Prisma SD-WAN

Prerequisites

The Prisma SD-WAN ION devices must be configured to send logs to LogZilla for these rules to work properly.

Configure Syslog Export for Events and Authentication

1. Navigate to Configure > Network & Security > Syslog
2. Click Add to create a new syslog server profile
3. Enter your LogZilla server details:
   • Server: LogZilla server IP address
   • Port: 514 (UDP) or 1514 (TCP)
   • Facility: daemon
   • Severity: info or higher
4. Enable the following log types:
   • Events: System events and alarms
   • Authentication: User login/logout events
5. Save and commit the configuration

Configure Flow Export (Optional)

For network flow analysis, configure IPFIX or Syslog flow export:

1. Navigate to Configure > Network & Security > Flow Export
2. Select Syslog Flow Export for LogZilla compatibility
3. Configure the export settings:
   • Destination: LogZilla server IP
   • Port: 514
   • Format: RFC 5424 with CSV body
4. Enable flow export on desired interfaces
5. Save and commit the configuration

Expected Log Formats

The app processes three types of Prisma SD-WAN logs:

Event Logs:

text
Wrap: OnCopyFullscreen
CLOUDGENIX_HOST="ion7k-Hub" DEVICE_TIME="2018-02-14T10:36:49.000" STATUS="Not cleared" CODE="DEVICESW_GENERAL_PROCESSRESTART" SEVERITY="minor" PROCESS_NAME="event_forward" ELEMENT_ID="15174644824510129"

Authentication Logs:

text
Wrap: OnCopyFullscreen
CLOUDGENIX_HOST="ion7k-Hub" DEVICE_TIME="2018-02-14T10:44:58.881Z" MSG="sshd-login keyboard-interactive/pam" SEVERITY="minor" PROCESS_NAME="sshd" FACILITY="auth" USER="elem-admin" ELEMENT_ID="15174644824510129"

Flow Logs:

text
Wrap: OnCopyFullscreen
<13>1 2020-01-28T23:46:17.000035+00:00 T1S3_SPOKE1 cgxFlowLogV1 13593 - - 2020-01-28T23:46:17,10.2.53.102,52520,10.2.13.100,80,tcp,,,15,23,1024,2048,,LondonPriWI1,15796434157670062,enterprise-http,New Flow,Allow-All:allow:1