- This topic has 0 replies, 1 voice, and was last updated 6 years, 4 months ago by
.
Viewing 1 post (of 1 total)
- Posts
Follow these directions from Palo Alto to enable NetFlow:
Wait at least 10 minutes then on the WitFoo Search interface, run a search on an IP address that should have been monitored by the NetFlow exporter. It should show up in the communications tab.
To enable syslog, follow these instructions: https://live.paloaltonetworks.com/t5/Configuration-Articles/How-to-Forward-Threat-Logs-to-Syslog-Server/ta-p/59980
For best results, configure output to WitFoo Precinct in CEF Format: https://docs.paloaltonetworks.com/content/dam/techdocs/en_US/pdf/cef/pan-os-80-cef-configuration-guide.pdf
Flip back over to the WitFoo “Search” interface and search for the IP address of the PAN server. An entry should be listed on the Syslog tab.
Viewing 1 post (of 1 total)
- You must be logged in to reply to this topic.