Request Clarification: Palo Alto source integration

[Aravind3]

Hello Everyone,

While integrating Palo Alto with Chronicle, I found a document from Palo Alto which states that the endpoint URL should be set as "https://malachiteingestion-pa.googleapis.com/v2/unstructuredlogentries:batchCreate" or according to region. My question is, by doing this, how do we specify the Log type? How will Chronicle identify that this is intended for Palo Alto Prisma Access logs or any other log type?

Reference: https://docs.paloaltonetworks.com/strata-logging-service/administration/forward-logs/forward-logs-to...

Thanks in advance.

Aravind Sreekumar

[Rene_Figueroa · Accepted solution]

Hi @Aravind3 the Palo Alto integration sets the log type. I think this integration sets the log type as ARCSIGHT_CEF and therefore the logs are parsed by our ARCSIGHT_CEF parser. If you want to double check the log source, you can follow up with Palo Alto directly. 

[Aravind3]

Hi @Rene_Figueroa,
Thanks a bunch

[Aravind3]

Hi @Rene_Figueroa ,
Is there an official google doc available for Proofpoint OnDemand integration?

[Rene_Figueroa]

Hi @Aravind3 we have the following PoD info on our public docs:

https://cloud.google.com/chronicle/docs/reference/feed-management-api#proofpoint-on-demand

[Aravind3]

Thanks a bunch @Rene_Figueroa 

[vpehlivanov]

Using the same Palo Alto integration I get an error at the very last step. It complains that "region is required". Has anyone seen that error before?

[ionutm]

We haven't seen this error on other instances. If this happens again please go through support so we can further investigate.