Forward Logs to an HTTPS Server

Forward Logs to an HTTPS Server

1. Sign In to the hub.
2. Select the Strata Logging Service instance that you want to configure for HTTPS forwarding.

   If you have multiple Strata Logging Service instances, click the Strata Logging Service tile and select an instance from the list of those available.

   If you are using Strata Cloud Manager to manage Strata Logging Service, click SettingsStrata Logging ServiceLog Forwarding to manage devices onboarded to your Strata Logging Service instance.
3. Select Log ForwardingAdd to add a new HTTPS forwarding profile.

   
4. Enter a descriptive Name for the profile.
5. Enter the URL that you copied in step

   13

   for the HTTPS receiver.

   The URL entered must begin with https. At the end of the top-level domain, you can specify a port number. The default port is 443.

   For Splunk HEC, ensure that the URL ends with /event.

   If you're forwarding logs to Google Chronicle, you must enter the URL that corresponds to your Strata Logging Service region:

   US	https://malachiteingestion-pa.googleapis.com/v2/unstructuredlogentries:batchCreate
   EU	https://europe-malachiteingestion-pa.googleapis.com/v2/unstructuredlogentries:batchCreate
   Asia	https://asia-southeast1-malachiteingestion-pa.googleapis.com/v2/unstructuredlogentries:batchCreate

   
6. (Optional) Authenticate your https server. Click + to upload a certificate. You can upload:

   • a self-signed certificate if you do not want to use a publicly signed certificate.
   • the private Root CA and intermediate CAs (If an intermediate CA exists). Do not upload the certificate issued for the syslog server—only CA certificates are needed to verify the chain from the syslog server.

   Only do this if you installed a private CA-signed, self-signed certificate on your receiver, or the public CA is not in the list of trusted CAs. The file containing the certificates must be in PEM format.

   
7. (Optional) Enable client authentication.

   Do this if company or regulatory policy requires client authentication when forwarding logs to your server.

   1. Download the certificate chain.
   2. Upload the certificate chain to your server.

      Refer to the documentation for your server management software to find out how to do this.
8. Configure Client Authorization.

   Do this if you're forwarding logs to a cloud HTTPS receiver, or if your HTTPS server requires a username and password.

   1. Select the Type of client authorization and enter the necessary credentials.

      HTTPS Receiver	Type	Credentials
      Splunk HEC	Splunk Authorization	HEC Token
      HTTPS Server (Password-protected)	Basic Authorization	Username Password
      Exabeam	Exabeam Authorization	Access Token
      Microsoft Sentinel	Sentinel Authorization	Workspace ID Primary Key Find your workspace ID and key
      Google Chronicle	Chronicle Authorization	Customer ID Service Account This should be a properly formatted JSON document. If you don’t know your Service Account credentials, contact Google Chronicle support.
      HTTPS Server	None	None
9. Acknowledge to reach out to your Palo Alto Networks team to enable log forwarding from Strata Logging Service in China to an external log server. Be aware that configuring log forwarding profiles to send logs to servers outside China can result in personally identifiable information leaving China.
10. Test Connection to ensure that Strata Logging Service can communicate with the receiver.

    This sends an empty log to the configured destination to verify that transmission is possible.

    If the test fails, you won't be able to proceed.
11. Click Next.
12. (Optional) To receive a STATUS NOTIFICATION when Strata Logging Service is unable to connect to the HTTPS receiver, enter the email address at which you’d like to receive the notification.

    You will continue to receive these notifications at least once every 60 minutes until the service restores connectivity. If the connectivity issue resolves within 72 hours, the service won't lose logs. However, the service could lose any log older than 72 hours following the service disconnection.
13. Enter a unique PROFILE TOKEN if your receiver needs to distinguish logs coming from different tenants.
14. Select the logs you want to forward.

    1. Add a new log filter.
    2. Select the log type.

       

       The Threat log type does not include URL logs or Data logs. If you wish to forward these log types, you must add them individually.
    3. (Optional) Create a log filter to forward only the logs that are most critical to you.
       You can either write your own queries from scratch or use the query builder. You can also select the query field to choose from among a set of common predefined queries.
       • No double quotes (“”).
       • No subnet masks. To return IP addresses with subnets, use the LIKE operator. Example: src_ip.value LIKE “192.1.1.%”.
       If you want to forward all logs of the type you selected, don't enter a query. Instead, proceed to the next step.
    4. Save your changes.
15. Save your changes.
16. Verify that the Status of your HTTPS forwarding profile is Running (

    

    ).

    Immediately after creating or editing your profile, the Status might be Provisioning for up to 10 minutes.
17. Verify that you can view logs on the HTTPS receiver.

    For Splunk Common Information Model (CIM) fields and Enterprise Security, follow the guide at https://splunk.paloaltonetworks.com to install the Palo Alto Networks Splunk add-on and create a Splunk HEC input.
18. (Optional) You can use the running HTTPS forwarding profile to forward past logs spanning up to 3 days.