Visualizing Palo Alto Logs as a Wazuh Agent

[Elvis Bustamante]

Hello,

I have a question regarding the integration of Palo Alto logs with Wazuh. Currently, I am receiving Palo Alto logs via syslog on my Wazuh server. In the interface, I can view them in the Explore -> Discover section, and in the console, they are being saved at the path /var/ossec/logs/alerts/alerts.log.

Is it possible to visualize these Palo Alto logs in more detail, as if they were from a Wazuh agent, considering that I do not have another machine to install an agent and use it as an intermediary?

Thank you in advance for any guidance you can provide.

[hasitha.u...@wazuh.com]

Hi  Elvis,

It seems you're looking if it's possible to improve how the already ingested Palo Alto logs are displayed in Wazuh.

Wazuh works by using agents on devices like computers and servers to collect security data, which is sent to a central server. For devices that can’t have agents, like firewalls, switches, or routers, Wazuh can still receive logs via Syslog, SSH, or APIs.

The central server analyzes these logs and sends the results to the Wazuh indexer, where the data is stored and made searchable.

To improve how Palo Alto logs are shown, you can create custom decoders and rules by following the Wazuh documentation.
Ref:https://documentation.wazuh.com/current/user-manual/ruleset/decoders/custom.html
https://documentation.wazuh.com/current/user-manual/ruleset/rules/custom.html
https://documentation.wazuh.com/current/user-manual/ruleset/ruleset-xml-syntax/rules.html

Also, by enabling archive logs, you can see all logs from your sources. However, this feature is disabled by default because it uses a lot of storage. Wazuh stores all events, even if they don’t trigger any rules, in the archive files located at /var/ossec/logs/archives/archives.log and /var/ossec/logs/archives/archives.json.

These logs are useful for reviewing past incidents, analyzing trends, and generating security reports.
Be aware that enabling archives means storing logs indefinitely, which can take up significant disk space.

You can also create custom dashboards for a more detailed view of the alerts for Palo Alto.
Ref: https://documentation.wazuh.com/current/user-manual/wazuh-dashboard/creating-custom-dashboards.html

For more details, on how Wazuh works, you can follow this.
Ref:https://documentation.wazuh.com/current/getting-started/architecture.html#architecture

Let me know if this helps!

Regards,
Hasitha Upekshitha