---
title: "Integrate Palo Alto Networks Wildfire with Red Canary via syslog"
slug: "integrate-palo-alto-networks-wildfire-with-red-canary-via-syslog"
updated: 2026-10-22T15:16:03Z
published: 2026-10-22T15:16:03Z
canonical: "docs.redcanary.com/integrate-palo-alto-networks-wildfire-with-red-canary-via-syslog"
---

> ## Documentation Index
> Fetch the complete documentation index at: https://docs.redcanary.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Integrate Palo Alto Networks Wildfire with Zscaler MDR via Syslog

> [!NOTE]
> **Note:** Red Canary is now Zscaler MDR. Please bear with us while we update the naming in our third-party integrations.

Palo Alto Networks Wildfire provides critical insights into malicious file behavior. By integrating Wildfire with Zscaler MDR through Syslog, you can significantly enhance your threat detection and response capabilities. This integration enables the seamless transfer of crucial threat intelligence data directly to Zscaler MDR’s advanced analytics platform. To integrate Palo Alto Networks Wildfire with Zscaler MDR via syslog, follow the procedure below from beginning to end.

## Step 1: Zscaler MDR–Create your Zscaler MDR provided-URL

**Create a Zscaler MDR provided-URL to send PAN-OS alerts for ingestion.**

1. In the Zscaler MDR portal, click **Integrations**. If you do not see the required integration, click **See all integrations**.

![](https://cdn.document360.io/75147bee-bf0d-444c-8afb-6e83b11ec0ef/Images/Documentation/integrations(6).png?sv=2026-02-06&spr=https&st=2026-11-09T11%3A54%3A30Z&se=2026-11-09T12%3A54%3A30Z&sr=c&sp=r&sig=DTiFcJC%2BaEca3FouuLVTGI%2F3EbODcbgQjsBuG7p88KA%3D)
2. In the search bar, type and then select Palo Alto Networks Wildfire.

![](https://cdn.document360.io/75147bee-bf0d-444c-8afb-6e83b11ec0ef/Images/Documentation/wildfire.png?sv=2026-02-06&spr=https&st=2026-11-09T11%3A54%3A30Z&se=2026-11-09T12%3A54%3A30Z&sr=c&sp=r&sig=DTiFcJC%2BaEca3FouuLVTGI%2F3EbODcbgQjsBuG7p88KA%3D)
3. Click **Configure**.
4. Click **Edit Configuration**.
5. Enter a Name for your external alert source.
6. Select a Display Category.
7. Under the Ingest Format/Method dropdown, select **Palo Alto Networks WildFire via Syslog**.
8. Click **Save Configuration**.
9. Click **Edit Configuration**.
10. Click **Activate**.
11. Zscaler MDR will generate a URL and Port number that you will use to input into your PAN-OS account. Copy and save this number as you will use it in subsequent steps. ![2.png](https://cdn.document360.io/75147bee-bf0d-444c-8afb-6e83b11ec0ef/Images/Documentation/7609342230679.png?sv=2026-02-06&spr=https&st=2026-11-09T11%3A54%3A30Z&se=2026-11-09T12%3A54%3A30Z&sr=c&sp=r&sig=DTiFcJC%2BaEca3FouuLVTGI%2F3EbODcbgQjsBuG7p88KA%3D)
12. With your Zscaler MDR URL generated, log in to your PAN-OS device of choice.

## Step 2: Your PAN-OS Device–Generate a PAN-OS certificate

Generate a PanOS custom certificate to send syslogs from your PAN-OS device to Zscaler MDR.

### Step 2.1–Create a Syslog Profile

1. From your PAN-OS dashboard, click **Device**.
2. From the Server Profiles dropdown in the navigation pane, click **Syslog.**

![3.png](https://cdn.document360.io/75147bee-bf0d-444c-8afb-6e83b11ec0ef/Images/Documentation/7609366645783.png?sv=2026-02-06&spr=https&st=2026-11-09T11%3A54%3A30Z&se=2026-11-09T12%3A54%3A30Z&sr=c&sp=r&sig=DTiFcJC%2BaEca3FouuLVTGI%2F3EbODcbgQjsBuG7p88KA%3D)
3. Click **+Add**.
4. Name your Syslog Profile.
5. Click **+Add**.
6. Name your Syslog Server.
7. Copy and paste the syslog server URL address from [Step 1.12](https://redcanary.document360.io/docs/integrate-palo-alto-networks-wildfire-with-red-canary-via-syslog#:~:text=Red%20Canary%20will%20generate%20a%20URL%20and%20Port%20number%20that%20you%20will%20use%20to%20input%20into%20your%20PAN%2DOS%20account.%20Copy%20and%20save%20this%20number%20as%20you%20will%20use%20it%20in%20subsequent%20steps.).
8. From the Transport dropdown, select **SSL**.
9. In the Port section, enter the Port number from [Step 1.12](https://redcanary.document360.io/docs/integrate-palo-alto-networks-wildfire-with-red-canary-via-syslog#:~:text=Red%20Canary%20will%20generate%20a%20URL%20and%20Port%20number%20that%20you%20will%20use%20to%20input%20into%20your%20PAN%2DOS%20account.%20Copy%20and%20save%20this%20number%20as%20you%20will%20use%20it%20in%20subsequent%20steps.).
10. From the Format dropdown, select **BSD**.
11. From the Facility dropdown, select **LOG_User**.
12. Click **OK**.

### Step 2.2–Create a Log Forwarding Profile

1. Click **Objects**.
2. In the navigation pane, click **Log Forwarding**.

![4.png](https://cdn.document360.io/75147bee-bf0d-444c-8afb-6e83b11ec0ef/Images/Documentation/7609366651287.png?sv=2026-02-06&spr=https&st=2026-11-09T11%3A54%3A30Z&se=2026-11-09T12%3A54%3A30Z&sr=c&sp=r&sig=DTiFcJC%2BaEca3FouuLVTGI%2F3EbODcbgQjsBuG7p88KA%3D)
3. Click **+Add**.
4. Name your log forwarding profile, and then write a description for the profile.
5. Click **+Add**.
6. Name your log forwarding profile match list, and then write a description for the profile match list.
7. From the Log Type dropdown, select **wildfire**.
8. From the Filter dropdown, select **All Logs**.
9. From the Syslog section, click **+Add**, and then select the syslog created from [Step 2.1](https://redcanary.document360.io/docs/integrate-palo-alto-networks-wildfire-with-red-canary-via-syslog#:~:text=to%20Red%20Canary.-,Step%202.1%E2%80%93Create%20a%20Syslog%20Profile,-From%20your%20PAN).
10. Click **OK**.

![5.png](https://cdn.document360.io/75147bee-bf0d-444c-8afb-6e83b11ec0ef/Images/Documentation/7609366696215.png?sv=2026-02-06&spr=https&st=2026-11-09T11%3A54%3A30Z&se=2026-11-09T12%3A54%3A30Z&sr=c&sp=r&sig=DTiFcJC%2BaEca3FouuLVTGI%2F3EbODcbgQjsBuG7p88KA%3D)
11. With your Log Forwarding Profile created, click **OK**.

### Step 2.3–Create a Security Policy Rule

1. Click **Policies**.
2. In the navigation pane, click **Security**. ![7.png](https://cdn.document360.io/75147bee-bf0d-444c-8afb-6e83b11ec0ef/Images/Documentation/7609366743063.png?sv=2026-02-06&spr=https&st=2026-11-09T11%3A54%3A30Z&se=2026-11-09T12%3A54%3A30Z&sr=c&sp=r&sig=DTiFcJC%2BaEca3FouuLVTGI%2F3EbODcbgQjsBuG7p88KA%3D)
3. Click **+Add**.
4. To create a Security Policy Rule, fill in the required information in all of the tabs.
5. Once you get to the Actions tab, from the Action dropdown, select **Allow**.
6. From the Profile Type dropdown, select **Profiles**.
7. From the WildFire Analysis dropdown, select **default**.
8. From the Log Forwarding dropdown, select **Wildfire Syslog Output**.
9. With all of the required information filled in, click **OK**.

### Step 2.4–Export your PAN-OS certificate

1. Click **Device**.
2. From the Certificate Management dropdown in the navigation pane, click **Certificates**. ![9.png](https://cdn.document360.io/75147bee-bf0d-444c-8afb-6e83b11ec0ef/Images/Documentation/7609342435991.png?sv=2026-02-06&spr=https&st=2026-11-09T11%3A54%3A30Z&se=2026-11-09T12%3A54%3A30Z&sr=c&sp=r&sig=DTiFcJC%2BaEca3FouuLVTGI%2F3EbODcbgQjsBuG7p88KA%3D)
3. Click **Generate**.
4. Name your certificate.
5. For Common Name, enter the address you acquired from Zscaler MDR in [Step 1.12](https://redcanary.document360.io/docs/integrate-palo-alto-networks-wildfire-with-red-canary-via-syslog#:~:text=Red%20Canary%20will%20generate%20a%20URL%20and%20Port%20number%20that%20you%20will%20use%20to%20input%20into%20your%20PAN%2DOS%20account.%20Copy%20and%20save%20this%20number%20as%20you%20will%20use%20it%20in%20subsequent%20steps.).
6. From the Signed By dropdown, select the trusted CA or the self-signed CA that the syslog server and the firewall both trust.

> **Note**: The certificate can’t be a Certificate Authority nor an External Authority (certificate signing request [CSR]).
7. Click **Generate**.

![10.png](https://cdn.document360.io/75147bee-bf0d-444c-8afb-6e83b11ec0ef/Images/Documentation/7609366800535.png?sv=2026-02-06&spr=https&st=2026-11-09T11%3A54%3A30Z&se=2026-11-09T12%3A54%3A30Z&sr=c&sp=r&sig=DTiFcJC%2BaEca3FouuLVTGI%2F3EbODcbgQjsBuG7p88KA%3D)
8. Click your newly created certificate, and then select **Certificate for Secure Syslog**. ![11.png](https://cdn.document360.io/75147bee-bf0d-444c-8afb-6e83b11ec0ef/Images/Documentation/7609342502935.png?sv=2026-02-06&spr=https&st=2026-11-09T11%3A54%3A30Z&se=2026-11-09T12%3A54%3A30Z&sr=c&sp=r&sig=DTiFcJC%2BaEca3FouuLVTGI%2F3EbODcbgQjsBuG7p88KA%3D)

![12.png](https://cdn.document360.io/75147bee-bf0d-444c-8afb-6e83b11ec0ef/Images/Documentation/7609342497687.png?sv=2026-02-06&spr=https&st=2026-11-09T11%3A54%3A30Z&se=2026-11-09T12%3A54%3A30Z&sr=c&sp=r&sig=DTiFcJC%2BaEca3FouuLVTGI%2F3EbODcbgQjsBuG7p88KA%3D)
9. Click **OK**.
10. From the Device Certificates landing page, select the new certificate, and then click **Export Certificate**. ![13.png](https://cdn.document360.io/75147bee-bf0d-444c-8afb-6e83b11ec0ef/Images/Documentation/7609366911255.png?sv=2026-02-06&spr=https&st=2026-11-09T11%3A54%3A30Z&se=2026-11-09T12%3A54%3A30Z&sr=c&sp=r&sig=DTiFcJC%2BaEca3FouuLVTGI%2F3EbODcbgQjsBuG7p88KA%3D)
11. Select **Export Private Key**.
12. Enter a Passphrase.
13. Confirm your Passphrase.
14. Click **OK**.

![14.png](https://cdn.document360.io/75147bee-bf0d-444c-8afb-6e83b11ec0ef/Images/Documentation/7609342542487.png?sv=2026-02-06&spr=https&st=2026-11-09T11%3A54%3A30Z&se=2026-11-09T12%3A54%3A30Z&sr=c&sp=r&sig=DTiFcJC%2BaEca3FouuLVTGI%2F3EbODcbgQjsBuG7p88KA%3D)
15. With your PAN-OS generated certificate downloaded, log in to Zscaler MDR.

## Step 3: Your PAN-OS Device–Create a Certificate Authority (CA) (Optional)

Generate a PanOS CA certificate to send syslogs from your PAN-OS device to Zscaler MDR. If you choose to perform this step, you do so before you perform Step 4.

1. Review this article and complete [steps 1-4 to configure the PAN-OS syslog monitoring process](https://docs.paloaltonetworks.com/pan-os/9-1/pan-os-admin/monitoring/use-syslog-for-monitoring/configure-syslog-monitoring).

> **Note**: If a CA certificate is not already present, PAN-OS allows for their firewall to act as a certificate authority. Learn more about [creating a certificate authority on a PAN device](https://docs.paloaltonetworks.com/pan-os/9-1/pan-os-admin/certificate-management/obtain-certificates/create-a-self-signed-root-ca-certificate).
2. From your PAN-OS dashboard, click **Device**.
3. From the Certificate Management dropdown in the navigation pane, click **Certificates**.

![12.png](https://cdn.document360.io/75147bee-bf0d-444c-8afb-6e83b11ec0ef/Images/Documentation/15334386491159.png?sv=2026-02-06&spr=https&st=2026-11-09T11%3A54%3A30Z&se=2026-11-09T12%3A54%3A30Z&sr=c&sp=r&sig=DTiFcJC%2BaEca3FouuLVTGI%2F3EbODcbgQjsBuG7p88KA%3D)
4. Click **Generate**.
5. Name your certificate.
6. For Common Name, enter the URL address you acquired from Zscaler MDR in [Step 1.12](https://redcanary.document360.io/docs/integrate-palo-alto-networks-wildfire-with-red-canary-via-syslog#:~:text=Red%20Canary%20will%20generate%20a%20URL%20and%20Port%20number%20that%20you%20will%20use%20to%20input%20into%20your%20PAN%2DOS%20account.%20Copy%20and%20save%20this%20number%20as%20you%20will%20use%20it%20in%20subsequent%20steps.).
7. From the Signed By dropdown, select the trusted CA or the self-signed CA that the syslog server and the firewall both trust.

> **Note**: The certificate can’t be a Certificate Authority nor an External Authority (certificate signing request [CSR]).
8. Select **Certificate Authority**.

![13.png](https://cdn.document360.io/75147bee-bf0d-444c-8afb-6e83b11ec0ef/Images/Documentation/15334375367959.png?sv=2026-02-06&spr=https&st=2026-11-09T11%3A54%3A30Z&se=2026-11-09T12%3A54%3A30Z&sr=c&sp=r&sig=DTiFcJC%2BaEca3FouuLVTGI%2F3EbODcbgQjsBuG7p88KA%3D)
9. From the Certificate Attributes section, click **+Add**.
10. From the Type dropdown, select **Email**.
11. From the Value dropdown, enter your email address.
12. Click **Generate**.
13. Click your newly created certificate, and then select **Certificate for Secure Syslog**.

![14.png](https://cdn.document360.io/75147bee-bf0d-444c-8afb-6e83b11ec0ef/Images/Documentation/15334375371031.png?sv=2026-02-06&spr=https&st=2026-11-09T11%3A54%3A30Z&se=2026-11-09T12%3A54%3A30Z&sr=c&sp=r&sig=DTiFcJC%2BaEca3FouuLVTGI%2F3EbODcbgQjsBuG7p88KA%3D)

![15.png](https://cdn.document360.io/75147bee-bf0d-444c-8afb-6e83b11ec0ef/Images/Documentation/15334386504471.png?sv=2026-02-06&spr=https&st=2026-11-09T11%3A54%3A30Z&se=2026-11-09T12%3A54%3A30Z&sr=c&sp=r&sig=DTiFcJC%2BaEca3FouuLVTGI%2F3EbODcbgQjsBuG7p88KA%3D)
14. Click **OK**.
15. From the Device Certificates landing page, select your new certificate, and then click **Export Certificate**.

![16.png](https://cdn.document360.io/75147bee-bf0d-444c-8afb-6e83b11ec0ef/Images/Documentation/15334375378071.png?sv=2026-02-06&spr=https&st=2026-11-09T11%3A54%3A30Z&se=2026-11-09T12%3A54%3A30Z&sr=c&sp=r&sig=DTiFcJC%2BaEca3FouuLVTGI%2F3EbODcbgQjsBuG7p88KA%3D)
16. Select **Export Private Key**.
17. Enter a Passphrase.
18. Copy and save this Passphrase for future reference.
19. Confirm your Passphrase.
20. Click **OK**.

![17.png](https://cdn.document360.io/75147bee-bf0d-444c-8afb-6e83b11ec0ef/Images/Documentation/15334386513815.png?sv=2026-02-06&spr=https&st=2026-11-09T11%3A54%3A30Z&se=2026-11-09T12%3A54%3A30Z&sr=c&sp=r&sig=DTiFcJC%2BaEca3FouuLVTGI%2F3EbODcbgQjsBuG7p88KA%3D)
21. Save the downloaded certificate as you will use it in subsequent steps.
22. With your PAN-OS generated CA certificate downloaded, log in to Zscaler MDR.

## Step 4: Zscaler MDR–Upload your PanOS certificates to Zscaler MDR

Connect your custom certificates to Zscaler MDR in order to start receiving PAN-OS alerts.

1. In the Zscaler MDR portal, click **Integrations**.
2. Scroll down, and then select your third-party security source.
3. Click **Edit Configuration**.
4. Select **Use Custom TLS server certificate for ingest over TLS**.
5. Upload the certificates you generated in [Step 2](https://redcanary.document360.io/docs/integrate-palo-alto-networks-wildfire-with-red-canary-via-syslog#:~:text=device%20of%20choice.-,Step%202%3A%20Your%20PAN%2DOS%20Device%E2%80%93Generate%20a%20PAN%2DOS%20certificate,-Generate%20a%20PanOS).
6. Upload a certificate file (PEM or DER)–Upload the server.crt from [Step 2.4](https://redcanary.document360.io/docs/integrate-palo-alto-networks-wildfire-with-red-canary-via-syslog#:~:text=click%20OK.-,Step%202.4%E2%80%93Export%20your%20PAN%2DOS%20certificate,-Click%20Device.).
7. Click **Save Configuration**.

## 

##