All Apps and Add-ons

Configuring Data Inputs for PAN Add-on in Splunk Cloud,Configuring the add-on for Splunk Cloud

hashicorpjf
New Member

Hey there! The documentation for configuring the PAN Add-on (found at splunk.paloaltonetworks.com) mentions that TCP/UDP data sources must be configured to get data out of our PAN firewalls; however, Splunk support informed me that this isn't possible due to security restrictions on Splunk Cloud instances. However, without these data sources, I'm not really sure how else to get data into our Splunk Cloud environment (they've mentioned that we can use an HTTP event collector, but the documentation doesn't say much on how to do that).

Has anyone else successfully connected their PAN firewalls/WIldfire to Splunk Cloud, and if so, would you be willing to advise me on how to do so?

Thanks!!,

0 Karma

woodcock
Esteemed Legend

It is simple. Stand up a syslog-ng server inside of your data center alongside the PANs and send the data to syslog-ng and have it either send to Splunk Cloud HEC or write to file and use a traditional UF:
http://www.georgestarcher.com/splunk-success-with-syslog/
https://www.splunk.com/blog/2017/03/30/syslog-ng-and-hec-scalable-aggregated-data-collection-in-splu...
If you need help, DM me; we do this all the time.

0 Karma
Get Updates on the Splunk Community!

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...