Configuration from the navigation bar and click Devices.
At the top left, click Add.
Creating Palo Alto Firewall as a Device¶
Enter a device Name.
Enter the IP address(es) of the Palo Alto Network Firewall.
Select the Device Groups.
Select an appropriate Log Collection Policy for the logs.
Select a collector/forwarder from the Distributed Collector.
Note
It is optional to select the Device Groups, the Log Collection Policy, and the Distributed Collector.
Select Time Zone.
Note
The timezone of the device should be the same as its log source.
Configure the Risk Values for Confidentiality, Integrity, and Availability. These values are used to calculate the risk levels of the alerts generated from the device.
Click Submit.
Go to Settings >> Configuration from the navigation bar and click Devices.
Search for the previously added device.
Click the Add icon from Actions.
Click Syslog Collector on AVAILABLE COLLECTORS FETCHERS.
Available Collectors Fetchers Panel¶
Select Syslog Parser as Parser.
Select a Processing Policy that uses the previously created normalization policy.
Select the Charset.
In Proxy Server, select None
Click Submit.
Configuring Syslog Collector¶