Palo Alto Networks Panorama

SamurAI [Local] Collector	SamurAI [Cloud] Collector

To complete this integration, you will need to:

1. Ensure connectivity requirements are in place:

• Connectivity Requirements

2. Configure your Palo Alto Networks Panorama environment:

• Configure syslog to your SamurAI Local Collector
• Enable API Access
• Configure WildFire authentication (optional)

3. Complete the integration in the SamurAI Portal:

• Complete the Palo Alto Networks Panorama Integration

Connectivity Requirements

You must ensure the following connectivity requirements are available:

Follow the Palo Alto Networks log-forwarding instructions appropriate to your Panorama deployment mode. Ensure that the device or Log Collector performing external log forwarding can reach the SamurAI Local Collector.

The OAuth authentication service is separate from the WildFire public cloud API endpoint. If WildFire public cloud collection is enabled, allow access to both destinations.

See:

• Configure Log Forwarding from Panorama to External Destinations
• Generate an Access Token for WildFire API Requests

Configure syslog to your SamurAI Local Collector

Follow the steps in the Palo Alto Networks documentation to configure external log forwarding from your Panorama environment to your SamurAI Local Collector:

• Configure Log Forwarding from Panorama to External Destinations

Use the following parameters when configuring the syslog server profile:

If you will not use the management interface for syslog forwarding, follow the applicable Palo Alto Networks instructions to configure an alternative interface.

Enable API Access

The Panorama API-Key is used for extended data collection from Panorama. It is separate from the WildFire authentication credentials configured later in this guide.

Follow the steps in the Palo Alto Networks documentation:

• Enable API Access

Create a dedicated administrator account and Admin Role Profile for the SamurAI integration.

Under XML API, disable all permissions except:

1. Log
2. Operational Requests
3. Export

Assign the Admin Role Profile to the dedicated administrator account.

Next, generate the API key by following:

• Get Your API Key

Use the username and password of the dedicated Panorama administrator account.

Securely record the value returned in the <key> element. Enter this value in the API-Key field when you Complete the Palo Alto Networks Panorama Integration.

Configure WildFire authentication

WildFire collection is optional. Complete this section if you want SamurAI to retrieve WildFire analysis reports.

The authentication method depends on the WildFire deployment:

These credentials are separate from the Panorama API-Key obtained in Enable API Access.

WildFire public cloud: obtain OAuth 2.0 credentials

For WildFire public cloud collection, obtain:

• Client ID — the identifier issued for the service account.
• Client Secret — the secret issued for that service account.
• TSG-ID — the Tenant Service Group ID associated with the WildFire tenant.

The integration uses these values to request OAuth 2.0 access tokens. You do not need to enter a manually generated access token in the SamurAI Portal.

1. Select the correct tenant

Sign in to Strata Cloud Manager and select the customer tenant associated with the WildFire entitlement.

The tenant must have the appropriate license. Palo Alto Networks documents that:

• An Advanced WildFire license permits creation of an Advanced WildFire API key.
• A Prisma Access license permits creation of a Prisma Access API key.

Follow the prerequisites and instructions for the applicable license in:

• Get Your Advanced WildFire Cloud API Key for Token-Based Authentication

2. Create a dedicated service account and configure its role

In Strata Cloud Manager, navigate to System Settings → Identity & Access Management.

Create a dedicated service account for this integration. Use a descriptive name, such as ntt_wildfire_user, subject to Palo Alto Networks naming requirements.

Configure the service account according to the WildFire documentation:

Do not leave the service account without an assigned role. Follow Palo Alto Networks’ WildFire-specific instructions for the required scope and restricted custom role.

See:

• Service Accounts
• Add a Custom Role Through Common Services
• Get Your Advanced WildFire Cloud API Key for Token-Based Authentication

3. Record the Client ID and Client Secret

Securely record the Client ID and Client Secret issued for the service account.

Use the issued Client ID, not merely the display name chosen for the account.

For details, see:

• Service Accounts

4. Bind the service account to the WildFire API key

Navigate to Configuration → WildFire Settings in Strata Cloud Manager.

If creating a new WildFire API key:

1. Select Create New Key.
2. Select the service account created for this integration.
3. Select Create API Key.
4. Wait until the key status changes from Pending to Valid.

Each WildFire API key must be bound to a unique service account.

If the tenant already has an NGFW or Prisma Access WildFire API key, follow the migration procedure instead. Existing unmigrated keys must be migrated or revoked before a new key can be created.

See:

• Get Your Advanced WildFire Cloud API Key for Token-Based Authentication
• Advanced WildFire Cloud API Migration

5. Obtain the TSG-ID

In Strata Multitenant Cloud Manager:

1. Select Tenants and Services → Tenant Management.
2. Select the customer tenant and the relevant licensed product.
3. Record the Tenant Service Group ID (tsg_id) shown for that tenant.

Use the tenant associated with the WildFire API key and service account.

See:

• Access Products from the Strata Multitenant Cloud Manager

The SamurAI integration can derive the TSG-ID when the Client ID matches:

<account-name>@<tsg-id>.iam.panserviceaccount.com

However, do not assume that every Client ID uses this format. Record the TSG-ID independently and enter the verified value in the WildFire TSG-ID field to avoid relying on automatic extraction.

6. Confirm the authentication endpoint

Palo Alto Networks documents the following OAuth 2.0 token endpoint:

https://auth.apps.paloaltonetworks.com/am/oauth2/access_token

Enter this value in the WildFire authentication service endpoint field when completing the integration.

This is the authentication endpoint, not the WildFire report endpoint or Panorama address.

See:

• Generate an Access Token for WildFire API Requests

On-premises WildFire appliance: obtain an API key

WildFire appliances use API keys generated directly on the appliance rather than the public cloud OAuth authentication workflow.

Follow the Palo Alto Networks instructions:

• WildFire Appliance API Authentication

If confirmed:

1. Generate an API key on the WildFire appliance using the Palo Alto Networks instructions.
2. Securely record the appliance-generated key.
3. Enter it in WildFire API-Key (legacy) in the SamurAI Portal.
4. Leave the WildFire OAuth fields blank for this authentication path.

Complete the Palo Alto Networks Panorama Integration

1. Log in to the SamurAI Portal.
2. Select Telemetry → Integrations from the main menu.
3. Click Create.
4. Find and select Palo Alto Networks Panorama.
5. Select the relevant Local Collector and click Next.
6. The Local Collector IP address is displayed on the left of the screen.
7. To configure extended collection, enable the toggle.
8. Enter the following information.

General extended collection settings

WildFire settings

Complete the fields for the applicable WildFire authentication method.

If WildFire collection is not required, leave the WildFire credential fields blank.

9. Click Finish.

Our Integration guide was accurate at the time of writing but vendors change things frequently! If you find errors or anything is outdated, let us know by raising a request in the SamurAI MDR Portal and we shall get it updated.