Palo Alto Firewall
Version: Palo Alto Appliance, PanOS version 2.0-8.1.
Palo Alto Networks, the next-generation firewalls provide a flexible networking architecture that includes support for dynamic routing, switching, and VPN connectivity, enabling you to deploy the firewall into nearly any networking environment. When configuring the Ethernet ports on your firewall, you can choose from virtual wire, Layer 2, or Layer 3 interface deployments. In addition, to allow you to integrate into a variety of network segments, you can configure different types of interfaces on different ports.
Netsurion Open XDR seamlessly integrates SIEM, Log Management, File Integrity Monitoring, and machine analytics. Netsurion Open XDR enables monitoring events obtained from the Palo Alto Firewall. The alerts, reports, dashboards, and categories in the Netsurion Open XDR benefit in capturing essential and critical activities in the Palo Alto Firewall.
The following are the key Data Source Integrations available in the Netsurion Open XDR platform.
Alerts
Type | Name | Description |
---|---|---|
Operational | Palo Alto Firewall – Configuration success and failure | This alert is generated whenever any configuration succeeds or fails in the Palo Alto Firewall. |
Operational | Palo Alto Firewall – VPN configuration changes | This alert is generated whenever any VPN configuration is modified in the Palo Alto Firewall. |
Compliance | Palo Alto Firewall – Logon failure | This alert is generated whenever any logon failure occurs in the Palo Alto Firewall. |
Compliance | Palo Alto Firewall – VPN login failures | This alert is generated whenever any VPN login failure occurs in the Palo Alto Firewall. |
Compliance | Palo Alto Firewall – User login success outside US | This alert is generated when any logon failure has occurred outside the US region. |
Security | Palo Alto Firewall – Virus detected | This alert is generated whenever Palo Alto Firewall detects any virus in the traffic. |
Security | Palo Alto Firewall – Vulnerability detected | This alert is generated whenever Palo Alto Firewall detects any vulnerability in the traffic. |
Reports
Type | Name | Description |
---|---|---|
Operational | Palo Alto Firewall – Traffic details | This report provides information related to the traffic flow. It includes session id, source address, source port, source location, destination address, destination port, destination location, protocol type, total bytes, bytes sent, bytes received, total packets, packets sent, and packets received. |
Operational | Palo Alto Firewall – Configuration success and failure | This report provides information related to any modifications in the Palo Alto firewall configuration. It includes user, source IP, console type, and configuration path. |
Operational | Palo Alto Firewall – VPN configuration changes | This report provides information related to any modifications in Palo Alto firewall’s VPN configuration. It includes user, source IP, console type, and configuration path. |
Operational | Palo Alto Firewall – VPN activities | This report provides information related to all VPN activities of Palo Alto firewall. |
Compliance | Palo Alto Firewall – Logon failure | This report provides information related to the user logon failures in the Palo Alto firewall. It includes source IP, user, and reason. |
Compliance | Palo Alto Firewall – Logon success | This report provides information related to the successful user login in Palo Alto firewall. It includes source IP and user. |
Compliance | Palo Alto Firewall – VPN login failures | This report provides information related to VPN logon failure in Palo Alto firewall. It includes source IP, user, and reason. |
Compliance | Palo Alto Firewall – VPN login and logout activity | This report provides information specific to all VPN login and logout activity of Palo Alto firewall. |
Security | Palo Alto Firewall – Threat details | This report provides information related to the threat detection. It includes threat id, protocol type, action taken, source address, source port, source location, destination address, destination port, and destination location. |
Dashboard
Type | Name | Description |
---|---|---|
Operational | Palo Alto Firewall – Traffic by Source IP address | This dashlet displays data of the Traffic by source IP address. |
Operational | Palo Alto Firewall – Traffic by Destination IP address | This dashlet displays the data of the Traffic by destination IP address. |
Operational | Palo Alto Firewall – Traffic by Source IP Geo-Location | This dashlet displays data of the Traffic by source IP location. |
Operational | Palo Alto Firewall – Traffic by Destination IP Geo-Location | This dashlet displays the data of the Traffic by destination IP location. |
Compliance | Palo Alto Firewall – Login Activities by User | This dashlet displays the data of the Login Activities by username. |
Compliance | Palo Alto Firewall – Login by Source IP Geo-location | This dashlet displays the data of the Logins by source IP location. |
Compliance | Palo Alto Firewall – Login Failed by Source IP | This dashlet displays the data of the Login Failures by source IP. |
Compliance | Palo Alto Firewall – Login Failed by Geo-Location | This dashlet displays the data of the Login Failures by source IP location. |
Compliance | Palo Alto Firewall – Login Failed by User | This dashlet displays data about login failure by user. |
Security | Palo Alto Firewall – Intrusion Detection by Destination IP Geo-Location | This dashlet displays data of the Intrusion Detection by destination IP location. |
Security | Palo Alto Firewall – Intrusion Detection by Destination IP | This dashlet displays the data of the Intrusion Detection by destination IP. |
Security | Palo Alto Firewall – Intrusion Detection by Source IP | This dashlet displays the data of the Intrusion Detection by source IP. |
Security | Palo Alto Firewall – Intrusion Detection by Threat Name and Action | This dashlet displays the data of the Intrusion Detection by threat name and action. |
Security | Palo Alto Firewall – Intrusion Detection by Source IP Geo-Location | This dashlet displays the data of the Intrusion Detection by source IP location. |
Saved Search
Type | Name | Description |
---|---|---|
Operational | Palo Alto Firewall – Allowed traffic | This saved search provides detailed information of the allowed traffics into the organization via firewall. |
Operational | Palo Alto Firewall – Configuration success and failure | This saved search provides the information about all the configurational changes (success or failure) that happened in firewall console. |
Operational | Palo Alto Firewall – Denied traffic | This saved search provides detailed information of the denied traffics. |
Operational | Palo Alto Firewall – VPN activities | This saved search provides detailed information about all the firewall VPN activities. |
Operational | Palo Alto Firewall – VPN configuration changes | This saved search provides the information about all the VPN configurational changes. |
Compliance | Palo Alto Firewall – Logon failures | This saved search provides detailed information of the failed logins to the firewall console. |
Compliance | Palo Alto Firewall – Logon success | This saved search provides detailed information of the successful logins to the firewall console. |
Compliance | Palo Alto Firewall – URL filtering | This saved search provides information about the URL details filtered by the firewall. |
Compliance | Palo Alto Firewall – VPN login and logout activity | This saved search provides the information about the VPN login and logout activities. |
Compliance | Palo Alto Firewall – VPN login failures | This saved search provides the information about the VPN login failures. |
Security | Palo Alto Firewall – Vulnerability detected | This saved search provides the information of any vulnerability detected by the firewall. |
Security | Palo Alto Firewall – Virus detected | This saved search provides information about the Virus details detected by the firewall. |
Documentation
The configuration details are consistent with the Netsurion Open XDR 9.3 and later, and Palo Alto Firewall.
Download the Integration Guide for configuration instructions and more information.