>
    Strata Copilot
    Log Forwarding from Strata Logging Service
    Focus
    Download PDF
    Focus
    1. Home
    2. Strata Logging Service
    3. Strata Logging Service Administration
    4. Log Forwarding from Strata Logging Service
    Download PDF
    Strata Logging Service

    Log Forwarding from Strata Logging Service

    Table of Contents

    Log Forwarding from Strata Logging Service

    Strata Logging Service supports log forwarding to SIEM systems and cloud storage destinations such as AWS S3 and Amazon Security Lake.
    Where Can I Use This?What Do I Need?
    One of these:
    To meet your organization's legal compliance requirements and operational needs, Strata Logging Service supports forwarding firewall logs to external destinations. You can forward logs to SIEMs for long-term storage, security operations center (SOC) analysis, and internal audit obligations, or to cloud storage destinations for scalable log retention.

    Log Forwarding Destinations

    Supported SIEM and Receiver Destinations
    You can send logs directly to the following SIEM solutions or to standardized receiving endpoints:
    • (Recommended)Microsoft Sentinel: Use native integration setup using Azure services to ingest Palo Alto Networks logs directly into Microsoft Sentinel SIEM.
    • Syslog Server: Forward logs via RFC 5425-compliant encrypted syslog. This is the primary method for sending logs to on-premises or cloud SIEMs such as Splunk and Exabeam.
    • HTTPS Server: Stream logs over HTTPS POST payloads, typically used for Splunk HTTP Event Collector (HEC) and Google Chronicle.
    • Email Server: Configure automated email alerts for high-priority or critical security events.
    Cloud Storage
    You can also forward logs to the following cloud storage destinations:
    When forwarding logs, Strata Logging Service ensures accuracy by using unique identifiers and preserving long values, which are important for identifying log records.
    If you use a third-party log streaming solution as an intermediary to forward logs from Strata Logging Service, the volume of received logs can vary depending on the log processing mechanism used by the third-party solution, including how the solution handles long identifiers. Strata Logging Service is tested and calibrated against the specific endpoints listed above. Therefore, we can't guarantee support for logs processed through unsupported intermediate streaming solutions. We recommend directly connecting to a supported endpoint or verifying compatibility when using an intermediary aggregator.

    Supported Formats for Log Forwarding

    Strata Logging Service can forward logs in multiple formats: CSV, LEEF, CEF, JSON, or PARQUET. Use the following table to find more information about supported log formats.
    Log FormatWhere to find more information about the logs:IETF StandardDefault Field Delimiter
    CSVLog Forwarding Schema ReferenceRFC 5425,
    LEEF RFC 5425<tab>
    CEF RFC 5425<space>

    Secure Log Forwarding

    Strata Logging Service ensures secure communication with log receivers through the following mechanisms:
    • TLS 1.2 Encryption: All communications are encrypted using TLS 1.2, ensuring data security during transmission.
    • Java 8 default cipher suites: The service uses Java 8 default cipher suites. Support for GCM ciphers is limited and not available for all tenants.
    • Certificate Validation: To establish a secure connection, the Strata Logging Service requires that the log receiver provides a valid certificate.
      • Trusted Certification: The receiver's certificate must be signed by a trusted root CA or a private CA.
      • Chain of Trust: The receiver must present all certificates in the chain of trust to successfully complete the TLS handshake and establish the connection.

    © 2026 Palo Alto Networks, Inc. All rights reserved.