> For the complete documentation index, see [llms.txt](https://help.radiantsecurity.ai/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://help.radiantsecurity.ai/radiant-connectors/network-security/palo-alto-networks/palo-alto-networks-firewall.md).
# Palo Alto Networks Firewall
Palo Alto Networks Firewall is a next-generation firewall that inspects traffic and enforces security policy to block intrusions, malware, and unauthorized access. Connecting the firewall forwards traffic, threat, and system logs to Radiant Security over syslog. Radiant uses the log data to triage firewall and threat alerts in context, giving analysts faster verdicts on whether observed traffic reflects a real compromise or routine network activity.
Palo Alto Networks Firewall can forward logs to Radiant Security in two ways:
* **Through the Radiant Agent (recommended).** Forward to a Radiant Agent deployed in your environment.
* **Direct to Radiant Security.** Forward over TLS to the Radiant syslog cluster. Use only when a Radiant Agent is not available.
### Prerequisites
* [ ] Admin access to Palo Alto Networks PAN-OS
* [ ] For the Radiant Agent path: a deployed [Radiant Agent](https://help.radiantsecurity.ai/radiant-connectors/data-connectors/install-the-radiant-security-agent) reachable from the Palo Alto Networks firewall
* [ ] For the direct path: network egress from the firewall to `cluster.syslog.radiantsecurity.ai` on TCP port `6514`
### Add the data connector in Radiant Security
Add the connector that matches the path you chose.
{% tabs %}
{% tab title="Radiant Agent (recommended)" %}
1. Log in to [Radiant Security](https://app.radiantsecurity.ai/).
2. From the navigation menu, click **Settings** > **Data Connectors**, then click **+ Add Connector**.
3. Search for and select **Radiant Agent**, then click **Data Feeds**.
4. Under **Select your data feeds**, select **Palo Alto Firewall 9.1**, then click **Credentials**.
5. Under **Credential Name**, enter an identifiable name for the Radiant Agent integration (e.g., `Radiant Agent integration`). To reuse an existing Radiant Agent credential, select it from the drop-down menu.
6. Click **Add Connector**.
{% endtab %}
{% tab title="Direct syslog" %}
1. Log in to [Radiant Security](https://app.radiantsecurity.ai/).
2. From the navigation menu, click **Settings** > **Data Connectors**, then click **+ Add Connector**.
3. Search for and select **Palo Alto Networks Firewall**, then click **Data Feeds**.
4. Under **Select your data feeds**, select **Palo Alto Firewall 9.1**, then click **Credentials**.
5. Under **Credential Name**, enter an identifiable name (e.g., `PAN Credentials`). To reuse an existing credential, select it from the drop-down menu.
6. In the **Connector tag** field, enter a value (optional).
7. Click **Add Connector**.
8. Download the **SSL Certificate** and **Custom Log** files. You use both in the sections below.
9. Click **Done** to save your changes.
{% endtab %}
{% endtabs %}
### Configure Palo Alto Networks Firewall to forward syslog through the Radiant Agent
Before starting, confirm the IP address of the Radiant Agent and the port configured to receive Palo Alto Networks Firewall data. If you do not know the port, contact your Customer Success representative.
1. Log in to the Palo Alto Networks firewall.
2. On the left navigation list, expand **Server Profiles** and click **Syslog**.
3. At the bottom of the right pane, click **Add**.
4. Under **Syslog Server Profile**, in **Name**, enter `RadiantSecurity`. Click **Add** to add a server, then configure:
1. **Name**: `RadiantSecurity Agent`
2. **Syslog Server**: the IP address of the Radiant Agent
3. **Transport**: `TCP`
4. **Port**: the port configured on the Radiant Agent to receive Palo Alto Networks Firewall data
5. Click the **Custom Log Format** tab.
6. In the **Log Type** column, click each log type name and paste its matching log format into the **Config Log Format** text box, then click **OK**. The log formats are in the [Radiant Security PAN custom templates file](https://files.gitbook.com/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FPsFulb2ZOtSPcRSc2rXE%2Fuploads%2FfNLNrMXXx8yUsLd0qCOi%2FRadiant%20Security%20PAN%20Custom%20Templates.zip?alt=media\&token=9d76878a-32ab-43ed-b084-15206ffb810a) for download.
7. Repeat step 6 for all 14 log types, then click **OK** on the syslog configuration screen.
### Configure Palo Alto Networks Firewall to forward syslog directly to Radiant Security
Use this path only when a Radiant Agent is not available. First, upload the Radiant certificate to the firewall, then configure the syslog server.
1. Log in to the Palo Alto Networks firewall.
2. On the top navigation bar, click **Device**.
3. On the left navigation list, expand **Certificate Management** and click **Certificates**.
4. At the bottom of the right pane, click **Import**.
5. Under **Import Certificate**, configure:
* **Certificate Name**: `Radiant Security Syslog CA`
* **Certificate File**: the SSL Certificate file you downloaded during the data connector setup
* **File Format**: Base64 Encoded Certificate (PEM)
6. Click **OK** to save the CA certificate.
7. On the left navigation list, expand **Server Profiles** and click **Syslog**.
6. At the bottom of the right pane, click **Add**.
6. Under **Syslog Server Profile**, in **Name**, enter `RadiantSecurity`. Click **Add** to add a server, then configure:
* **Name**: `Primary`
* **Syslog Server**: `cluster.syslog.radiantsecurity.ai`
* **Transport**: `SSL`
* **Port**: `6514`
6. Click the **Custom Log Format** tab.
7. In the **Log Type** column, click each log type name and paste its matching log format into the **Config Log Format** text box, then click **OK**. The log formats are in the Custom Log file you downloaded during the data connector setup.
7. Repeat step 11 for all 14 log types, then click **OK** on the syslog configuration screen.
### Configure log settings
The following steps apply to both paths.
1. On the left navigation list, under **Certificate Management**, click **Log Settings**.
2. For each of **System**, **Configuration**, **User-ID**, **HIP Match**, **GlobalProtect**, and **IP-Tag**, complete the following:
* Click **Add**.
* Under **Log Settings - System**, configure:
* **Name**: Radiant Security
* **Filter**: All Logs
* Under **Syslog**, click **Add** and select the **RadiantSecurity** syslog server profile you created in the previous section.
* Click **OK** to save.
### Configure syslog log forwarding
The following steps apply to both paths.
{% hint style="info" %}
If log forwarding is already configured on your firewall, add the Radiant Security syslog server to the existing log forwarding profile without removing any current settings. This sends syslog messages to both destinations at the same time.
{% endhint %}
1. On the top navigation bar, click **Objects**.
2. On the left navigation list, under **Security Profiles**, click **Log Forwarding**.
3. At the bottom of the right pane, click **Add**. If log forwarding is already configured, click **Edit** on the current profile instead.
4. Under **Log Forwarding Profile**, in **Name**, enter `Radiant Security Log Profile`.
5. Click **Add** to add a log forwarding profile match. If the existing profile does not have all log types selected, add each one in the **Log Forwarding Profile Match List** pane:
* **Name**: use the same name as the **Log Type**
* **Panorama**: enable this option if you use Panorama for log forwarding
* Under **Syslog**, click **Add** and select the **RadiantSecurity** syslog profile you created in the previous section.
* Click **OK** to save.
6. Once all log types are added, click **OK** on the **Log Forwarding Profile** pane.
7. To assign the log forwarding profile to policy rules, navigate to **Policies** > **Security**. For each rule that should forward logs to Radiant Security:
* Edit the rule.
* Click **Actions** and select the **Radiant Security Log Profile**.
* For **Traffic Logs**, select **Log at Session End**.
* For **Threat Logs**, select the security profile required to generate the log.
8. Click **Commit** in the upper-right corner to apply the changes.
9. When the **Commit Status** completes, the firewall begins forwarding logs to Radiant Security.
### Verify ingestion
After Palo Alto Networks Firewall begins forwarding, confirm alerts and events are reaching Radiant.
1. In Radiant, navigate to [Log Management](https://app.radiantsecurity.ai/logs).
2. Filter by `rs_connectorType:"paloaltonw9_1"`.
3. Confirm recent alerts and events appear.
{% hint style="info" %}
Allow several minutes for alerts and events to be parsed, indexed, and available for search.
{% endhint %}
---
# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.
## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.
Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:
```
GET https://help.radiantsecurity.ai/radiant-connectors/network-security/palo-alto-networks/palo-alto-networks-firewall.md?ask=&goal=
```
`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.
The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.
Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.