Palo Alto Panorama Traffic logs

Palo Alto Panorama is a centralized management system for Palo Alto Networks’ firewalls. Its Traffic logs provide detailed information about network traffic, including source and destination IP addresses, application usage, and session details, which can be used for monitoring and analyzing network activity.

Ingestion Methods

Setup the ingestion of this source using one of the following guides.

• AWS S3 Bucket
• AWS S3 Bucket with Custom SQS

arn:aws:sns:<REGION>:253602268883:runreveal_palopanotraf

Collecting logs in a bucket

Palo alto panorama traffic logs are loaded from S3. You will need to forward your logs to a bucket prior to collecting them with RunReveal.

Use the following config example in reveald to forward panorama syslogs to your S3 bucket.

{
  "sources": {
      "hostlogs": {
        "type": "file",
        "path": "/var/log/syslog/",
        "extension": ".log",
      },
  },
  "destinations": {
      "runreveal-store": {
        "type": "s3",
        "bucketName": "runreveal-bucket",
        "bucketRegion": "us-west-2",
        "accessKeyID": "ACCESSKEY",
        "secretAccessKey": "SECRET"
      },
  },
}

Schema

The following columns are exposed for this source. RunReveal applies schema normalization across all sources, ensuring uniform field names and data types for cross-source queries and reusable detection logic.