Ingest Next-Generation Firewall logs using the Syslog collector
Use the Syslog collector to ingest Next-Generation Firewall (NGFW) logs in CEF format. This method is useful when your firewalls are located in a different region, or bandwidth issues are encountered due to large log size. When possible, we recommend that you ingest NGFW logs using the dedicated Next-Generation Firewall data collector instead of the Syslog collector.
### Note
In the following procedure, general information is provided for NGFW and Panorama. For detailed instructions, consult the documentation for your specific devices and Panorama version, to ensure that you have configured log forwarding correctly for all the log types that you would like to forward to Cortex XSIAM. The following steps only cover configuration of the custom log schema (CEF) for a given syslog server. They do not replace the administrator guide’s configuration coverage of log forwarding.
For tenants where customers have integrated directly with Strata Logging Service, the configured integrations, such as Next-Generation Firewall and Prisma Access, can be migrated to Cortex XSIAM in either of the following ways before the license expires:
Configure the firewall/Panorama for log forwarding to Cortex XSIAM
1. To configure the device to include its IP address in the header of Syslog messages, select **Panorama/Device** → **Setup** → **Management**, click the **Edit** icon in the **Logging and Reporting Settings** section, and navigate to the **Log Export and Reporting** tab.
2. From the **Syslog HOSTNAME Format** menu, select **ipv4-address** or **ipv6-address**, and click **OK**.
3. Select **Device** → **Server Profiles** → **Syslog**, and click **Add**.
4. Enter a server profile **Name** and **Location** (**Location** refers to a virtual system, if the device is enabled for virtual systems).
5. On the **Servers** tab of the **Syslog Server Profiles** window, click **Add,** and enter the following information for the Syslog server:
* **Name**
* **Syslog Server** (IP address)
* **Transport**, **Port** (default 514 for UDP)
* **Facility** (default LOG\_USER)
6. Select the **Custom Log Format** tab and click configure the log formats as follows:
<div data-gb-custom-block data-tag="hint" data-style="info" class="hint hint-info"><h3>Note</h3><p>To avoid the possible effects of line formatting, do not copy/paste the message formats directly into the PAN-OS web interface. Instead, paste into a text editor, remove any carriage return or line feed characters, and then copy and paste into the web interface.</p></div>
<div data-gb-custom-block data-tag="hint" data-style="info" class="hint hint-info"><h3>Note</h3><p>From version 10.0 and later, the log format documented for log types (Traffic, Threat, and URL) exceeds the maximum supported 2048 characters in the Custom Log Format tab on the firewall and Panorama. Select the CEF keys and values to limit the number of characters to 2048, as per your requirements.</p></div>
| Log Type | Custom Format |
| --------- | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| Traffic | CEF:0\|PANW\|NGFW\_CEF\|$sender\_sw\_version\|$subtype\|$type\|1\| \_\_firewall\_type=firewall.traffic \_\_timestamp=$start \_\_tz=$high\_res\_timestamp log\_type=$type subtype=$subtype log\_time=$cef-formatted-receive\_time time\_generated=$cef-formatted-time\_generated log\_source\_id=$serial log\_source\_name=$device\_name sequence\_no=$seqno source\_ip=$src dest\_ip=$dst source\_port=$sport dest\_port=$dport nat\_source=$natsrc nat\_dest=$natdst nat\_source\_port=$natsport nat\_dest\_port=$natdport protocol=$proto action=$action source\_user=$srcuser dest\_user=$dstuser xff\_ip=$xff\_ip app=$app app\_category=$category\_of\_app app\_sub\_category=$subcategory\_of\_app rule\_matched=$rule rule\_matched\_uuid=$rule\_uuid severity=1 vsys=$vsys vsys\_name=$vsys\_name from\_zone=$from to\_zone=$to inbound\_if=$inbound\_if outbound\_if=$outbound\_if session\_id=$sessionid source\_device\_category=$src\_category source\_device\_profile=$src\_profile source\_device\_model=$src\_model source\_device\_vendor=$src\_vendor source\_device\_osfamily=$src\_osfamily source\_device\_osversion=$src\_osversion source\_device\_mac=$src\_mac dest\_device\_category=$dst\_category dest\_device\_profile=$dst\_profile dest\_device\_model=$dst\_model dest\_device\_vendor=$dst\_vendor dest\_device\_osfamily=$dst\_osfamily dest\_device\_osversion=$dst\_osversion dest\_device\_mac=$dst\_mac bytes\_sent=$bytes\_sent bytes\_received=$bytes\_received packets\_received=$pkts\_received packets\_sent=$pkts\_sent total\_time\_elapsed=$elapsed session\_end\_reason=$session\_end\_reason url\_category=$category |
| Threat | CEF:0\|PANW\|NGFW\_CEF\|$sender\_sw\_version\|$threatid\|$type\|$number-of-severity\| \_\_firewall\_type=firewall.threat \_\_timestamp=$cef-formatted-time\_generated \_\_tz=$high\_res\_timestamp log\_type=$type subtype=$subtype log\_time=$cef-formatted-receive\_time time\_generated=$cef-formatted-time\_generated log\_source\_id=$serial log\_source\_name=$device\_name sequence\_no=$seqno source\_ip=$src dest\_ip=$dst source\_port=$sport dest\_port=$dport nat\_source=$natsrc nat\_dest=$natdst nat\_source\_port=$natsport nat\_dest\_port=$natdport protocol=$proto action=$action source\_user=$srcuser dest\_user=$dstuser xff=$xff xff\_ip=$xff\_ip app=$app app\_category=$category\_of\_app app\_sub\_category=$subcategory\_of\_app rule\_matched=$rule rule\_matched\_uuid=$rule\_uuid severity=$number-of-severity vsys=$vsys vsys\_name=$vsys\_name from\_zone=$from to\_zone=$to inbound\_if=$inbound\_if outbound\_if=$outbound\_if session\_id=$sessionid source\_device\_category=$src\_category source\_device\_profile=$src\_profile source\_device\_model=$src\_model source\_device\_vendor=$src\_vendor source\_device\_osfamily=$src\_osfamily source\_device\_osversion=$src\_osversion source\_device\_mac=$src\_mac dest\_device\_category=$dst\_category dest\_device\_profile=$dst\_profile dest\_device\_model=$dst\_model dest\_device\_vendor=$dst\_vendor dest\_device\_osfamily=$dst\_osfamily dest\_device\_osversion=$dst\_osversion dest\_device\_mac=$dst\_mac misc=$misc threat\_id=$threatid threat\_name=$threat\_name threat\_category=$thr\_category direction=$direction user\_agent=$user\_agent |
| URL | CEF:0\|PANW\|NGFW\_CEF\|$sender\_sw\_version\|$subtype\|$type\|$number-of-severity\| \_\_firewall\_type=firewall.url \_\_timestamp=$cef-formatted-time\_generated \_\_tz=$high\_res\_timestamp log\_type=$type subtype=$subtype log\_time=$cef-formatted-receive\_time time\_generated=$cef-formatted-time\_generated log\_source\_id=$serial log\_source\_name=$device\_name sequence\_no=$seqno source\_ip=$src dest\_ip=$dst source\_port=$sport dest\_port=$dport nat\_source=$natsrc nat\_dest=$natdst nat\_source\_port=$natsport nat\_dest\_port=$natdport protocol=$proto action=$action source\_user=$srcuser dest\_user=$dstuser xff=$xff xff\_ip=$xff\_ip app=$app app\_category=$category\_of\_app app\_sub\_category=$subcategory\_of\_app rule\_matched=$rule rule\_matched\_uuid=$rule\_uuid severity=$number-of-severity vsys=$vsys vsys\_name=$vsys\_name from\_zone=$from to\_zone=$to inbound\_if=$inbound\_if outbound\_if=$outbound\_if session\_id=$sessionid source\_device\_category=$src\_category source\_device\_profile=$src\_profile source\_device\_model=$src\_model source\_device\_vendor=$src\_vendor source\_device\_osfamily=$src\_osfamily source\_device\_osversion=$src\_osversion source\_device\_mac=$src\_mac dest\_device\_category=$dst\_category dest\_device\_profile=$dst\_profile dest\_device\_model=$dst\_model dest\_device\_vendor=$dst\_vendor dest\_device\_osfamily=$dst\_osfamily dest\_device\_osversion=$dst\_osversion dest\_device\_mac=$dst\_mac uri=$misc threat\_id=$threatid threat\_name=$threat\_name threat\_category=$thr\_category direction=$direction user\_agent=$user\_agent url\_category=$category url\_category\_list=$url\_category\_list content\_type=$contenttype http\_method=$http\_method http\_headers=$http\_headers http2\_connection=$http2\_connection referer=$referer pcap\_id=$pcap\_id |
| File Data | CEF:0\|PANW\|NGFW\_CEF\|$sender\_sw\_version\|$threatid\|$type\|$number-of-severity\| \_\_firewall\_type=firewall.filedata \_\_timestamp=$cef-formatted-time\_generated \_\_tz=$high\_res\_timestamp log\_type=$type subtype=$subtype log\_time=$cef-formatted-receive\_time time\_generated=$cef-formatted-time\_generated log\_source\_id=$serial log\_source\_name=$device\_name sequence\_no=$seqno source\_ip=$src dest\_ip=$dst source\_port=$sport dest\_port=$dport nat\_source=$natsrc nat\_dest=$natdst nat\_source\_port=$natsport nat\_dest\_port=$natdport protocol=$proto action=$action source\_user=$srcuser dest\_user=$dstuser xff=$xff xff\_ip=$xff\_ip app=$app app\_category=$category\_of\_app app\_sub\_category=$subcategory\_of\_app rule\_matched=$rule rule\_matched\_uuid=$rule\_uuid severity=$number-of-severity vsys=$vsys vsys\_name=$vsys\_name from\_zone=$from to\_zone=$to inbound\_if=$inbound\_if outbound\_if=$outbound\_if session\_id=$sessionid source\_device\_category=$src\_category source\_device\_profile=$src\_profile source\_device\_model=$src\_model source\_device\_vendor=$src\_vendor source\_device\_osfamily=$src\_osfamily source\_device\_osversion=$src\_osversion source\_device\_mac=$src\_mac dest\_device\_category=$dst\_category dest\_device\_profile=$dst\_profile dest\_device\_model=$dst\_model dest\_device\_vendor=$dst\_vendor dest\_device\_osfamily=$dst\_osfamily dest\_device\_osversion=$dst\_osversion dest\_device\_mac=$dst\_mac misc=$misc threat\_id=$threatid threat\_name=$threat\_name threat\_category=$thr\_category direction=$direction user\_agent=$user\_agent file\_url=$file\_url filedigest=$filedigest filetype=$filetype pcap\_id=$pcap\_id |
7. Configure **Escaping** characters as follows:
* **Escaped Characters:** \\
* **Escape Character:** \\
### Configure Syslog collection
Set up a Syslog collector for the logs, as explained in [Activate Syslog Collector](../../generic-on-premise-data-collectors/broker-vm-data-collector-applets/syslog-collector-applet/activate-syslog-collector). In Task 4, ensure that you set **Format** to CEF.