There are no Advanced Threat Prevention log events in a company's SIEM instance. However, the systems administrator has confirmed that the Advanced Threat Prevention subscription is licensed and…

Question

Options

• AEnable the company's Threat Prevention license.
• BCheck with the SIEM vendor to verify that Advanced Threat Prevention logs are reaching the
• CHave the SIEM vendor troubleshoot its software.
• DEnsure the Security policy rules that use Advanced Threat Prevention are set for log forwarding to

• A
  3% (1)
• B
  11% (4)
• C
  3% (1)
• D
  84% (32)

Explanation

Understanding the Problem: The issue is that Advanced Threat Prevention (ATP) logs are visible on the firewall but are not being ingested into the company's SIEM. This implies that the ATP subscription is working and generating logs on the firewall but the logs are not being forwarded properly to the SIEM. Action to Resolve: Log Forwarding Configuration: Verify that the Security policy rules configured to inspect traffic using Advanced Threat Prevention are set to forward logs to the SIEM instance. This is a common oversight. Even if the logs are generated locally, they will not be forwarded unless explicitly configured. Configuration steps to verify in the Palo Alto Networks firewall: Go to Policies > Security Policies and check the "Log Forwarding" profile applied. Ensure the "Log Forwarding" profile includes the correct settings to forward Threat Logs to the Go to Device > Log Settings and ensure the firewall is set to forward Threat logs to the desired Syslog or SIEM destination.

No community discussion yet for this question.