Azure CloudNGFW By Palo Alto Networks connector for Microsoft Sentinel
Cloud Next-Generation Firewall by Palo Alto Networks - an Azure Native ISV Service - is Palo Alto Networks Next-Generation Firewall (NGFW) delivered as a cloud-native service on Azure. You can discover Cloud NGFW in the Azure Marketplace and consume it in your Azure Virtual Networks (VNet). With Cloud NGFW, you can access the core NGFW capabilities such as App-ID, URL filtering based technologies. It provides threat prevention and detection through cloud-delivered security services and threat prevention signatures. The connector allows you to easily connect your Cloud NGFW logs with Microsoft Sentinel, to view dashboards, create custom alerts, and improve investigation. This gives you more insight into your organization's network and improves your security operation capabilities. For more information, see the Cloud NGFW for Azure documentation.
This is autogenerated content. For changes, contact the solution provider.
Connector attributes
| Connector attribute | Description |
|---|---|
| Log Analytics table(s) | fluentbit_CL |
| Data collection rules support | Not currently supported |
| Supported by | Palo Alto Networks |
Query samples
List of connected Cloud NGFW resources
fluentbit_CL
| distinct FirewallName_s
Connectivity status of Cloud NGFW resources
fluentbit_CL
| extend TimeGenerated = todatetime(TimeGenerated)
| summarize LastLogReceived = max(TimeGenerated) by FirewallName_s
| extend Status = iff(now() - LastLogReceived > 24h, "Disconnected", "Connected")
| project FirewallName_s, LastLogReceived, Status
| order by Status desc, LastLogReceived desc
Total data received (MB)
fluentbit_CL
| extend bytes_received = toint(parse_json(Message).bytes_recv)
| summarize TotalBytesReceived = sum(bytes_received)
| extend TotalMBReceived = round(TotalBytesReceived / 1048576.0, 2)
| project TotalMBReceived
Top 5 apps
fluentbit_CL
| extend app = tostring(parse_json(Message).app)
| summarize Count = count() by app
| top 5 by Count desc
| project app, Count
Top 5 categories
fluentbit_CL
| extend category = tostring(parse_json(Message).category)
| summarize Count = count() by category
| top 5 by Count desc
| project category, Count
Top 5 rules
fluentbit_CL
| summarize Rule=count() by tostring(parse_json(Message).rule)
| top 5 by Rule desc
Top 5 source IPs
fluentbit_CL
| summarize SourceIP=count() by tostring(parse_json(Message).src_ip)
| top 5 by SourceIP desc
Top 5 destination IPs
fluentbit_CL
| summarize DestinationIP=count() by tostring(parse_json(Message).dst_ip)
| top 5 by DestinationIP desc
Vendor installation instructions
Connect Cloud NGFW by Palo Alto Networks to Microsoft Sentinel
Enable Log Settings on All Cloud NGFWs by Palo Alto Networks.
Inside your Cloud NGFW resource:
- Navigate to the Log Settings from the homepage.
- Ensure the Enable Log Settings checkbox is checked.
- From the Log Settings drop-down, choose the desired Log Analytics Workspace.
- Confirm your selections and configurations.
- Click Save to apply the settings.
Next steps
For more information, go to the related solution in the Azure Marketplace.