Palo Alto Networks

Collect firewall logs from Palo Alto Networks firewalls and offer serious threats to the security signal inbox.

At a glance

Direction	Into Aegis.
What it brings in	Threat, WildFire, URL and traffic logs, as chosen per connection, from a minimum severity and over a chosen time range.
Where it lands	The connection's log list; new high and critical threat logs are offered to the security signal inbox. You can also create an incident from one log by hand (see Incidents).
Credentials and permissions	The firewall's management address (HTTPS, reachable from Aegis) and an API key of an account with read-only access to logs, with the XML API enabled.
Owner of imported records	Logs and signals have no owner; an incident belongs to the person who created or accepted it.
When it runs	Connections are checked every five minutes against their own schedule, and on demand.
Set it up	`/connectors/paloalto`, by people allowed to configure connectors, on a plan that includes the connector. Several firewalls can be added.

Good to know

Traffic logs are high in volume; switch them on only when you need them.
Management addresses on private networks are refused unless your instance allows them.

Where this connects

Signals and incidents are handled in Incidents.