Inventory
Table of Contents
Expand all | Collapse all
-
- Cortex Data Lake for Panorama-Managed Firewalls
- Start Sending Logs to a New Cortex Data Lake Instance
- Configure Panorama in High Availability for Cortex Data Lake
- Allocate Storage Based on Log Type
- View Cortex Data Lake Status
- View Logs in Cortex Data Lake
- TCP Ports and FQDNs Required for Cortex Data Lake
- Sizing for Cortex Data Lake Storage
-
- Forward Logs from Cortex Data Lake to a Syslog Server
- Forward Logs from Cortex Data Lake to an HTTPS Server
- Forward Logs from Cortex Data Lake to an Email Server
- Log Record Formats
- Create Log Filters
- Server Certificate Validation
- List of Trusted Certificates for Syslog and HTTPS Forwarding
- Log Forwarding Errors
Inventory
Manage the devices connected to
Cortex
Data Lake
from
the Inventory tab.From the
Inventory
page, you can view a list of devices and
tenants onboarded to your Cortex
Data Lake
instance.
Panorama Appliances
This list does not show the mapping of a Panorama to its managed firewalls.
Generate OTP
to create the one-time password used to onboard Panorama-managed firewalls to your
Cortex
Data Lake
instance.Add
a Panorama appliance to onboard
a new appliance to your Cortex
Data Lake
instance or move an appliance from one instance to
another.Panorama uses this OTP to install the logging service certificate. For Panorama
10.1 or later, go to the Customer Support Portal to get the OTP for installing
the device certificate.
Name | The name under which the Customer Support Portal
registered the Panorama. If unnamed, then the name appears as
Panorama . |
Model | The model of the Panorama |
Serial Number | The unique serial number of the Panorama |
PAN-OS Version | The version of PAN-OS that the Panorama is
running |
Last Contact Time | The last time that the Panorama communicated with
Cortex
Data Lake , either to query logs or
fetch reports |
Certificate Status | Whether the Panorama has the certificate necessary to
connect to Cortex
Data Lake . Hover over the
certificate status to see which certificate the Panorama is using to
connect to Cortex
Data Lake : logging service
certificate or device certificate.
You can only have one Panorama (or high availability pair)
associated with your instance at a time. |
Firewalls
Check
only show firewalls that are storing logs
to hide the
firewalls that send data to Cortex
Data Lake
only for ingestion
and further streaming to other Palo Alto Networks applications.Generate PSK
to create the pre-shared key used to onboard a
firewall running PAN-OS 10.0 or earlier to your Cortex
Data Lake
instance.Add
a firewall to onboard a new firewall to your Cortex
Data Lake
instance or move a firewall from one instance to
another.Above the firewalls table, you can see the number of firewalls with each connection status.
Select the chart icon (
) on any table row to view a
chart of the incoming log rate and connectivity history for the firewall:


Name | The name under which the Customer Support Portal
registered the Panorama. If unnamed, then the name appears as
Panorama . |
Model | The model of the firewall |
Serial Number | The unique serial number of the firewall |
PAN-OS Version | The version of PAN-OS that the firewall is
running |
Managed By Panorama | Whether a Panorama manages the firewall or
not |
Connection Status | Whether the firewall can connect to Cortex
Data Lake . This can have four different
values:
|
Ingestion Rate | The rate, in logs per second, at which the firewall is sending
logs to Cortex
Data Lake |
Storage Used | The amount of your Cortex
Data Lake storage
capacity that a firewall is using at this point in time |
Apps Using Log Data | All apps that consume data from the firewall |
Store Log Data | Choose whether Cortex
Data Lake
stores firewall data or only ingests it.
After you toggle On , Cortex
Data Lake can take up to 15 minutes to start
storing log data for the firewall.If toggled
On and grayed out, this switch means
that the IoT Security package to which you subscribe requires
that you store log data.You can set log retention
policy for your entire Cortex
Data Lake instance from Storage Configuration |
Last Contact Time | The last time that the device communicated with
Cortex
Data Lake , either to send logs or to
report telemetry |
Certificate Status | Whether the firewall has the certificate necessary to
connect to Cortex
Data Lake . Hover over the
certificate status to see which certificate the Panorama is using to
connect to Cortex
Data Lake : logging service
certificate or device certificate
|
Cloud NGFW
View Cloud NGFW resources associated with your
Cortex
Data Lake
instance.
ID | The ID of the Cloud NGFW resource. |
Ingestion Rate | The rate, in logs per second, at which Cortex
Data Lake is ingesting logs from a Cloud
NGFW resource. This is a sum across all devices with the same
resource ID. |
Storage Used | The amount of your Cortex
Data Lake storage
capacity that the Cloud NGFW resource is using. This is a sum
across all devices with the same resource ID. |
Last Contact Time | The last time that the Cloud NGFW resource
communicated with Cortex
Data Lake |
Prisma Access
Prisma Access
View the
Prisma Access
instances associated with your Cortex
Data Lake
instance.Instance Name | The name under which the Customer Support Portal
registered the Prisma Access instance. If unnamed, then the
name appears as Prisma Access |
Ingestion Rate | The rate, in logs per second, at which Prisma Access is
sending logs to Cortex
Data Lake |
Storage Used | The amount of your Cortex
Data Lake storage
capacity that the Prisma Access instance is using at
this point in time. |
Last Contact Time | The last time that the Prisma Access
instance communicated with Cortex
Data Lake |