Blumira’s modern cloud SIEM platform integrates with Palo Alto Next-Generation Firewalls to stream security event logs to the Blumira service for automated threat detection and actionable response.
Additionally, enabling Blumira’s dynamic blocklist capabilities on your integrated next-generation firewall allows us to provide automated blocking of known threats. Learn more about enabling Blumira’s blocklists to block malicious source IP addresses and domains for automated threat response. Also refer to Palo Alto's instructions to Configure the Firewall to Access an External Dynamic List.
Before you begin
Determine the Blumira sensor you will use as a syslog server to collect log data. On the sensor detail screen, under Host Details, copy the IP address of your Blumira sensor to use when configuring Palo Alto.
Configuring Log Forwarding for Palo Alto Networks Next-Gen Firewall
You must first configure log forwarding in Palo Alto to allow Blumira to collect the logs. See directions on how to configure log forwarding in Palo Alto’s Tips & Tricks: Forward traffic logs to a syslog server.
Provide the Blumira sensor information when setting up your syslog server:
- IP address of the Blumira sensor you will log events to
- Port number 514
While completing this step, take the time to review your current security policies and ensure that they are up to date. Blumira generally prefers settings that will result in the most verbosity in regard to log content and volume and should be applied to every policy in the device.