Ingest Traps ESM Logs on Panorama

Define the log ingestion profile on Panorama and attach it to a Collector Group.
Panorama virtual appliance in legacy mode cannot ingest Traps logs.
Select
Panorama
Log Ingestion Profile
, and click
Add
.
Enter a
Name
for the profile.
Click
Add
and enter the details for the ESM Server. You can add up to four ESM Servers to a profile.
Enter a
Source Name
.
Specify the
Port
on which Panorama will be listening for syslog messages. The range is 23000 to 23999.
Select the
Transport
layer protocol—TCP, UDP, or SSL.
Select Traps_ESM for
External Log type
and 3.4.0 from the
Version
drop-down.
As Traps log formats are updated, the updated log definitions will be available through content updates on Panorama.
Select
Panorama
Collector Groups
Log Ingestion
and
Add
the log ingestion profile so that the Collector Group can receive logs from the ESM Server(s) listed in the profile.
If you are enabling SSL for secure syslog communication between Panorama and the ESM Server(s), you must attach a certificate to the Managed Collectors that belong to the Collector Group (
Panorama
Managed Collectors
General
, and select the certificate to use for
Inbound Certificate for Secure Syslog
).
Commit
changes to Panorama and the Collector Group.
Configure Panorama as a Syslog receiver on the ESM Server.
From the ESM Console, select
Settings
ESM
Syslog
, and
Enable Syslog
.
Enter Panorama hostname or IP address as the
Syslog Server
and the
Syslog Port
on which Panorama is listening.
Select the Transport layer protocol: TCP, TCP with SSL, or UDP. If you select TCP with SSL, the ESM Server requires a server certificate to enable client authentication.
From Panorama, you must export the root CA certificate for the Inbound Certificate for Secure Syslog, and import the certificate in to the trusted root certificate store of the host on which you have installed the ESM Server.
In the Logging Events area, select one or more of the events. At a minimum, you must enable sending of security events for prevention, notification, and provisional incidents that the Traps agents report. For details on the other forwarding settings, refer to the Traps 3.4 Administrator’s Guide.
View ESM logs and correlated events.
Select
Monitor
External Logs
Traps ESM
to view the logs ingested in to Panorama.

Select
Monitor
Automated Correlation Engine
Correlated Events
, and filter on the
Wildfire and Traps ESM Correlated C2
correlation object name to find correlated events. Panorama generates correlated events when a host on your network exhibits command and control activity that matches the behavior observed for a malicious file in the WildFire virtual environment. This correlated event alerts you to suspicious activity that a Traps agent and the firewall have observed from one or more infected hosts on your network.