> For the complete documentation index, see [llms.txt](https://cortex-docs.paloaltonetworks.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://cortex-docs.paloaltonetworks.com/cortex-xdr-3.x/cortex-xdr-3.x-documentation/data-management/data-ingestion/palo-alto-networks-integrations/ingest-data-from-next-generation-firewall.md). # Ingest data from Next-Generation Firewall {% hint style="info" %} ### Notice Ingestion of logs and data requires a Cortex XDR Pro per GB license. {% endhint %} You can forward firewall data from your Next-Generation Firewall (NGFW) and Panorama devices to Cortex XDR. Collection of firewall data from multiple accounts is supported. Super User permissions on both the Cortex XDR tenant accounts and the NGFW or Panorama accounts are required for this use case. This is only supported for users logged in via the Customer Support Portal (CSP) and not SSO. New tenants (and tenants upgraded from XDR to XSIAM) will work with the new direct integration of Next-Generation Firewall and Panorama into Cortex. For such tenants, there’s no option to use the Strata Logging Service integration. For tenants where customers have integrated directly with Strata Logging Service, the configured integrations, such as Next-Generation Firewall and Prisma Access, can be migrated to Cortex XDR in either of the following ways before the license expires: * More than two weeks before the license for existing integrations with Strata Logging Service expires, manually migrate the integrations, using the corresponding **Migrate Devices** buttons on the **Collection Integrations** page. Make sure you select all your devices to connect directly to Cortex XDR. * Two weeks prior to the end of your Strata Logging Service license, Cortex XDR will automatically migrate your integrations to your Strata Logging Service.

Note

Roll-back of Strata Logging Service integration migration is not supported.

{% hint style="warning" %} ### Prerequisite Ensure that you have completed the following on the NGFW or Panorama side: * For Panorama only, ensure that the Panorama Cloud Services plugin is installed. * Enable log forwarding profiles on firewall rules. On the Cortex XDR side, ensure that you have user role permissions for **Data Collection > Log Collections**. Configuration of data ingestion from multiple accounts requires Super User permissions on both the Cortex XDR tenant and on the device accounts. **Note**: Cross CSP (Customer Support Portal) is supported only within the same SFDC hierarchy. Consequently, MSSP use cases where the customer owns one end of the solution are not supported. {% endhint %} {% hint style="info" %} ### Note If your firewalls are located in a different region, or bandwidth issues are encountered due to large log size, you can ingest NGFW logs in CEF format, using the Syslog collector. However, the Syslog solution is not as powerful nor as comprehensive as this data collector, and should only be used when this data collector cannot be used. For more information, see [Ingest Next-Generation Firewall logs using the Syslog collector](/cortex-xdr-3.x/cortex-xdr-3.x-documentation/data-management/data-ingestion/palo-alto-networks-integrations/ingest-data-from-next-generation-firewall/ingest-next-generation-firewall-logs-using-the-syslog-collector.md). {% endhint %} {% hint style="info" %} ### Note In the following procedure, general information is provided for NGFW and Panorama. For detailed instructions, consult the documentation for your specific devices and Panorama version. {% endhint %} **Set up detection data ingestion** 1. In Cortex XDR, select **Settings** → **Configurations** → **Data Collection** → **Collection Integrations**. 2. On the **Collection Integrations** page, locate your NGFW data source and select **Add Instance** to begin a new connection. 3. Select **Add NGFW Device** or **Add Panorama Device**, and then do one of the following: * For devices in your account, select one or more devices from **Select FW/Panorama devices**. * To include devices from other accounts, select **Select devices from other accounts**, and then select one or more FW or Panorama devices from other accounts. For cross-account connections, you must have Super User permissions on the Cortex tenant account and the device account.

Important

This cross-account support is limited to the same SFDC hierarchy; it does not extend to MSSP scenarios where the customer and provider own separate ends of the solution.

Devices already connected are listed at the end. A device may be connected via Strata Logging Service, or via Cortex XDR. Rectify any streaming issues that may arise by checking configurations for the relevant connection type (Strata Logging Service or Cortex XDR). 4. To complete the onboarding process of your devices, on the **Next Steps to Connect Your Devices** page, expand the relevant device version, and follow the corresponding instructions. 5. Click **Connect** to establish the instance. Connection is established regardless of the firewall credential status and can take up to several minutes, select **Sync now** to refresh your instances. 6. Ensure that you pull your cloud logging licenses on the firewall before proceeding to configure the firewall. 7. In the user interface for setting up firewalls, for Strata Logging Service/Cloud Logging, enable the following options directly, or using device templates. (For example, go to **Device** → **Setup** → **Management** → **Cloud Logging** section) 1. Select **Enable Strata Logging Service**. 2. Select **Enable Enhanced Application Logging**. 3. (Optional, depending on your organization's requirements) Select **Enable Duplicate Logging (Cloud and On-Premise)**. 8. Depending on your PAN-OS or Panorama version, generate either a certificate or PSK. For PAN-OS and Panorama versions 10.1 and later, each firewall requires a separate certificate. Certificates need to be requested through the Customer Support portal. To sign in to the portal, click [here](https://support.paloaltonetworks.com/Support/Index). For PAN-OS and Panorama versions 10.0 and earlier, you are only required to generate one global PSK for all the firewall devices.

Note

Cortex XDR does not validate your firewall credentials, you must ensure the certificates or PSK details have been updated in your firewalls in order for data to stream.

9. Onboard the certificates. 10. Define a Log Forwarding profile. 11. Map the Log Forwarding profile to a Security Policy Rule. 12. Verify that the connection between the firewalls and Strata Logging Service is valid. 13. Push the configuration changes to the firewalls. 14. Validate that your data is streaming. It might be necessary to create traffic before you verify data streaming. To ensure the data is streaming into your tenant: * In your NGFW Standalone Firewall Devices, track the **Last communication** timestamp. * Run XQL Query: **dataset = panw\_ngfw\_system\_raw| filter log\_source\_id = "\[NGFW device SN]"** 15. (Optional) Manage your Instance. After you create the NGFW instance, on the **Collection Integrations** page, expand the NGFW to track the status of your **Standalone Firewall Devices** and **Panorama Devices**. Select the ellipses to **Request Certificate**, if required, or **Delete** the instance. {% hint style="info" %} ### Note It might take an hour or longer after connecting the firewall in Cortex XDR until you start seeing notifications that the certificate has been approved, and that the logging service license has appeared on the firewall. {% endhint %} When Cortex XDR begins receiving detection data, the console begins stitching logs with other Palo Alto Network-generated logs to form stories. Use the XQL Search dataset `panw_ngfw_*_raw` to query your data, where the following logs are supported: * [Authentication Logs](https://docs.paloaltonetworks.com/cortex/cortex-data-lake/log-forwarding-schema-reference/network-logs/network-authentication-log.html): panw\_ngfw\_auth\_raw * [File Data Logs](https://docs.paloaltonetworks.com/strata-logging-service/log-reference/network-logs/network-file-log): panw\_ngfw\_filedata\_raw * [Global Protect Logs](https://docs.paloaltonetworks.com/cortex/cortex-data-lake/log-forwarding-schema-reference/network-logs/network-globalprotect-log.html): panw\_ngfw\_globalprotect\_raw * [Hipmatch Logs](https://docs.paloaltonetworks.com/cortex/cortex-data-lake/log-forwarding-schema-reference/network-logs/network-hip-match-log.html): panw\_ngfw\_hipmatch\_raw\* * [System Logs](https://docs.paloaltonetworks.com/cortex/cortex-data-lake/log-forwarding-schema-reference/common-logs/common-system-log.html): panw\_ngfw\_system\_raw * [Threat Logs](https://docs.paloaltonetworks.com/cortex/cortex-data-lake/log-forwarding-schema-reference/network-logs/network-threat-log.html): panw\_ngfw\_threat\_raw\* * [Traffic Logs](https://docs.paloaltonetworks.com/cortex/cortex-data-lake/log-forwarding-schema-reference/network-logs/network-traffic-log.html): panw\_ngfw\_traffic\_raw\* * [URL Logs](https://docs.paloaltonetworks.com/cortex/cortex-data-lake/log-forwarding-schema-reference/network-logs/network-url-log.html): panw\_ngfw\_url\_raw\* * [User ID Logs](https://docs.paloaltonetworks.com/cortex/cortex-data-lake/log-forwarding-schema-reference/network-logs/network-userid-log.html): panw\_ngfw\_userid\_raw * [Tunnel Logs](https://docs.paloaltonetworks.com/strata-logging-service/log-reference/network-logs/network-tunnel-log): panw\_ngfw\_tunnel\_raw * [Configuration Logs](https://docs.paloaltonetworks.com/strata-logging-service/log-reference/common-logs/common-configuration-log): panw\_ngfw\_config\_raw \*These datasets use the query field names as described in the [Cortex schema](https://docs.paloaltonetworks.com/cortex/cortex-data-lake/log-forwarding-schema-reference.html) documentation. For stitched raw data, you can query the `xdr_data` dataset or use any preset designated for stitched data, such as `network_story`. For query examples, refer to the in-app XQL Library. When relevant, Cortex XDR can also raise Cortex XDR alerts (Analytics, Correlation Rules, IOC, and BIOC only) from Strata Logging Service detection data. While Correlation Rules alerts are raised on non-normalized and normalized logs, Analytics, IOC, and BIOC alerts are only raised on normalized logs. {% hint style="info" %} ### Note IOC and BIOC alerts are applicable on stitched data only and are not available on raw data. {% endhint %} {% hint style="info" %} ### Tip You can see an overview of ingestion status for all log types, and a breakdown of each log type and its daily consumption quota on the NGFW Ingestion Dashboard. {% endhint %} --- # Agent Instructions This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com. ## Querying This Documentation If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question. Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter: ``` GET https://cortex-docs.paloaltonetworks.com/cortex-xdr-3.x/cortex-xdr-3.x-documentation/data-management/data-ingestion/palo-alto-networks-integrations/ingest-data-from-next-generation-firewall.md?ask=&goal= ``` `ask` is the immediate question: it should be specific, self-contained, and written in natural language. `goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal. The response will contain a direct answer to the question and relevant excerpts and sources from the documentation. Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.