Wazuh palo alto integration

[Kerim Karataş]

Greetings to everyone,

I forwarded the logs to Wazuh in Palo Alto. It generates an alert when it drops a malicious link. But I want it to generate an alert when I commit in Palo Alto. How can I do it?

Thank you in advance for your help.

[Nicolas Stefani]

Hi Kerim,

I'm not sure how Palo Alto works but when you commit in Palo Alto, does this action generate any log or event?

If this is the case you will need to forward this information to Wazuh and create a custom rule to generate an alert.

Let me know if this works for you.

Regards,

[Kerim Karataş]

Hi Stefan,

Yes, it creates and sends the commit log with syslog. But I couldn't find the log. Normally I can see the syslog logs.

Best regards.

1 Temmuz 2024 Pazartesi tarihinde saat 15:49:16 UTC+3 itibarıyla Nicolas Stefani şunları yazdı:

[Nicolas Stefani]

Well, if you find the log I can assist you in creating the custom rule. If not I can't do much more.

Regards,