PANW-IP-000058 - The Palo Alto Networks security platform must off-load log records to a centralized log server in real-time.

Information

Off-loading ensures audit information does not get overwritten if the limited audit storage capacity is reached and also protects the audit record in case the system/component being audited is compromised.

Off-loading is a common process in information systems with limited audit storage capacity. The audit storage on the device is used only in a transitory fashion until the system can communicate with the centralized log server designated for storing the audit records, at which point the information is transferred. However, DoD requires that the log be transferred in real-time which indicates that the time from event detection to off-loading is seconds or less.

This does not apply to audit logs generated on behalf of the device itself (management).

Solution

To create a syslog server profile:
Go to Device >> Server Profiles >> Syslog
Select 'Add'.
In the Syslog Server Profile, enter the name of the profile.
Select 'Add'.
In the 'Servers' tab, enter the required information.
Name: Name of the syslog server
Server: Server IP address where the logs will be forwarded to
Port: Default port 514
Facility: Select from the drop-down list.
Select 'OK.

After you create the Server Profiles that define where to send your logs, you must enable log forwarding.
The way you enable forwarding depends on the log type:
Traffic Logs-You enable forwarding of Traffic logs by creating a Log Forwarding Profile (Objects >> Log Forwarding) and adding it to the security policies you want to trigger the log forwarding. Only traffic that matches a specific rule within the security policy will be logged and forwarded.
Configure the log-forwarding profile to select the logs to be forwarded to syslog server.
Go to Objects >> Log forwarding.
The 'Log Forwarding Profile' window appears. Note that it has five columns. In the 'Syslog' column, select the syslog server profile for forwarding threat logs to the configured server(s).
Select 'OK.

When the 'Log Forwarding Profile' window disappears, the screen will show the configured log-forwarding profile.
Threat Logs-You enable forwarding of Threat logs by creating a Log Forwarding Profile (Objects >> Log Forwarding) that specifies which severity levels you want to forward and then adding it to the security policies for which you want to trigger the log forwarding. A Threat log entry will only be created (and therefore forwarded) if the associated traffic matches a Security Profile (Antivirus, Anti-spyware, Vulnerability, URL Filtering, File Blocking, Data Filtering, or DoS Protection).
Configure the log-forwarding profile to select the logs to be forwarded to syslog server.
Go to Objects >> Log forwarding
The 'Log Forwarding Profile' window appears. Note that it has five columns. In the 'Syslog' column, select the syslog server profile for forwarding threat logs to the configured server(s).
Select 'OK'.

When the 'Log Forwarding Profile' window disappears, the screen will show the configured log-forwarding profile.
System Logs-You enable forwarding of System logs by specifying a Server Profile in the log settings configuration.
Go to Device >> Log Settings >> System Logs
The list of severity levels is displayed.
You must select a Server Profile for each severity level you want to forward.
Select each severity level in turn; with each selection, the 'Log Systems - Setting' window will appear.
In the 'Log Systems - Setting' window, in the 'Syslog' drop-down box, select the configured Server Profile.
Select 'OK.

Config Logs-You enable forwarding of Config logs by specifying a Server Profile in the log settings configuration.
Go to Device >> Log Settings >> Config Logs
Select the 'Edit' icon (the gear symbol in the upper-right corner of the pane).
In the 'Log Settings Config' window, in the 'Syslog' drop-down box, select the configured Server Profile.
Select 'OK.

For Traffic Logs and Threat Logs, use the log forwarding profile in the security rules.
Go to Policies >> Security Rule
Select the rule for which the log forwarding needs to be applied. Apply the security profiles to the rule.
Go to Actions >> Log forwarding
Select the log forwarding profile from drop-down list.
Commit changes by selecting 'Commit' in the upper-right corner of the screen.
Select 'OK' when the confirmation dialog appears.

Item Details

Audit Name: DISA STIG Palo Alto IDPS v3r1

Category: AUDIT AND ACCOUNTABILITY

Plugin: Palo_Alto

Control ID: 2a38c0165c38f966ba48fee0f2cd4eaeac58c4f0aecfd975966bad7365143ee9

Detections

Analytics

PANW-IP-000058 - The Palo Alto Networks security platform must off-load log records to a centralized log server in real-time.

Information

Solution

See Also

Item Details