Enable Cribl to Send Palo Alto Networks Firewall Logs to Azure Event Hub
Use the following procedures to allow Cribl Stream to send Palo Alto Networks firewall logs to the Illumio-hosted Azure Event Hub.
Note
For Cribl, use the default Palo Alto Networks log format instead of Common Event Format (CEF).
In Cribl Stream, add a Data Destination with the following values to the Azure Event Hub that you use for Illumio Insights:
Output ID: Enter a unique name to identify the Azure Event Hubs definition.
Brokers: arch-eventhub.servicebus.windows.net:9093
Event Hub Name: rsyslog-logs
TLS: Enabled
Authentication: Enabled
SASL Mechanism: PLAIN
Username: $ConnectionString
Password: Will be provided in a separate email. It is the full Event Hub connection string (usually starts with Endpoint=sb.//...;SharedAccessKeyName=...;SharedAccessKey=...).
Add a Data Route with the following values to the Data Destination that you created:
Route Name: Enter a unique name for the route.
Pipeline: Select a value.
Destination: Select the Destination Name (Output ID) that you created in Step 1.a.