Sending Palo Alto logs to Splunk without the Splunk-For-Palo-Alto app or add-in

[BasicCrow]

Hello, I have a Palo Alto Firewall in my environment and would like to set it up to forward logs to a Splunk indexer which is also the syslog server. The environment is small and we are not allowed to log in to anything to download software, so using the App or Add-on isn't possible. Is there a way to directly send my Palo logs to the Splunk indexer?

[richgalloway]

First, Splunk indexers should not be used as syslog servers.  They will lose syslog data during restarts and cannot monitor port 514 (unless running as root, which is another no-no).  Instead, use a dedicated syslog receiver (syslog-ng or SC4S) and forward data from there to Splunk.

Second, Splunk apps are not software so they should not be subject to software download restrictions.  Splunk apps are (mostly) just bundles of config files.  Yes, some contain executable code (usually open Python), but you don't have to download those.

That said, you need neither app nor add-on to ingest PA Firewall data.  Open a TCP port on the indexer and point PA to that port.  Without an add-on, Splunk will guess at the how to process the data and may (probably will) guess incorrectly.  You likely will need to define props.conf settings that tell Splunk the best way to onboard events from PA.

[BasicCrow]

Unfortunately, the environment we have forces us to run things a little messy. We don't have a box to use as a syslog server, and as such must run as root. Also, the download restriction is more on logging in than what is being downloaded. We are not allowed to log in to anything other than the devices in the environment. Do you know of any documentation on good props.conf settings to use?

[richgalloway]

Documentation for props.conf is in props.conf.spec.  Documentation of props for Palo Alto is in the add-on.  I've attached props.conf from the TA for your reference.