Palo Alto via Broker Agent

The Palo Alto and ESET PROTECT integration enables ingestion and normalization of selected network security indicators (threat logs), providing visibility into network-related threats alongside ESET security events. Indicators are available for investigation in the ESET PROTECT Web Console > Advanced Search.

The integration is Syslog-based and installs a Broker Agent on the target device during integration setup. The Broker Agent is a component that collects and forwards data to the ESET PROTECT Platform.

ESET PROTECT offers two options of the integration setup for your choice: Optimal and Custom setup. If you select Optimal setup, ESET handles the setup and maintenance for you, including Syslog profile creation and management. If you select Custom setup, you set up and manage the Syslog profile yourself in Palo Alto, and provide its configuration details during the setup process in the ESET PROTECT Web Console.

Prerequisites

•You have configured the Palo Alto Firewall on your network.

•The Palo Alto Firewall generates the threat logs.

•You have prepared a target device running Windows Server 2016 or later.

•The target device has the ESET Management Agent installed and is connected to ESET PROTECT.

•The target device can receive incoming Syslog traffic on the configured port.

•You have enabled API access in Palo Alto and generated an API key using the Palo Alto instructions (required for Optimal setup).

•You have generated and exported a public certificate from Palo Alto, and selected it for TLS communication with the management interface (required for Optimal setup).

•You have configured a Syslog profile with the IETF log format in the Palo Alto Firewall (required for Custom setup).

How to enable the integration

To install and set up the Palo Alto via Broker Agent integration application, navigate to ESET PROTECT Web Console > Integrations > Marketplace and follow the steps below.

1.On the Marketplace, find Palo Alto via Broker Agent and click Connect.

2.Review the Before you begin notification and click Continue.

3.In General Setup, complete the following fields. Then, click Next.

•Select company (required)—Select the company for which you configure the integration. The field appears only for MSP users.

•Name (optional)—Type a distinct name for the integration.

•Description (optional)—Type a description for the integration.

4.In Choose Configuration, select the desired setup option. Then, click Next.

•Optimal setup—ESET handles the setup and maintenance for you, including Syslog profile creation and management.

•Custom setup—You set up and manage the Syslog profile yourself in Palo Alto, and provide its configuration details during the setup process in the ESET PROTECT Web Console.

5.In Target, select the target device for the integration, and click Next.

6.In Instance Settings, complete the following fields. Then, click Next.

•IP/Hostname address (required)—Type the IP address or Hostname of your Palo Alto Firewall.

•API Port (required)—Select the API port used by your Palo Alto Firewall.

•API Key (required)—Type the API key that your Palo Alto Firewall generated.

•Certificate (required)—Upload the public certificate exported from Palo Alto.

7.In Syslog Settings, complete the following fields. Then, click Next.

•Listener (Bind) IP address (optional)—Type the IP address for the connector to listen for incoming Syslog messages. If not specified, the connector will listen to all available network interfaces (0.0.0.0).

•Allowed source IP addresses (optional)—Type the IP addresses or CIDR blocks from which the Syslog listener can accept incoming messages. Use the UDP and TCP settings to prevent log spoofing from unauthorized devices on the local network. If you do not specify and IP address, the listener accepts connections from any IP address.

•Protocol (required)—Select the connection protocol.

•Port (required)—Specify the port number to use for the connection. If multiple integrations use the same target device, configure a unique Syslog listener port for each integration to avoid port conflicts.

•Severity settings (required)—Select severity types for the logs to be received. Available severity settings are:

oAll severities—Include informational, low, medium, high and critical.

oCritical

oHigh and above

oMedium and above

oLow and above

8.In Summary, review your settings and click Create.

When the integration setup is complete, the data from Palo Alto will appear in the ESET PROTECT Web Console > Advanced Search. Retrieve the data from Palo Alto using the following filter:

Troubleshooting

˄˅