> For the complete documentation index, see [llms.txt](https://cortex-docs.paloaltonetworks.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/configure-cortex-xdr/cortex-xdr-data-sources/palo-alto-networks-integrations/next-generation-firewall/ingest-next-generation-firewall-logs-using-the-syslog-collector.md).

# Ingest Next-Generation Firewall logs using the Syslog collector

Use the Syslog collector to ingest Next-Generation Firewall (NGFW) logs in CEF format. This method is useful when your firewalls are located in a different region, or bandwidth issues are encountered due to large log size. When possible, we recommend that you ingest NGFW logs using the dedicated Next-Generation Firewall data collector instead of the Syslog collector.

{% hint style="info" %}

### Note

In the following procedure, general information is provided for NGFW and Panorama. For detailed instructions, consult the documentation for your specific devices and Panorama version, to ensure that you have configured log forwarding correctly for all the log types that you would like to forward to Cortex XDR. The following steps only cover configuration of the custom log schema (CEF) for a given syslog server. They do not replace the administrator guide’s configuration coverage of log forwarding.
{% endhint %}

For tenants where customers have integrated directly with Strata Logging Service, the configured integrations, such as Next-Generation Firewall and Prisma Access, can be migrated to Cortex XDR in either of the following ways before the license expires:

Configure the firewall/Panorama for log forwarding to Cortex XSIAM

1. To configure the device to include its IP address in the header of Syslog messages, select **Panorama/Device** → **Setup** → **Management**, click the **Edit** icon in the **Logging and Reporting Settings** section, and navigate to the **Log Export and Reporting** tab.
2. From the **Syslog HOSTNAME Format** menu, select **ipv4-address** or **ipv6-address**, and click **OK**.
3. Select **Device** → **Server Profiles** → **Syslog**, and click **Add**.
4. Enter a server profile **Name** and **Location** (**Location** refers to a virtual system, if the device is enabled for virtual systems).
5. On the **Servers** tab of the **Syslog Server Profiles** window, click **Add,** and enter the following information for the Syslog server:
   * **Name**
   * **Syslog Server** (IP address)
   * **Transport**, **Port** (default 514 for UDP)
   * **Facility** (default LOG\_USER)
6. Select the **Custom Log Format** tab and click configure the log formats as follows:

   <div data-gb-custom-block data-tag="hint" data-style="info" class="hint hint-info"><h3>Note</h3><p>To avoid the possible effects of line formatting, do not copy/paste the message formats directly into the PAN-OS web interface. Instead, paste into a text editor, remove any carriage return or line feed characters, and then copy and paste into the web interface.</p></div>

   <div data-gb-custom-block data-tag="hint" data-style="info" class="hint hint-info"><h3>Note</h3><p>From version 10.0 and later, the log format documented for log types (Traffic, Threat, and URL) exceeds the maximum supported 2048 characters in the Custom Log Format tab on the firewall and Panorama. Select the CEF keys and values to limit the number of characters to 2048, as per your requirements.</p></div>

   | Log Type  | Custom Format                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      |
   | --------- | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
   | Traffic   | CEF:0\|PANW\|NGFW\_CEF\|$sender\_sw\_version\|$subtype\|$type\|1\| \_\_firewall\_type=firewall.traffic \_\_timestamp=$start \_\_tz=$high\_res\_timestamp log\_type=$type subtype=$subtype log\_time=$cef-formatted-receive\_time time\_generated=$cef-formatted-time\_generated log\_source\_id=$serial log\_source\_name=$device\_name sequence\_no=$seqno source\_ip=$src dest\_ip=$dst source\_port=$sport dest\_port=$dport nat\_source=$natsrc nat\_dest=$natdst nat\_source\_port=$natsport nat\_dest\_port=$natdport protocol=$proto action=$action source\_user=$srcuser dest\_user=$dstuser xff\_ip=$xff\_ip app=$app app\_category=$category\_of\_app app\_sub\_category=$subcategory\_of\_app rule\_matched=$rule rule\_matched\_uuid=$rule\_uuid severity=1 vsys=$vsys vsys\_name=$vsys\_name from\_zone=$from to\_zone=$to inbound\_if=$inbound\_if outbound\_if=$outbound\_if session\_id=$sessionid source\_device\_category=$src\_category source\_device\_profile=$src\_profile source\_device\_model=$src\_model source\_device\_vendor=$src\_vendor source\_device\_osfamily=$src\_osfamily source\_device\_osversion=$src\_osversion source\_device\_mac=$src\_mac dest\_device\_category=$dst\_category dest\_device\_profile=$dst\_profile dest\_device\_model=$dst\_model dest\_device\_vendor=$dst\_vendor dest\_device\_osfamily=$dst\_osfamily dest\_device\_osversion=$dst\_osversion dest\_device\_mac=$dst\_mac bytes\_sent=$bytes\_sent bytes\_received=$bytes\_received packets\_received=$pkts\_received packets\_sent=$pkts\_sent total\_time\_elapsed=$elapsed session\_end\_reason=$session\_end\_reason url\_category=$category                                                                                                                                                                                                                |
   | Threat    | CEF:0\|PANW\|NGFW\_CEF\|$sender\_sw\_version\|$threatid\|$type\|$number-of-severity\| \_\_firewall\_type=firewall.threat \_\_timestamp=$cef-formatted-time\_generated \_\_tz=$high\_res\_timestamp log\_type=$type subtype=$subtype log\_time=$cef-formatted-receive\_time time\_generated=$cef-formatted-time\_generated log\_source\_id=$serial log\_source\_name=$device\_name sequence\_no=$seqno source\_ip=$src dest\_ip=$dst source\_port=$sport dest\_port=$dport nat\_source=$natsrc nat\_dest=$natdst nat\_source\_port=$natsport nat\_dest\_port=$natdport protocol=$proto action=$action source\_user=$srcuser dest\_user=$dstuser xff=$xff xff\_ip=$xff\_ip app=$app app\_category=$category\_of\_app app\_sub\_category=$subcategory\_of\_app rule\_matched=$rule rule\_matched\_uuid=$rule\_uuid severity=$number-of-severity vsys=$vsys vsys\_name=$vsys\_name from\_zone=$from to\_zone=$to inbound\_if=$inbound\_if outbound\_if=$outbound\_if session\_id=$sessionid source\_device\_category=$src\_category source\_device\_profile=$src\_profile source\_device\_model=$src\_model source\_device\_vendor=$src\_vendor source\_device\_osfamily=$src\_osfamily source\_device\_osversion=$src\_osversion source\_device\_mac=$src\_mac dest\_device\_category=$dst\_category dest\_device\_profile=$dst\_profile dest\_device\_model=$dst\_model dest\_device\_vendor=$dst\_vendor dest\_device\_osfamily=$dst\_osfamily dest\_device\_osversion=$dst\_osversion dest\_device\_mac=$dst\_mac misc=$misc threat\_id=$threatid threat\_name=$threat\_name threat\_category=$thr\_category direction=$direction user\_agent=$user\_agent                                                                                                                                                                                                                         |
   | URL       | CEF:0\|PANW\|NGFW\_CEF\|$sender\_sw\_version\|$subtype\|$type\|$number-of-severity\| \_\_firewall\_type=firewall.url \_\_timestamp=$cef-formatted-time\_generated \_\_tz=$high\_res\_timestamp log\_type=$type subtype=$subtype log\_time=$cef-formatted-receive\_time time\_generated=$cef-formatted-time\_generated log\_source\_id=$serial log\_source\_name=$device\_name sequence\_no=$seqno source\_ip=$src dest\_ip=$dst source\_port=$sport dest\_port=$dport nat\_source=$natsrc nat\_dest=$natdst nat\_source\_port=$natsport nat\_dest\_port=$natdport protocol=$proto action=$action source\_user=$srcuser dest\_user=$dstuser xff=$xff xff\_ip=$xff\_ip app=$app app\_category=$category\_of\_app app\_sub\_category=$subcategory\_of\_app rule\_matched=$rule rule\_matched\_uuid=$rule\_uuid severity=$number-of-severity vsys=$vsys vsys\_name=$vsys\_name from\_zone=$from to\_zone=$to inbound\_if=$inbound\_if outbound\_if=$outbound\_if session\_id=$sessionid source\_device\_category=$src\_category source\_device\_profile=$src\_profile source\_device\_model=$src\_model source\_device\_vendor=$src\_vendor source\_device\_osfamily=$src\_osfamily source\_device\_osversion=$src\_osversion source\_device\_mac=$src\_mac dest\_device\_category=$dst\_category dest\_device\_profile=$dst\_profile dest\_device\_model=$dst\_model dest\_device\_vendor=$dst\_vendor dest\_device\_osfamily=$dst\_osfamily dest\_device\_osversion=$dst\_osversion dest\_device\_mac=$dst\_mac uri=$misc threat\_id=$threatid threat\_name=$threat\_name threat\_category=$thr\_category direction=$direction user\_agent=$user\_agent url\_category=$category url\_category\_list=$url\_category\_list content\_type=$contenttype http\_method=$http\_method http\_headers=$http\_headers http2\_connection=$http2\_connection referer=$referer pcap\_id=$pcap\_id |
   | File Data | CEF:0\|PANW\|NGFW\_CEF\|$sender\_sw\_version\|$threatid\|$type\|$number-of-severity\| \_\_firewall\_type=firewall.filedata \_\_timestamp=$cef-formatted-time\_generated \_\_tz=$high\_res\_timestamp log\_type=$type subtype=$subtype log\_time=$cef-formatted-receive\_time time\_generated=$cef-formatted-time\_generated log\_source\_id=$serial log\_source\_name=$device\_name sequence\_no=$seqno source\_ip=$src dest\_ip=$dst source\_port=$sport dest\_port=$dport nat\_source=$natsrc nat\_dest=$natdst nat\_source\_port=$natsport nat\_dest\_port=$natdport protocol=$proto action=$action source\_user=$srcuser dest\_user=$dstuser xff=$xff xff\_ip=$xff\_ip app=$app app\_category=$category\_of\_app app\_sub\_category=$subcategory\_of\_app rule\_matched=$rule rule\_matched\_uuid=$rule\_uuid severity=$number-of-severity vsys=$vsys vsys\_name=$vsys\_name from\_zone=$from to\_zone=$to inbound\_if=$inbound\_if outbound\_if=$outbound\_if session\_id=$sessionid source\_device\_category=$src\_category source\_device\_profile=$src\_profile source\_device\_model=$src\_model source\_device\_vendor=$src\_vendor source\_device\_osfamily=$src\_osfamily source\_device\_osversion=$src\_osversion source\_device\_mac=$src\_mac dest\_device\_category=$dst\_category dest\_device\_profile=$dst\_profile dest\_device\_model=$dst\_model dest\_device\_vendor=$dst\_vendor dest\_device\_osfamily=$dst\_osfamily dest\_device\_osversion=$dst\_osversion dest\_device\_mac=$dst\_mac misc=$misc threat\_id=$threatid threat\_name=$threat\_name threat\_category=$thr\_category direction=$direction user\_agent=$user\_agent file\_url=$file\_url filedigest=$filedigest filetype=$filetype pcap\_id=$pcap\_id                                                                                                                                     |
7. Configure **Escaping** characters as follows:

   * **Escaped Characters:** \\
   * **Escape Character:** \\

   ![](/files/MDn658Q8AkIYiEOyU2U0)

### Configure Syslog collection

Set up a Syslog collector for the logs, as explained in [Activate Syslog Collector](/cortex-xdr-5.x/configure-cortex-xdr/cortex-xdr-data-sources/generic-on-premise-data-collectors/broker-vm-data-collector-applets/syslog-collector-applet/activate-syslog-collector.md). In Task 4, ensure that you set **Format** to CEF.


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:

```
GET https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/configure-cortex-xdr/cortex-xdr-data-sources/palo-alto-networks-integrations/next-generation-firewall/ingest-next-generation-firewall-logs-using-the-syslog-collector.md?ask=<question>&goal=<endgoal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.