Palo Alto Firewall Syslog Filter Documentation

1. Introduction

This guide outlines how to configure Syslog filters on Palo Alto Networks firewalls to control which logs are sent to external Syslog servers. Proper filtering reduces noise, focuses on relevant events, and improves SIEM performance.

2. Syslog Overview

Syslog is a protocol used to send logs from network devices to centralized logging systems. Palo Alto firewalls support syslog forwarding for various log types: traffic, threat, system, and configuration.

3. Components Involved

Component	Description
Syslog Server Profile	Defines the destination server and syslog transport type
Log Forwarding Profile	Specifies what logs to forward and to whom
Security Policy	Determines when logs are generated and which are forwarded

4. Configuration Steps
4.1 Create Syslog Server Profile

Navigate to: Device > Server Profiles > Syslog

Steps:

Click Add to create a new profile.
Enter a Name (e.g., SIEM-Syslog).
Under Syslog Server, click Add and enter:
- Name: e.g., SIEM-Server
- Server: IP or hostname of your syslog server
- Transport: UDP, TCP, or SSL
- Port: Default is 514 (UDP)
- Facility: e.g., local4
- Format: BSD or IETF
(Optional) Add a Filter to specify:
- Log Type: Threat, Traffic, System, Config
- Severity: Info, Low, Medium, High, Critical
Click OK

4.2 Create Log Forwarding Profile

Navigate to: Objects > Log Forwarding

Steps:

Click Add to create a new log forwarding profile.
Name it (example: syslog)
Under Log Type, click Add and configure:
- Log Type: Select Threat or Traffic
- Filter (optional): For example, (severity eq high)
- Forward Method: Select the Syslog Server Profile you created, click Add then select the one you created
Click OK