Skip to main content

CollectorsCloud Collectors Administration Guide

Configure the Palo Alto Networks Cortex Data Lake Cloud Collector

Palo Alto Networks Cortex Data Lake collects and stores the network logs generated by security products, including next-generation firewalls, Prisma Access, and Cortex XDR. Configure Palo Alto Networks Cortex Data Lake to forward logs to New-Scale Security Operations Platform to ingest firewall data for monitoring network activities, and for long-term storage, reporting, or legal and compliance requirements.

To set up the Cloud Collector to ingest data from Palo Alto Networks Cortex Data Lake:

  • Obtain the authentication token and URL to use a token-based authentication model

  • Configure Palo Alto Networks Cortex Data Lake to forward HTTPS logs to Exabeam

Obtain the Authentication Token and URL

  1. Log in to the New-Scale Security Operations Platform with your registered credentials as an administrator.

  2. Click New Collector.

  3. Click Palo Alto Networks Cortex Data Lake.

  4. Enter the following information for the cloud collector:

    PAN1.png

    • Name – Specify a name for the Cloud Collector instance.

    • Format – The format for receiving data is set to JSON by default. The default format cannot be modified.

      The New-Scale Security Operations Platform accepts and parses the JSON Array log format in which PAN Cortex Data Lake forwards logs.

  5. (Optional) SITE – Select an existing site or to create a new site with a unique ID, click manage your sites. Adding a site name helps you to ensure efficient management of environments with overlapping IP addresses.

    By entering a site name, you associate the logs with a specific independent site. A sitename metadata field is automatically added to all the events that are going to be ingested via this collector. For more information about Site Management, see Define a Unique Site Name.

  6. (Optional) TIMEZONE – Select a time zone applicable to you for accurate detections and event monitoring.

    By entering a time zone, you override the default log time zone. A timezone metadata field is automatically added to all events ingested through this collector.

    Timezone_sitename_site_management_1.png

  7. To confirm that the New-Scale Security Operations Platform communicates with the service, click Test Connection.

  8. Click Install.

    A confirmation message informs you that the new Cloud Collector is created. The message box also displays the authentication token and the URL to which logs are sent.

    Pan_3.png

  9. Copy the Authentication Token by clicking the copy icon. Record the token for later use when you configure Palo Alto Networks Cortex Data Lake Cloud Collector on the Palo Alto Networks Cortex Data Lake platform.

  10. To view the cloud collector summary, click Go to Overview. If you want to add more cloud collector instances, click Add more collectors.

    The Overview tab displays the Palo Alto Networks Cortex Data Lake Cloud Collector instance that you installed.

Configure Palo Alto Networks Cortex Data Lake to Forward HTTPS Logs to Exabeam

To configure the Palo Alto Networks Cortex Data Lake to receive data into the New-Scale Security Operations Platform, on the Palo Alto Networks Cortex Data Lake portal, follow the steps mentioned in the Forward Logs from Cortex Data Lake to an HTTPS Server section in the Palo Alto Networks Cortex Data Lake documentation.

Note

The Exabeam certificate is trusted by Palo Alto Networks to establish communication between Cortex Data Lake and Exabeam. Hence, do not configure TLS server certificates.