Palo Alto Create Policy to SIEM

[adem_netsys]

Hi,

I am going to create a rule on the Siem side about policies created and deleted in Palo alto. Is there a rule you have used or prepared before?

Thank you

[dbu]

I think there are no predefined rules for Palo Alto firewall. 

From the official guide i see that it can monitor "Configuration Change" for Palo Alto so basically every change, but not something specifically for policies.

https://help.fortinet.com/fsiem/5-2-6_ESCG_HTML/FortiSIEM/User-guide/Palo-Alto-Firewall-Configuratio...

[Richie_C]

Hi @adem_netsys 

You should start by checking out the event types available for Palo Alto (ADMIN > Device Support > Event Types). Find the relevant event type for you and make sure you are receiving the event.

Then you could simply clone a rule such as FortiGate: Admin User Deleted. Then replace the event type as required. For example:

be sure to also change the incident name under actions.

I hope it helps!

[adem_netsys]

Thank you @Richie_C 

I solved the issue.