XML API

[mathewtpower]

Hey all! I am currently using this Add-On: https://splunkbase.splunk.com/app/3732 but I've noticed it's no longer supported and has been archived. Hoping to move to something supported but wasn't sure if your add-on supported the XML API/if you have any alternative options if not!

Thanks :)

[btorresgil]

Hi @mathewtpower , that app in your link was made by a 3rd party. The official Palo Alto Networks Splunk App/Add-on does support the XML API for some things, but not for log collection. At Palo Alto Networks we made a design decision to use syslog to collect logs into Splunk, and not the XML API, for better consistency and scalability within the Splunk architecture. The XML API is used by the Splunk App for operational changes such as dynamic address group updates, user logins, etc.

[Trek333]

@btorresgil and @mathewtpower My organization is interested in log collection of Palo Alto firewall data into Splunk Enterprise that is not available via syslog. One example is the Palo Alto XML API endpoint is "show system environmentals power" . Since the " official Palo Alto Networks Splunk App/Add-on" apps do not perform "log collection" using the Palo Alto XML API, does a Palo Alto process exist to request that non-syslog Palo Alto data be made available via syslog?