want to integrate Palo Alto Networks PA-440 Firewall with wazuh

[Meraz Khan]

Hi ,

My Organization wants to integrate the firewall with wazuh , i didnt found any particular integration documentation , can you please help me ,like what are the changes i need to do in my config file as well as decoders and rules . 

Regards ,

Meraz

[Stuti Gupta]

Hi Meraz

Wazuh manager can receive log messages via Syslog. https://documentation.wazuh.com/current/user-manual/capabilities/log-data-collection/syslog.html
You need configure the section remote in ossec. conf. It is located at /var/ossec/etc/ossec.conf
For more information, you can follow our documentation: Local configuration - remote

1. A configuration example is:

<remote>
  <connection>syslog</connection>
  <port>514</port>
  <protocol>udp</protocol>
  <allowed-ips>10.0.0.0/24</allowed-ips>
  <local_ip>10.0.0.1</local_ip>
</remote>

2. Enable Log Monitoring To ensure that Wazuh logs all incoming messages, you can set the following options in the <global> section of ossec.conf:
<ossec_config>
  <global>
    <jsonout_output>yes</jsonout_output>
    <alerts_log>yes</alerts_log>
    <logall>yes</logall>
    <logall_json>yes</logall_json>

   ...
</ossec_config>

This configuration allows Wazuh to log all incoming events, which is useful for debugging and ensuring logs are being received correctly.

3. Decoders and Rules
Wazuh already includes built-in decoders and rules for FortiGate logs.  If you find that some logs are not being processed correctly, you may need to create custom decoders or rules. Wazuh provides documentation on how to create these custom configurations here. https://wazuh.com/blog/creating-decoders-and-rules-from-scratch/
4. After making the changes, restart the Wazuh manager to apply the new configurations: sudo systemctl restart wazuh-manager

I hope this example help you. If you have further questions, let us know.