FortiAnalyzer third-party log parser

another question

Can a playbook be triggered based on PA logs?

Hi,

To get normalized fields, yes you need to configure the Log Parser:

1. Go to System Settings → Advanced → Log Forwarding (or in some builds: Device Manager → Add Device → add as "Syslog" or "Generic" device, then configure a parser)
2. In newer FAZ versions (7.x/8.x), the relevant section is usually:
   System Settings → Log Parser (or Device Log Settings → Custom Parser)
3. You'll create a custom log parsing profile where you:
   • Define the field mapping (regex or delimiter-based) to extract Palo Alto's syslog fields
   • Map them to FortiAnalyzer's normalized field names (srcip, dstip, srcport, dstport, action, policyid, etc.)
4. Apply that parser to the device entry representing your Palo Alto firewall in FAZ.