Ingest Data from Next-Generation Firewall - Administrator Guide - Cortex XDR - Cortex - Security Operations

Cortex XDR Pro Administrator Guide

Cortex XDR
Creation date
Last date published
Administrator Guide

Learn how to ingest detection data from Next-Generation Firewall and Panorama.

You can forward firewall data from your Next-Generation Firewall (NGFW) and Panorama devices to Cortex XDR.


Ensure that you have completed the following on the NGFW or Panorama side:

  • For Panorama only, ensure that the Panorama Cloud Services plugin is installed.

  • Enable log forwarding profiles on firewall rules.

On the Cortex XDR side, ensure that you have user role permissions for Data Collection > Log Collections .


Ingesting logs from Next-Generation Firewall requires a Cortex XDR Pro per GB license.

You can only stream data from firewalls (standalone and Panorama-managed firewalls) that are assigned to the same region and are allocated to the same Customer Support Account (CSP). Firewalls can only be paired to a Strata Logging Service instance operating in the same region as the Cortex XDR tenant.


In the following procedure, general information is provided for NGFW and Panorama. For detailed instructions, consult the documentation for your specific devices and Panorama version.

Set up detection data ingestion
  1. In the user interface for setting up firewalls, for Strata Logging Service/Cloud Logging, enable the following options directly, or using device templates.

    (For example, go to DeviceSetupManagementCloud Logging section)

    1. Select Enable Strata Logging Service.

    2. Select Enable Enhanced Application Logging.

    3. (Optional, depending on your organization's requirements) Select Enable Duplicate Logging (Cloud and On-Premise).

  2. Depending on your PAN-OS or Panorama version, generate either a certificate or PSK.

    For PAN-OS and Panorama versions 10.1 and later, each firewall requires a separate certificate. Certificates need to be requested through the Customer Support portal. To sign in to the portal, click here. For PAN-OS and Panorama versions 10.0 and earlier, you are only required to generate one global PSK for all the firewall devices.


    Cortex XDR does not validate your firewall credentials, you must ensure the certificates or PSK details have been updated in your firewalls in order for data to stream.

  3. Onboard the certificates.

  4. Define a Log Forwarding profile.

  5. Map the Log Forwarding profile to a Security Policy Rule.

  6. Verify that the connection between the firewalls and Strata Logging Service is valid.

  7. Push the configuration changes to the firewalls.

  8. In Cortex XDR, select SettingsConfigurationsData CollectionCollection Integrations.

  9. On the Collection Integrations page, locate your NGFW data source and select Add Instance to begin a new connection.

  10. Select Add NGFW Device or Add Panorama Device.

    A list of all available devices allocated to your account is displayed.

    Devices already connected are listed at the end. A device may be connected via Strata Logging Service, or via Cortex XDR. Depending on the type of connection, you can rectify any streaming issues that may arise.

  11. Connect to establish the instance.

    Connection is established regardless of the firewall credential status and can take up to several minutes, select Sync now to refresh your instances.

  12. Validate that your data is streaming. It might be necessary to create traffic before you verify data streaming.

    To ensure the data is streaming into your tenant:

    • In your NGFW Standalone Firewall Devices, track the Last communication timestamp.

    • Run XQL Query: dataset = panw_ngfw_system_raw| filter log_source_id = "[NGFW device SN]"

  13. (Optional) Manage your Instance.

    After you create the NGFW instance, on the Collection Integrations page, expand the NGFW to track the status of your Standalone Firewall Devices and Panorama Devices.

    Select the ellipses to Request Certificate, if required, or Delete the instance.


It might take an hour or longer after connecting the firewall in Cortex XDR until you start seeing notifications that the certificate has been approved, and that the logging service license has appeared on the firewall.

As soon as Cortex XDR begins receiving detection data, the console begins stitching logs with other Palo Alto Network-generated logs to form stories. Use the XQL Search dataset panw_ngfw_*_raw to query your data, where the following logs are supported:

*These datasets use the query field names as described in the Cortex schema documentation.

For stitched raw data, you can query the xdr_data dataset or use any preset designated for stitched data, such as network_story. For query examples, refer to the in-app XQL Library. When relevant, Cortex XDR can also raise Cortex XDR alerts (Analytics, Correlation Rules, IOC, and BIOC only) from Strata Logging Service detection data. While Correlation Rules alerts are raised on non-normalized and normalized logs, Analytics, IOC, and BIOC alerts are only raised on normalized logs.


IOC and BIOC alerts are applicable on stitched data only and are not available on raw data.


You can see an overview of ingestion status for all log types, and a breakdown of each log type and its daily consumption quota on the NGFW Ingestion Dashboard.