Configuring Palo Alto Connector

Palo Alto Firewall Connector System Requirements

Ensure that the following requirements are met before configuring the connector:

1. A Linux or macOS machine with a static IP address.
2. RAM: 4 GB or more.
3. CPU: 2 vCPUs or more.
4. Disk space: 100 GB or more.
5. curl must be installed.

Configuring the Palo Alto Connector

1. Go to Connector > Ingestion.
2. Select Palo Alto Firewall Connector.
3. Click Configure.
4. For Enable Palo Alto Firewall Events?, select Yes.
5. Click Validate and Save.
6. Copy and save the generated token. You need this token when installing the ES Agent.

Installing the Palo Alto ES Agent

The Fleet URL depends on the stack on which the tenant is hosted.

Ensure that the prepared Linux or macOS machine meets the system requirements before installing the ES Agent.

1. Open a terminal on the Linux or macOS machine.
2. Replace <Token> with the token generated during connector configuration.
3. Run the following command:

sudo bash
mkdir PaloAlto_es_agent
cd PaloAlto_es_agent
curl -L -O https://artifacts.elastic.co/downloads/beats/elastic-agent/elastic-agent-8.17.9-linux-x86_64.tar.gz
tar xzvf elastic-agent-8.17.9-linux-x86_64.tar.gz
cd elastic-agent-8.17.9-linux-x86_64
sudo ./elastic-agent install --url=https://elk-next-fleet-1.seqrite.com:443 --insecure --enrollment-token=<Token>

Note: Use the appropriate Fleet URL based on the tenant's stack.

Configuring the Palo Alto Firewall

Before configuring the firewall, ensure that the Palo Alto ES Agent is up and running.

1. Log in to the Palo Alto firewall interface.

2. Go to Logs & Report > Log Settings.

3. Under Global Settings, enable the following logging options:

   • Address
   • Event
   • Local Traffic
   • Syslog

4. Enter the IP address of the Linux or macOS machine on which the ES Agent is installed.

5. Use UDP port 9001 for event log forwarding.

6. Click Apply.

After completing the configuration, alerts are automatically generated in the XDR portal. This indicates that the Palo Alto Firewall connector is configured successfully.

Uninstalling the Palo Alto ES Agent

After deleting the Palo Alto Firewall connector configuration from the XDR portal, uninstall the ES Agent from the Linux or macOS machine.

Run the following commands:

sudo elastic-agent uninstall
sudo rm -rf elastic-agent-8.17.9-linux-x86_64
sudo rm -f elastic-agent-8.17.9-linux-x86_64.tar.gz
sudo rm -rf /opt/Elastic/Agent
sudo rm -rf /etc/elastic-agent
sudo rm -rf /var/lib/elastic-agent
sudo rm -rf /var/log/elastic-agent