---
title: "Integrate Palo Alto PAN-OS with Red Canary"
slug: "integrate-palo-alto-pan-os-with-red-canary"
updated: 2026-09-09T16:09:35Z
published: 2026-09-09T16:09:35Z
canonical: "docs.redcanary.com/integrate-palo-alto-pan-os-with-red-canary"
---

> ## Documentation Index
> Fetch the complete documentation index at: https://docs.redcanary.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Integrate Palo Alto PAN-OS with Zscaler MDR

By integrating Palo Alto Networks PAN-OS with Zscaler MDR, you can significantly bolster your network security posture. This powerful combination provides a comprehensive view of network activity, accelerates threat detection, and improves incident response capabilities.

## How the Integration Works

Zscaler MDR only ingests Palo Alto Threat Prevention and Wildfire alerts with `Medium` , `High` , or `Critical `severity level. Zscaler MDR automatically drops alerts that meet the following criteria:

- Severity level: `Low` or `Informational`
- Action: `drop`, `drop-packet`, `sinkhole` , or `reset-both`
- Threat/Content Type (subtype): `Vulnerability`
- Rule name: `Trusted-Communication`

After setup, once Zscaler MDR receives eligible alerts, two separate integrations will appear in the UI, one for Threat alerts and one for Wildfire alerts. For example, if you name your integration **Palo-Alto-Firewall**, you’ll see **Palo-Alto-Threat-Prevention (via Palo-Alto-Firewall)** and **Palo-Alto-PAN-OS-Wildfire (via Palo-Alto-Firewall)** listed on the Integrations page.

## Get Started

To integrate Palo Alto PAN-OS with Zscaler MDR, follow the procedure below from beginning to end. Ensure that you are on PAN-OS version 10.1.7 or higher.

## **Step 1: Zscaler MDR–Create your Zscaler MDR generated URL**

Create a Zscaler MDR generated-URL to send PAN-OS alerts for ingestion.

1. In the Zscaler MDR portal, click **Integrations**. If you do not see the required integration, click **See all integrations**.

![](https://cdn.document360.io/75147bee-bf0d-444c-8afb-6e83b11ec0ef/Images/Documentation/integrations(3).png?sv=2026-02-06&spr=https&st=2026-10-30T06%3A08%3A47Z&se=2026-10-30T07%3A08%3A47Z&sr=c&sp=r&sig=s%2Flpm9UMzwXqpZDrk8Me5NrdUKta8OAN%2BbT0Si97twU%3D)
2. In the search bar, type click **Palo Alto PAN-OS**.
3. Continue **Configure**.
4. Enter a Name for your external alert source.
5. Select a Display Category.
6. Under the Ingest Format/Method dropdown, select **Palo Alto Networks PAN OS via Syslog**.
7. Click **Save Configuration**.
8. Click **Edit Configuration**.
9. Click **Activate**.
10. Zscaler MDR will generate a URL and Port number that you will use to input into your PAN-OS account. Copy and save this number as you will use it in subsequent steps.

![2.png](https://cdn.document360.io/75147bee-bf0d-444c-8afb-6e83b11ec0ef/Images/Documentation/8376388522391.png?sv=2026-02-06&spr=https&st=2026-10-30T06%3A08%3A47Z&se=2026-10-30T07%3A08%3A47Z&sr=c&sp=r&sig=s%2Flpm9UMzwXqpZDrk8Me5NrdUKta8OAN%2BbT0Si97twU%3D)
11. With your Zscaler MDR URL generated, log in to your PAN-OS device of choice.

## **Step 2: Your PAN-OS Device–Create the syslog profile and set up the firewall policy**

### Step 2.1–Create a Syslog Profile

1. From your PAN-OS dashboard, click **Device**.
2. From the Server Profiles dropdown in the navigation pane, click **Syslog**.

![3.png](https://cdn.document360.io/75147bee-bf0d-444c-8afb-6e83b11ec0ef/Images/Documentation/15334206561943.png?sv=2026-02-06&spr=https&st=2026-10-30T06%3A08%3A47Z&se=2026-10-30T07%3A08%3A47Z&sr=c&sp=r&sig=s%2Flpm9UMzwXqpZDrk8Me5NrdUKta8OAN%2BbT0Si97twU%3D)
3. Click **+Add**.
4. Name your Syslog Profile.
5. Click **+Add**.
6. Name your Syslog Server.
7. Copy and paste the syslog server URL address from [Step 1.11](https://redcanary.document360.io/docs/integrate-palo-alto-pan-os-with-red-canary#:~:text=Red%20Canary%20will%20generate%20a%20URL%20and%20Port%20number%20that%20you%20will%20use%20to%20input%20into%20your%20PAN%2DOS%20account.%20Copy%20and%20save%20this%20number%20as%20you%20will%20use%20it%20in%20subsequent%20steps.). ![4.png](https://cdn.document360.io/75147bee-bf0d-444c-8afb-6e83b11ec0ef/Images/Documentation/8403598291991.png?sv=2026-02-06&spr=https&st=2026-10-30T06%3A08%3A47Z&se=2026-10-30T07%3A08%3A47Z&sr=c&sp=r&sig=s%2Flpm9UMzwXqpZDrk8Me5NrdUKta8OAN%2BbT0Si97twU%3D)
8. From the Transport dropdown, select **SSL**.
9. In the Port section, enter the Port number from [Step 1.11](https://redcanary.document360.io/docs/integrate-palo-alto-pan-os-with-red-canary#:~:text=Red%20Canary%20will%20generate%20a%20URL%20and%20Port%20number%20that%20you%20will%20use%20to%20input%20into%20your%20PAN%2DOS%20account.%20Copy%20and%20save%20this%20number%20as%20you%20will%20use%20it%20in%20subsequent%20steps.).
10. From the Format dropdown, select **BSD**.
11. From the Facility dropdown, select **LOG_User**.
12. Click **OK.**

### Step 2.2–Create a Log Forwarding Profile

1. From your PAN-OS dashboard, click **Objects**.
2. In the navigation pane, click **Log Forwarding**.

**![4.png](https://cdn.document360.io/75147bee-bf0d-444c-8afb-6e83b11ec0ef/Images/Documentation/15334206567191.png?sv=2026-02-06&spr=https&st=2026-10-30T06%3A08%3A47Z&se=2026-10-30T07%3A08%3A47Z&sr=c&sp=r&sig=s%2Flpm9UMzwXqpZDrk8Me5NrdUKta8OAN%2BbT0Si97twU%3D)**
3. Click **+Add**.
4. Name your log forwarding profile, and then write a description for the profile.

> **Note**: We recommend that you name your profile something generic so it can be reused with other PAN-OS security products (for example, RC Syslog Output).
5. Click **+Add**.
6. Name your log forwarding profile match list, and then write a description for the profile match list.
7. From the Log Type dropdown, select **threat**.
8. From the Filter dropdown, select **All Logs**.
9. Select **Syslog**.
10. From the Syslog section, click **+Add**, and then select the syslog created from [Step 2.1](https://redcanary.document360.io/docs/integrate-palo-alto-pan-os-with-red-canary#:~:text=the%20firewall%20policy-,Step%202.1%E2%80%93Create%20a%20Syslog%20Profile,-From%20your%20PAN).

![6.png](https://cdn.document360.io/75147bee-bf0d-444c-8afb-6e83b11ec0ef/Images/Documentation/8403705488023.png?sv=2026-02-06&spr=https&st=2026-10-30T06%3A08%3A47Z&se=2026-10-30T07%3A08%3A47Z&sr=c&sp=r&sig=s%2Flpm9UMzwXqpZDrk8Me5NrdUKta8OAN%2BbT0Si97twU%3D)
11. Click **OK**.

**![5.png](https://cdn.document360.io/75147bee-bf0d-444c-8afb-6e83b11ec0ef/Images/Documentation/17830986814103.png?sv=2026-02-06&spr=https&st=2026-10-30T06%3A08%3A47Z&se=2026-10-30T07%3A08%3A47Z&sr=c&sp=r&sig=s%2Flpm9UMzwXqpZDrk8Me5NrdUKta8OAN%2BbT0Si97twU%3D)**
12. With your Log Forwarding Profile created, click **OK**.

### Step 2.3–Create a Security Policy Rule

> [!NOTE]
> Note:
> 
> Please ensure that the Security Policy and Zone Protection are configured correctly. For instructions, please read [Palo Alto Threat Logs.](https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA14u000000oM87CAE)

1. From your PAN-OS dashboard, click **Policies**.
2. In the navigation pane, click **Security**.

![6.png](https://cdn.document360.io/75147bee-bf0d-444c-8afb-6e83b11ec0ef/Images/Documentation/15334235012631.png?sv=2026-02-06&spr=https&st=2026-10-30T06%3A08%3A47Z&se=2026-10-30T07%3A08%3A47Z&sr=c&sp=r&sig=s%2Flpm9UMzwXqpZDrk8Me5NrdUKta8OAN%2BbT0Si97twU%3D)
3. Select an existing policy rule if available, or click **+Add** and follow these steps:
  1. Fill in the required information in all of the tabs.

> **Note**: We recommend that you name your Security Policy Rule something generic so it can be reused with other PAN-OS security products (for example, RC Security Policy).
  2. Under the Actions tab, click the **Action Setting** dropdown and select **Allow**.
  3. From the **Profile Type** dropdown, select **Profiles**.
  4. Customize the type of information you want to send to Zscaler MDR by selecting your profile settings.
4. From the **Log Forwarding** dropdown, select the syslog created from Step 2.1.

![8.png](https://cdn.document360.io/75147bee-bf0d-444c-8afb-6e83b11ec0ef/Images/Documentation/8403892797719.png?sv=2026-02-06&spr=https&st=2026-10-30T06%3A08%3A47Z&se=2026-10-30T07%3A08%3A47Z&sr=c&sp=r&sig=s%2Flpm9UMzwXqpZDrk8Me5NrdUKta8OAN%2BbT0Si97twU%3D)
5. With all of the required information filled in, click **OK**.

## **Step 3: Your PAN-OS Device–Create a Certificate Authority (CA)**

Generate a PanOS CA certificate to send via Syslog from your PAN-OS device to Zscaler MDR. If you choose to perform this step, **you do so before you perform Step 4**.

> **Note**: If a self signed CA is not already present, then generate one using the steps below before moving on to [Step 3.2](https://redcanary.document360.io/docs/integrate-palo-alto-pan-os-with-red-canary#:~:text=Export%20Certificate.-,Step%203.2%E2%80%93Create%20your%20PAN%2DOS%20Certificate,-From%20your%20PAN).

### Step 3.1-Create a local CA

1. Review this article and complete [steps 1-4 to configure the PAN-OS syslog monitoring process](https://docs.paloaltonetworks.com/pan-os/9-1/pan-os-admin/monitoring/use-syslog-for-monitoring/configure-syslog-monitoring).

> **Note**: If a CA certificate is not already present, PAN-OS allows for their firewall to act as a certificate authority. Learn more about [creating a certificate authority on a PAN device](https://docs.paloaltonetworks.com/pan-os/9-1/pan-os-admin/certificate-management/obtain-certificates/create-a-self-signed-root-ca-certificate).
2. From your PAN-OS dashboard, click **Device**.
3. From the Certificate Management dropdown in the navigation pane, click **Certificates**.

![12.png](https://cdn.document360.io/75147bee-bf0d-444c-8afb-6e83b11ec0ef/Images/Documentation/15334235030807.png?sv=2026-02-06&spr=https&st=2026-10-30T06%3A08%3A47Z&se=2026-10-30T07%3A08%3A47Z&sr=c&sp=r&sig=s%2Flpm9UMzwXqpZDrk8Me5NrdUKta8OAN%2BbT0Si97twU%3D)
4. Click **Generate**.
5. Name your certificate.
6. For Common Name, enter the FQDN or IP of your PAN-OS Device.
7. Select **Certificate Authority**.

![](https://cdn.document360.io/75147bee-bf0d-444c-8afb-6e83b11ec0ef/Images/Documentation/19875374948631.png?sv=2026-02-06&spr=https&st=2026-10-30T06%3A08%3A47Z&se=2026-10-30T07%3A08%3A47Z&sr=c&sp=r&sig=s%2Flpm9UMzwXqpZDrk8Me5NrdUKta8OAN%2BbT0Si97twU%3D)
8. From the Certificate Attributes section, click **+Add**.
9. From the Type dropdown, select **Email**.
10. From the Value dropdown, enter your email address.
11. Click **Generate**.
12. After generating the CA certificate, click **Export Certificate**.

## Step 3.2–Create your PAN-OS Certificate

1. From your PAN-OS dashboard, click **Device**.
2. From the Certificate Management dropdown in the navigation pane, click **Certificates**.

![7.png](https://cdn.document360.io/75147bee-bf0d-444c-8afb-6e83b11ec0ef/Images/Documentation/15334206571287.png?sv=2026-02-06&spr=https&st=2026-10-30T06%3A08%3A47Z&se=2026-10-30T07%3A08%3A47Z&sr=c&sp=r&sig=s%2Flpm9UMzwXqpZDrk8Me5NrdUKta8OAN%2BbT0Si97twU%3D)
3. Click **Generate**.
4. Name your certificate.
5. For **Common Name**, enter the address you acquired from Zscaler MDR in [Step 1.11](https://redcanary.document360.io/docs/integrate-palo-alto-pan-os-with-red-canary#step-32%E2%80%93create-your-panos-certificate:~:text=Red%20Canary%20will%20generate%20a%20URL%20and%20Port%20number%20that%20you%20will%20use%20to%20input%20into%20your%20PAN%2DOS%20account.%20Copy%20and%20save%20this%20number%20as%20you%20will%20use%20it%20in%20subsequent%20steps.).

> [!NOTE]
> **Note**: Ensure you do not copy "**:port**" when copying the address.
6. From the **Signed By** dropdown, select the trusted CA or the self-signed CA that you created.

![](https://cdn.document360.io/75147bee-bf0d-444c-8afb-6e83b11ec0ef/Images/Documentation/19877874088855.png?sv=2026-02-06&spr=https&st=2026-10-30T06%3A08%3A47Z&se=2026-10-30T07%3A08%3A47Z&sr=c&sp=r&sig=s%2Flpm9UMzwXqpZDrk8Me5NrdUKta8OAN%2BbT0Si97twU%3D)
7. Click **Generate**.
8. Click your newly created certificate.

![8.png](https://cdn.document360.io/75147bee-bf0d-444c-8afb-6e83b11ec0ef/Images/Documentation/15334206574615.png?sv=2026-02-06&spr=https&st=2026-10-30T06%3A08%3A47Z&se=2026-10-30T07%3A08%3A47Z&sr=c&sp=r&sig=s%2Flpm9UMzwXqpZDrk8Me5NrdUKta8OAN%2BbT0Si97twU%3D)
9. Select **Certificate for Secure Syslog**.

![9.png](https://cdn.document360.io/75147bee-bf0d-444c-8afb-6e83b11ec0ef/Images/Documentation/15334235022743.png?sv=2026-02-06&spr=https&st=2026-10-30T06%3A08%3A47Z&se=2026-10-30T07%3A08%3A47Z&sr=c&sp=r&sig=s%2Flpm9UMzwXqpZDrk8Me5NrdUKta8OAN%2BbT0Si97twU%3D)
10. Click **OK**.
11. From the Device Certificates landing page, click **Commit** to commit changes, then select the new certificate, and then click **Export Certificate**.

![10.png](https://cdn.document360.io/75147bee-bf0d-444c-8afb-6e83b11ec0ef/Images/Documentation/15334235025047.png?sv=2026-02-06&spr=https&st=2026-10-30T06%3A08%3A47Z&se=2026-10-30T07%3A08%3A47Z&sr=c&sp=r&sig=s%2Flpm9UMzwXqpZDrk8Me5NrdUKta8OAN%2BbT0Si97twU%3D)
12. Select **Export Private Key**.
13. Enter a Passphrase.
14. Confirm your Passphrase.
15. Click **OK**.

![11.png](https://cdn.document360.io/75147bee-bf0d-444c-8afb-6e83b11ec0ef/Images/Documentation/15334235028503.png?sv=2026-02-06&spr=https&st=2026-10-30T06%3A08%3A47Z&se=2026-10-30T07%3A08%3A47Z&sr=c&sp=r&sig=s%2Flpm9UMzwXqpZDrk8Me5NrdUKta8OAN%2BbT0Si97twU%3D)
16. Save the downloaded certificate as you will use it in subsequent steps.
17. With your PAN-OS generated certificate downloaded, log in to Zscaler MDR.

## **Step 4: Zscaler MDR–Upload your PanOS certificates to Zscaler MDR**

Connect your custom certificates to Zscaler MDR in order to start receiving PAN-OS alerts.

1. In the Zscaler MDR portal, click **Integrations**.

![](https://cdn.document360.io/75147bee-bf0d-444c-8afb-6e83b11ec0ef/Images/Documentation/19875374971415.png?sv=2026-02-06&spr=https&st=2026-10-30T06%3A08%3A47Z&se=2026-10-30T07%3A08%3A47Z&sr=c&sp=r&sig=s%2Flpm9UMzwXqpZDrk8Me5NrdUKta8OAN%2BbT0Si97twU%3D)
2. Scroll down, and then select your third-party security source.
3. Click **Edit Configuration**.
4. Select **Use Custom TLS server certificate for ingest over TLS**.
5. Upload the certificates you generated in previous steps:
  - Upload a certificate file (PEM or DER)–Upload the server.crt from [Step 3.2](https://redcanary.document360.io/docs/integrate-palo-alto-pan-os-with-red-canary#step-32%E2%80%93create-your-panos-certificate:~:text=Export%20Certificate.-,Step%203.2%E2%80%93Create%20your%20PAN%2DOS%20Certificate,-From%20your%20PAN).
  - Enter the Private key passphrase used to generate the server key from [Step 3.2.13](https://redcanary.document360.io/docs/integrate-palo-alto-pan-os-with-red-canary#step-32%E2%80%93create-your-panos-certificate:~:text=Private%20Key.-,Enter%20a%20Passphrase.,-Confirm%20your%20Passphrase).
  - Upload the CA certificate corresponding to your certificate–Upload the ca.crt used to sign the server.crt.
    - > [!NOTE]
> **Note**: The passphrase is only necessary for the PEM or DER certificate created in [Step 3.2](https://redcanary.document360.io/docs/integrate-palo-alto-pan-os-with-red-canary#step-32%E2%80%93create-your-panos-certificate:~:text=Export%20Certificate.-,Step%203.2%E2%80%93Create%20your%20PAN%2DOS%20Certificate,-From%20your%20PAN).
6. Click **Save Configuration**.