Palo Alto Networks Next-Generation Firewall
| SamurAI [Local] Collector | SamurAI [Cloud] Collector |
|---|---|
 |
To complete this integration, you will need to:
- Ensure connectivity requirements are in place:
- Configure your Palo Alto Networks Next-Generation Firewall:
- Configure syslog to your SamurAI Local Collector
- Create Log Forwarding Profiles
- Create URL Filtering Profile
- Create Filtering Profile Group
- Create Security Policy Rule
- Enable Packet Capture Profiles
- Enable API Access
- Configure WildFire authentication (optional)
- Complete the integration in the SamurAI Portal:
Connectivity Requirements
You must ensure the following connectivity requirements are available:
| Source | Destination | Ports | Description |
|---|---|---|---|
| Palo Alto Networks NGFW | SamurAI Local Collector | UDP/514 (syslog) | Firewall log transmission |
| SamurAI Local Collector | Palo Alto Networks NGFW | TCP/443 (HTTPS) | Extended data collection, including packet captures where enabled |
| SamurAI Local Collector | *.wildfire.paloaltonetworks.com | TCP/443 (HTTPS) | WildFire public cloud report retrieval, if configured |
| SamurAI Local Collector | auth.apps.paloaltonetworks.com | TCP/443 (HTTPS) | OAuth 2.0 access-token generation for WildFire public cloud collection |
The OAuth authentication service is separate from the WildFire public cloud API endpoint. If WildFire public cloud collection is enabled, allow access to both destinations.
See Palo Alto Networks:
Configure syslog to your SamurAI Local Collector
Follow the steps in the Palo Alto Networks documentation to configure your firewall to send logs to your SamurAI Local Collector.
If you do not have Panorama deployed:
If you have Panorama deployed, refer to:
Follow the instructions appropriate to your Panorama deployment mode.
Use the following parameters when completing the steps:
| Field Name | Parameter |
|---|---|
| Server Profile Name | A name of your choice. We suggest NTT_Syslog_Profile. |
| Syslog Server | IP address of your SamurAI Local Collector |
| Transport | UDP |
| Port | 514 |
| Format | BSD |
| Facility | Keep the default |
| Custom Log Format | Keep the default for every log type |
Create Log Forwarding Profiles
Follow the steps in the Palo Alto Networks documentation:
Configure log forwarding for each applicable log type using the following parameters:
| Field Name | Parameter |
|---|---|
| Name | A name of your choice. We suggest NTT_Log_Fwd_Profile. |
| Name for each Log Type | A name of your choice. We suggest NTT_<log-type>_Fwd_Profile, where <log-type> identifies the applicable log type. |
| Log Type | Include all applicable log types, such as traffic, threat, and WildFire. |
| Filter | All logs |
| Forward Method | Select the syslog Server Profile configured in Configure syslog to your SamurAI Local Collector. We suggested NTT_Syslog_Profile. |
Create URL Filtering Profile
Follow the steps in the Palo Alto Networks documentation:
allow unless you do not want those categories logged.| Field Name | Parameter |
|---|---|
| Name | A name of your choice. We suggest NTT_URL_Profile. |
| Site Access for Each Category | Alert. If your organisation’s policy requires Block for certain categories, retain that requirement. |
| User Credential Submission for Each Category | Alert. If your organisation’s policy requires Block for certain categories, retain that requirement. |
| Settings | Ensure Log container page only is not selected. |
| HTTP Header Logging | Enable User-Agent, Referer, and X-Forwarded-For. |
Create Filtering Profile Group
Follow the steps in the Palo Alto Networks documentation:
Use the following parameters:
| Field Name | Parameter |
|---|---|
| Security Profile Group name | A name of your choice. We suggest NTT_Security_Profile. |
| Filtering Profiles | Include all applicable profiles, such as Antivirus, Anti-Spyware, Vulnerability Protection, and the URL Filtering profile configured in Create URL Filtering Profile. Where packet captures are required, use the profiles configured in Enable Packet Capture Profiles. |
Create Security Policy Rule
Follow the steps in the Palo Alto Networks documentation:
Apply the following settings in the Actions tab of the applicable security policy rule:
| Field Name | Parameter |
|---|---|
| Profile Setting | Select the Security Profile Group configured in Create Filtering Profile Group. We suggested NTT_Security_Profile. |
| Log at Session Start | Enabled |
| Log at Session End | Enabled |
| Log Forwarding | Select the Log Forwarding Profile configured in Create Log Forwarding Profiles. We suggested NTT_Log_Fwd_Profile. |
Enable Packet Capture Profiles
Packet captures provide additional network context for security events and support investigation, validation, and response workflows.
Packet capture ingestion is optional and controlled within the SamurAI Portal. Firewall logs and security events can be collected without enabling packet capture ingestion.
NTT recommends enabling packet capture profiles to maximise the network context available during investigations.
Where organisational policies or data-handling requirements restrict packet capture usage, select Skip packet captures in the SamurAI Portal.
Follow the steps in the Palo Alto Networks documentation:
Enable packet capture for the applicable profiles using the following settings.
Antivirus Profile
| Field Name | Parameter |
|---|---|
| Name | A name of your choice. We suggest NTT_AV_Profile. |
| Antivirus | Enable Packet Capture where available for the applicable profile and PAN-OS version. |
Anti-Spyware Profile
| Field Name | Parameter |
|---|---|
| Name | A name of your choice. We suggest NTT_Spyware_Profile. |
| Severity Critical, High, and Medium | Select extended-capture. |
Vulnerability Protection Profile
| Field Name | Parameter |
|---|---|
| Name | A name of your choice. We suggest NTT_IDS_Profile. |
| Severity Critical, High, and Medium | Select extended-capture. |
Ensure these profiles are included in the Security Profile Group applied to the applicable security policy rules.
Enable API Access
The firewall API-Key is used for extended data collection from the Palo Alto Networks firewall. It is separate from the WildFire authentication credentials configured later in this guide.
Follow the steps in the Palo Alto Networks documentation:
Create a dedicated administrator account and Admin Role Profile for the SamurAI integration.
Under XML API, disable all permissions except:
- Log
- Operational Requests
- Export
Assign the Admin Role Profile to the dedicated administrator account.
Next, generate the API key by following:
Use the username and password of the dedicated administrator account.
Securely record the value returned in the <key> element. Enter this value in the API-Key field when you Complete the Palo Alto Networks Next-Generation Firewall Integration.
Configure WildFire authentication
WildFire collection is optional. Complete this section if you want SamurAI to retrieve WildFire analysis reports.
The authentication method depends on the WildFire deployment:
| WildFire Deployment | SamurAI Portal Fields |
|---|---|
| WildFire public cloud | WildFire Client ID, WildFire Client Secret, WildFire TSG-ID, and the WildFire authentication service endpoint |
| On-premises WildFire appliance | WildFire API-Key (legacy) |
These credentials are separate from the firewall API-Key obtained in Enable API Access.
The WildFire public cloud authentication procedure also applies to customers using Panorama-managed firewalls.
These credentials authenticate the integration to the WildFire public cloud API. They do not replace the firewall or Panorama API-Key, and do not require changing the firewall management platform.
WildFire public cloud: obtain OAuth 2.0 credentials
For WildFire public cloud collection, obtain:
- Client ID — the identifier issued for the service account.
- Client Secret — the secret issued for that service account.
- TSG-ID — the Tenant Service Group ID associated with the WildFire tenant.
The integration uses these values to request OAuth 2.0 access tokens. You do not need to enter a manually generated access token in the SamurAI Portal.
1. Select the correct tenant
Sign in to Strata Cloud Manager and select the customer tenant associated with the WildFire entitlement.
The tenant must have the appropriate license. Palo Alto Networks documents that:
- An Advanced WildFire license permits creation of an Advanced WildFire API key.
- A Prisma Access license permits creation of a Prisma Access API key.
Follow the prerequisites and instructions for the applicable license in:
2. Create a dedicated service account and configure its role
In Strata Cloud Manager, navigate to System Settings → Identity & Access Management.
Create a dedicated service account for this integration. Use a descriptive name, such as ntt_wildfire_user, subject to Palo Alto Networks naming requirements.
Configure the service account according to the WildFire documentation:
| Setting | Required Configuration |
|---|---|
| Apps & Services | All Apps & Services |
| Role | A custom role containing the iam.service_account and iam.custom_role permissions |
Do not leave the service account without an assigned role. Follow Palo Alto Networks’ WildFire-specific instructions for the required scope and restricted custom role.
See:
- Service Accounts
- Add a Custom Role Through Common Services
- Get Your Advanced WildFire Cloud API Key for Token-Based Authentication
3. Record the Client ID and Client Secret
Securely record the Client ID and Client Secret issued for the service account.
Use the issued Client ID, not merely the display name chosen for the account.
The Client Secret cannot be retrieved again after the service account has been created.
Store the secret securely. Do not include it in email, screenshots, support-ticket text, or documentation.
For details, see:
4. Bind the service account to the WildFire API key
Navigate to Configuration → WildFire Settings in Strata Cloud Manager.
If creating a new WildFire API key:
- Select Create New Key.
- Select the service account created for this integration.
- Select Create API Key.
- Wait until the key status changes from Pending to Valid.
Each WildFire API key must be bound to a unique service account.
If the tenant already has an NGFW or Prisma Access WildFire API key, follow the migration procedure instead. Existing unmigrated keys must be migrated or revoked before a new key can be created.
See:
- Get Your Advanced WildFire Cloud API Key for Token-Based Authentication
- Advanced WildFire Cloud API Migration
For OAuth-based WildFire collection, enter the bound service account’s Client ID and Client Secret in the SamurAI Portal.
Do not enter the WildFire backend API key in the WildFire API-Key (legacy) field.
5. Obtain the TSG-ID
In Strata Multitenant Cloud Manager:
- Select Tenants and Services → Tenant Management.
- Select the customer tenant and the relevant licensed product.
- Record the Tenant Service Group ID (
tsg_id) shown for that tenant.
Use the tenant associated with the WildFire API key and service account.
See:
The SamurAI integration can derive the TSG-ID when the Client ID matches:
<account-name>@<tsg-id>.iam.panserviceaccount.com
However, do not assume that every Client ID uses this format. Record the TSG-ID independently and enter the verified value in the WildFire TSG-ID field to avoid relying on automatic extraction.
6. Confirm the authentication endpoint
Palo Alto Networks documents the following OAuth 2.0 token endpoint:
https://auth.apps.paloaltonetworks.com/am/oauth2/access_token
Enter this value in the WildFire authentication service endpoint field when completing the integration.
This is the authentication endpoint, not the WildFire report endpoint, firewall address, or Panorama address.
See:
On-premises WildFire appliance: obtain an API key
WildFire appliances use API keys generated directly on the appliance rather than the public cloud OAuth authentication workflow.
Follow the Palo Alto Networks instructions:
If confirmed:
- Generate an API key on the WildFire appliance using the Palo Alto Networks instructions.
- Securely record the appliance-generated key.
- Enter it in WildFire API-Key (legacy) in the SamurAI Portal.
- Leave the WildFire OAuth fields blank for this authentication path.
Complete the Palo Alto Networks Next-Generation Firewall Integration
- Log in to the SamurAI Portal.
- Select Telemetry → Integrations from the main menu.
- Click Create.
- Find and select Palo Alto Networks Next-Generation Firewall.
- Select the relevant Local Collector and click Next.
- The Local Collector IP address is displayed on the left of the screen.
- To configure Extended Data Collection, enable the toggle.
- Enter the following information.
General extended data collection settings
| Field | Value |
|---|---|
| Name of Integration | A descriptive name to identify the integration in the SamurAI Portal. |
| Description (Optional) | Additional information to help identify the integration. |
| API-Key | The firewall API key obtained in Enable API Access. This is separate from the WildFire credentials below. |
| Hostname / IP | The hostname or IP address of the Palo Alto Networks firewall used for extended data collection. |
| Vsys (Optional) | The virtual systems to collect from, for example vsys1, vsys2. If omitted, the integration uses vsys1. |
| Threat severity ignore list (Optional) | Select threat severities to exclude from extended collection. By default, informational and low severities are excluded. |
Optional: Skip packet captures
Select Skip packet captures (Optional) if packet capture data must not be ingested.
- Packet capture data will not be ingested.
- Firewall logs and security events will continue to be collected through the configured log-forwarding path.
WildFire settings
Complete the fields for the applicable WildFire authentication method.
If WildFire collection is not required, leave the WildFire credential fields blank.
| Field | Value |
|---|---|
| WildFire API-Key (legacy) (Optional) | For a supported on-premises WildFire appliance integration only: enter the appliance-generated key obtained in Configure WildFire authentication. Leave blank when using WildFire public cloud OAuth authentication. |
| WildFire Client ID (Optional) | For WildFire public cloud collection: enter the Client ID issued for the service account bound to the WildFire API key. Client ID and Client Secret must both be provided. |
| WildFire Client Secret (Optional) | For WildFire public cloud collection: enter the secret issued for the same service account. This is not the legacy WildFire API key. |
| WildFire TSG-ID (Optional) | Enter the verified Tenant Service Group ID obtained in Configure WildFire authentication. If omitted, the integration can derive it only when the Client ID matches <account-name>@<tsg-id>.iam.panserviceaccount.com. Otherwise, this field must be completed. |
| WildFire authentication service endpoint | If not set the default will be used https://auth.apps.paloaltonetworks.com/am/oauth2/access_token for Oauth2 token generation |
Although the WildFire credential fields are marked Optional in the portal, Client ID and Client Secret are both required to enable WildFire public cloud OAuth collection.
The correct TSG-ID must also be available, either through the WildFire TSG-ID field or the supported Client ID extraction format.
Configure only one WildFire authentication method.
For public cloud OAuth authentication, leave WildFire API-Key (legacy) blank.
For a supported WildFire appliance integration, provide the appliance API key and leave the WildFire OAuth fields blank.
- Click Finish.
Our Integration guide was accurate at the time of writing but vendors change things frequently! If you find errors or anything is outdated, let us know by raising a request in the SamurAI MDR Portal and we shall get it updated.