Integrate Palo Alto PAN-OS with Red Canary
- 16 Oct 2024
- 4 Minutes to read
- PDF
Integrate Palo Alto PAN-OS with Red Canary
- Updated on 16 Oct 2024
- 4 Minutes to read
- PDF
Article summary
Did you find this summary helpful?
Thank you for your feedback
By integrating Palo Alto Networks PAN-OS with Red Canary, you can significantly bolster your network security posture. This powerful combination provides a comprehensive view of network activity, accelerates threat detection, and improves incident response capabilities.
To integrate Palo Alto PAN-OS with Red Canary, follow the procedure below from beginning to end. Ensure that you are on PAN-OS version 10.1.7 or higher.
Step 1: Red Canary–Create your Red Canary generated URL
Create a Red Canary generated-URL to send PAN-OS alerts for ingestion.
From your Red Canary homepage, click Integrations. If you do not see the required integration, click See all integrations.
.png?sv=2022-11-02&spr=https&st=2024-11-21T09%3A34%3A00Z&se=2024-11-21T09%3A44%3A00Z&sr=c&sp=r&sig=uUOAGJiqBumAv8ITbY%2FayPyOjHkJH0b1PksEn5ZcNvo%3D)
In the search bar, type click Palo Alto PAN-OS.
Continue Configure.
Enter a Name for your external alert source.
Select a Display Category.
Under the Ingest Format/Method dropdown, select Palo Alto Networks PAN OS via Syslog.
Click Save Configuration.
Click Edit Configuration.
Click Activate.
Red Canary will generate a URL and Port number that you will use to input into your PAN-OS account. Copy and save this number as you will use it in subsequent steps.
With your Red Canary URL generated, log in to your PAN-OS device of choice.
.png?sv=2022-11-02&spr=https&st=2024-11-21T09%3A34%3A00Z&se=2024-11-21T09%3A44%3A00Z&sr=c&sp=r&sig=uUOAGJiqBumAv8ITbY%2FayPyOjHkJH0b1PksEn5ZcNvo%3D)
Step 2: Your PAN-OS Device–Create the syslog profile and set up the firewall policy
Step 2.1–Create a Syslog Profile
From your PAN-OS dashboard, click Device.
From the Server Profiles dropdown in the navigation pane, click Syslog.
Click +Add.
Name your Syslog Profile.
Click +Add.
Name your Syslog Server.
Copy and paste the syslog server URL address from Step 1.11.
From the Transport dropdown, select SSL.
In the Port section, enter the Port number from Step 1.11.
From the Format dropdown, select BSD.
From the Facility dropdown, select LOG_User.
Click OK.
Step 2.2–Create a Log Forwarding Profile
From your PAN-OS dashboard, click Objects.
In the navigation pane, click Log Forwarding.
Click +Add.
Name your log forwarding profile, and then write a description for the profile.
Note: We recommend that you name your profile something generic so it can be reused with other PAN-OS security products (for example, RC Syslog Output).
Click +Add.
Name your log forwarding profile match list, and then write a description for the profile match list.
From the Log Type dropdown, select threat.
From the Filter dropdown, select All Logs.
Select Syslog.
From the Syslog section, click +Add, and then select the syslog created from Step 2.1.
Click OK.
With your Log Forwarding Profile created, click OK.
Step 2.3–Create a Security Policy Rule
Note:
Please ensure that the Security Policy and Zone Protection are configured correctly. For instructions, please read Palo Alto Threat Logs.
From your PAN-OS dashboard, click Policies.
In the navigation pane, click Security.
Click +Add.
To create a Security Policy Rule, fill in the required information in all of the tabs.
Note: We recommend that you name your Security Policy Rule something generic so it can be reused with other PAN-OS security products (for example, RC Security Policy).
In the Actions tab’s Action Setting dropdown, select Allow.
From the Profile Type dropdown, select Profiles.
Customize the type of information you want to send to Red Canary by selecting your profile settings.
From the Log Forwarding dropdown, select the syslog created from Step 2.1.
With all of the required information filled in, click OK.
Step 3: Your PAN-OS Device–Create a Certificate Authority (CA)
Generate a PanOS CA certificate to send via Syslog from your PAN-OS device to Red Canary. If you choose to perform this step, you do so before you perform Step 4.
Note: If a self signed CA is not already present, then generate one using the steps below before moving on to Step 3.2.
Step 3.1-Create a local CA
Review this article and complete steps 1-4 to configure the PAN-OS syslog monitoring process.
Note: If a CA certificate is not already present, PAN-OS allows for their firewall to act as a certificate authority. Learn more about creating a certificate authority on a PAN device.
From your PAN-OS dashboard, click Device.
From the Certificate Management dropdown in the navigation pane, click Certificates.
Click Generate.
Name your certificate.
For Common Name, enter the FQDN or IP of your PAN-OS Device.
Select Certificate Authority.
From the Certificate Attributes section, click +Add.
From the Type dropdown, select Email.
From the Value dropdown, enter your email address.
Click Generate.
After generating the CA certificate, click Export Certificate.
Step 3.2–Create your PAN-OS Certificate
From your PAN-OS dashboard, click Device.
From the Certificate Management dropdown in the navigation pane, click Certificates.
Click Generate.
Name your certificate.
For Common Name, enter the address you acquired from Red Canary in Step 1.11.
Note: Ensure you do not copy ":port" when copying the address.
From the Signed By dropdown, select the trusted CA or the self-signed CA that you created.
Click Generate.
Click your newly created certificate.
Select Certificate for Secure Syslog.
Click OK.
From the Device Certificates landing page, click Commit to commit changes, then select the new certificate, and then click Export Certificate.
Select Export Private Key.
Enter a Passphrase.
Confirm your Passphrase.
Click OK.
Save the downloaded certificate as you will use it in subsequent steps.
With your PAN-OS generated certificate downloaded, log in to Red Canary.
Step 4: Red Canary–Upload your PanOS certificates to Red Canary
Connect your custom certificates to Red Canary in order to start receiving PAN-OS alerts.
From your Red Canary homepage, click Integrations.
Scroll down, and then select your third-party security source.
Click Edit Configuration.
Select Use Custom TLS server certificate for ingest over TLS.
Upload the certificates you generated in previous steps:
Upload a certificate file (PEM or DER)–Upload the server.crt from Step 3.2.
Enter the Private key passphrase used to generate the server key from Step 3.2.13.
Upload the CA certificate corresponding to your certificate–Upload the ca.crt used to sign the server.crt.
Note: The passphrase is only necessary for the PEM or DER certificate created in Step 3.2.
Click Save Configuration.
FAQ
What type of data is ingested via the Palo Alto PAN-OS Integration?
Red Canary prioritizes ingesting logs from Palo Alto WildFire and Palo Alto Threat Prevention with Critical, High, or Medium severity. While system logs can also be ingested, they are given lower priority. Logs with Low or Informational severity are filtered out and will not appear in the alerts page UI.
Since Palo Alto PAN-OS can take automated actions on certain types of traffic, we apply filters to exclude alerts for Vulnerability, Trusted Communications, and reset-both, as these are already handled by PAN-OS actions. Additionally, alerts marked with the "drop" action are not processed, as PAN-OS has already mitigated them.
Was this article helpful?
