Logpresso Store

Install Guide

Overview

This section describes how to integrate Logpresso Sonar with Palo Alto Networks NGFW. The Palo Alto Networks NGFW app collects traffic, threat, system, and configuration change logs from PAN-OS firewalls via Syslog or the PAN-OS XML API. It also supports DAG (Dynamic Address Group) based IP blocking, so threat IPs detected by Logpresso Sonar can be automatically registered to and released from the firewall.

Scope

Note

Works with Sonar 4.0.2502.0 or later and PAN-OS 10.x or later. This feature was developed and tested on PA-820 10.2.2.
The maximum number of IPs that can be registered to an address group varies by model. See the Palo Alto Networks product comparison page for details.

Caution

Starting with version 1.8.2610.0, the API logger uses a connect profile instead of taking the hostname and API key directly. After installing this version, API loggers added in earlier versions may stop working. Add a connect profile, then edit each logger to specify the connect profile. Syslog loggers are not affected.

Requirements

Item	Requirement	Note
Device permissions	Permission to change Syslog forwarding settings and to generate API keys	Configuration fails without these permissions
Network access	HTTPS/443 (Sonar → NGFW, Outbound)	Required for API collection or IP blocking
Logpresso app	Palo Alto Networks NGFW app installed

Palo Alto Networks NGFW Setup

Note

In the Palo Alto Networks NGFW console, complete the prerequisites for API collection, firewall query commands, and IP blocking.

Step 1: Generate an API Key

Generate the API key required for IP blocking and API collection. Run the curl command against the firewall management IP.

curl -k -X GET 'https://<firewall>/api/?type=keygen&user=<username>&password=<password>'

On success, the API key is in the <key> element of the XML response.

<response status="success">
  <result>
    <key>xxx...</key>
  </result>
</response>

Caution

Regenerating the API key terminates all sessions connected with the previous key. If a connect profile is in use, update it after changing the key.

Step 2: Create a DAG (Dynamic Address Group)

A Dynamic Address Group is required for IPs registered by the IP blocking integration to take effect in firewall policies.

Go to Objects > Address Groups, click Add, and enter the values below.

Item	Setting
Name	Group name (e.g. block_logpresso)
Type	Select Dynamic
Match	Tag match condition (e.g. 'blocked')

Always wrap the Match value in single quotes.
Multiple tags: 'blocked' or 'malicious'
AND condition: 'blocked' and 'high-risk'

Tip

You do not need to create tags in advance. Tags are created automatically when IPs are registered via the API.

Step 3: Create Tag Objects (Optional, Recommended)

Go to Objects > Tags, click Add, and enter the values below.

Item	Setting
Name	Tag name (e.g. `blocked`). Same as the DAG Match condition
Color	Color for visual distinction
Comments	Purpose (e.g. `ip blocked by logpresso`)

Creating tags in advance lets you distinguish them by color when monitoring.

Step 4: Create a Security Policy (Block Rule)

Add a security policy that actually blocks the IPs registered in the DAG.

Go to Policies > Security, click Add, and configure each tab.

General tab:

Item	Setting
Name	Rule name (e.g. `deny_block_src_logpresso`)
Rule Type	`universal`

Source tab:

Specify the DAG in Source or Destination depending on the blocking direction.

Item	Setting
Source Zone	Target zone (e.g. `Any`)
Source Address	Select the DAG created above (e.g. `block_logpresso`)

Actions tab:

Item	Setting
Action	`Deny` (or `Drop`, `Reset-both`)

Tip

For inbound blocking (external → internal), specify the DAG in Source Address. For outbound blocking (internal → external), specify it in Destination Address. To block both directions, create two rules or specify the DAG on both sides.

Step 5: Check Rule Order

The block rule must be placed above the allow rules. Drag it in the Security Policy list or use the Move button to move it up. If an existing Allow rule matches first, blocking does not work.

Step 6: Commit

Click Commit at the top right to apply the configuration.

Note

Commit is required only for the initial DAG and Security Policy setup. After that, IP registration and release via the API take effect immediately without a commit.

Logpresso Setup

Add a Connect Profile

Go to System > Connect Profiles, click Add, and enter the values below.

Type	Item	Setting
Required	Name	Unique name of the connect profile
Required	Identifier	Unique identifier used in Logpresso queries (e.g. `paloalto_ngfw`)
Required	Type	Select `Palo Alto Networks NGFW`
Required	Hostname	Domain or IP address of the firewall (e.g. `192.0.2.1`)
Required	API Key	API key generated in NGFW Setup Step 1
Optional	HTTP Proxy	`IP:PORT` format. Set when the connection must go through a proxy

Add a Syslog Logger

To collect logs from Syslog sent by the firewall, add a logger. The Syslog logger does not use a connect profile.

Go to System > Loggers, click Add, and enter the values below.

Type	Item	Setting
Required	Name	Unique name of the logger
Required	Storage	Select the node to store logs
Required	Logger Model	Select `Palo Alto Networks NGFW (Syslog)`
Required	Table	Table name starting with `FW_PALOALTO`
Optional	Remote IP	IP address of the firewall sending Syslog (e.g. `192.0.2.1`)
Optional	Port	Receiving port filter. Receives on all ports if not set (e.g. `514`)

Note

The default dashboards and datasets reference tables whose names start with FW_PALOALTO.

Add an API Logger

To collect traffic and threat logs via the PAN-OS XML API instead of Syslog, add a logger. The logger connects to the firewall with the hostname, API key, and HTTP proxy of the connect profile registered above.

Go to System > Loggers, click Add, and enter the values below.

Type	Item	Setting
Required	Name	Unique name of the logger
Required	Run Mode	Select `Interval`
Required	Interval	Collection interval in seconds. Default `5`
Required	Storage	Select the node to store logs
Optional	Collector	Select the sentry that performs collection
Required	Logger Model	Select `Palo Alto Networks NGFW (API)`
Required	Table	Table name starting with `FW_PALOALTO`
Required	Connect profile	Identifier of the connect profile registered above (e.g. `paloalto_ngfw`)
Optional	Start time	`yyyy-MM-dd HH:mm:ss` format. Collects from an hour ago if not set

Add an IP Blocking Integration

Go to System > Response Integrations, click Add, and enter the values below.

Type	Item	Setting
Required	Name	Unique name of the IP blocking integration
Required	Response Model	Select `Palo Alto Networks NGFW`
Required	Connect Profile	Select the profile registered in the step above
Required	Address Group	Select or create the address group that manages blocked IPs
Required	DAG Tag Name	Tag name used for dynamic address group blocking (e.g. `blocked`)

Note

The DAG tag name must match the tag used in the DAG Match condition in NGFW Setup Step 2.

Post-Installation Verification

Run the query below to check that collection is working. Both Syslog and API loggers store logs in tables starting with FW_PALOALTO.

table duration=10m FW_PALOALTO*
| stats count by type

Normal: One or more records are returned per log type (TRAFFIC, THREAT, etc.). The API logger collects only TRAFFIC and THREAT.
Abnormal (Syslog): If the count is 0, check the firewall's Syslog forwarding settings and the logger's Remote IP and Port.
Abnormal (API): If the count is 0, check the error message in the logger status, the hostname and API key of the connect profile, and network reachability (HTTPS/443).

To verify firewall blocking, register a test IP with the commands below and check it on the NGFW.

paloalto-ngfw-add-dynamic-address profile=paloalto_ngfw tag=blocked ip=192.0.2.1

paloalto-ngfw-dynamic-addresses profile=paloalto_ngfw tag=blocked

On the NGFW console, go to Objects > Address Groups, select the DAG, and click the more... link to see the registered IPs. You can also check them on the CLI with the command below.

show object registered-ip tag "blocked"

When verification is complete, release the test IP.

paloalto-ngfw-remove-dynamic-address profile=paloalto_ngfw tag=blocked ip=192.0.2.1

Overview

Scope

Requirements

Palo Alto Networks NGFW Setup

Step 1: Generate an API Key

Step 2: Create a DAG (Dynamic Address Group)

Step 3: Create Tag Objects (Optional, Recommended)

Step 4: Create a Security Policy (Block Rule)

Step 5: Check Rule Order

Step 6: Commit

Logpresso Setup

Add a Connect Profile

Add a Syslog Logger

Add an API Logger

Add an IP Blocking Integration

Post-Installation Verification

References