Paloalto Sdwan Ion

Overview

Palo Alto Prisma SD-WAN ION devices are edge appliances that provide software-defined wide area networking capabilities. ION devices generate syslog messages for authentication events, privilege escalation, VPN link alerts, system/hardware status, and network flow logs.

The Prisma SD-WAN ION app parses these logs, extracts metadata into user tags, and applies MITRE ATT&CK mappings for security-relevant events.

App Function

• Detects and auto-classifies all ION log types: Event/Auth, Alert, and Flow logs.
• Parses key/value pairs from event and alert logs into user tags for fast filtering.
• Parses CSV-formatted flow logs for network traffic visibility.
• Extracts high-value security fields: User, SrcIP, DstIP, Action for SOC analysis.
• Applies MITRE ATT&CK technique mappings (T1548, T1110, T1078, T1071).
• Automatically converts numeric ports to friendly service names (e.g., 53 → domain).
• Ships with an overview dashboard plus triggers for VPN failures, hardware issues, and authentication failures.

LogZilla Configuration

The Prisma SD-WAN ION app requires a dedicated syslog port for ION events.

1. Navigate to Settings > System > Application Ports
2. Set Prisma SD-WAN ION syslog port to a dedicated port (e.g., 5519)
3. Click Save

The syslog and parser services reload automatically. Both TCP and UDP listeners are enabled on the configured port.

Vendor Documentation

• Prisma SD-WAN Documentation
• Syslog Profile Configuration
• Incident and Alert Event Codes

Log Source Details

Incoming Log Formats

ION devices send three message types in RFC 5424 format:

Event/Auth Logs

Space-separated key/value pairs with double-quoted values:

text
Wrap: OnCopyFullscreen
ION_HOST="hostname" DEVICE_TIME="timestamp" MSG="message content"
SEVERITY="minor|major|critical" PROCESS_NAME="sudo|sshd|charon"
FACILITY="authpriv|auth|daemon" [USER="username"] ELEMENT_ID="id"

Alert Logs

Alert events with CODE field indicating the alert type:

text
Wrap: OnCopyFullscreen
ION_HOST="hostname" DEVICE_TIME="timestamp" STATUS="cleared|Not clear"
CODE="NETWORK_VPNLINK_DOWN" Severity="major" [REASON="reason_code"]
[VPN_LINK_ID="id"] ELEMENT_ID="id"

Flow Logs (CSV)

CSV format with program cgxFlowLogV1:

text
Wrap: OnCopyFullscreen
timestamp,srcip,srcport,dstip,dstport,protocol,,,bytes_in,bytes_out,
packets_in,packets_out,,wan_interface,flow_id,app,flow_type,rule:action:code

Legacy Format

Older ION devices (pre-Palo Alto acquisition) use CLOUDGENIX_HOST instead of ION_HOST. Both formats are supported.

Parsed Metadata Fields

The following user tags are extracted from ION log messages.

Common Fields (All Log Types)

Event/Auth Log Fields

Alert Log Fields

Flow Log Fields

MITRE ATT&CK Tags

MITRE mappings applied:

• T1548 (Privilege Escalation) - sudo commands
• T1110 (Brute Force) - SSH authentication failures
• T1078 (Valid Accounts) - SSH authentication success
• T1071 (Application Layer Protocol) - denied flow traffic

Device Configuration

ION devices send syslog in RFC 5424 format only. Configure syslog export via the Prisma SD-WAN web interface.

Configure Syslog Profile

1. Log into the Prisma SD-WAN Controller (Strata Cloud Manager)
2. Navigate to Configuration > Prisma SD-WAN > Profiles and Templates > Syslog
3. Click Create Syslog Profile
4. Configure the following settings:
   • Name: Enter a profile name (e.g., LogZilla-Export)
   • Enable Flow Logging: Enable to capture network traffic flows
   • Severity Level: Select Minor to capture all events
   • Protocol: Select UDP, TCP, or TLS
   • Server IP: Enter the LogZilla server IP address
   • Server Port: 5519 (dedicated ION port configured above)
5. Click Save
6. Assign the Syslog Profile to ION devices via device configuration

For detailed instructions, see the Prisma SD-WAN Syslog Profile Configuration documentation.

TLS Configuration Notes

• Self-signed certificates are not supported for TLS connections
• Server FQDN must match the Subject Alternate Name (SAN) in the certificate
• Only TLS 1.2 is supported

Alert Codes

ION devices generate alerts with the following CODE prefixes:

Log Examples

Sudo Command

text
Wrap: OnCopyFullscreen
ION_HOST="US-DA7-SDW-102" DEVICE_TIME="2025-11-19T17:47:39.610Z"
MSG="pam-all:root : PWD=/ ; USER=root ; COMMAND=/usr/bin/fp-cpu-usage --json"
SEVERITY="minor" PROCESS_NAME="sudo" FACILITY="authpriv"
ELEMENT_ID="1706032838379022596"

SSH Authentication Failure

text
Wrap: OnCopyFullscreen
ION_HOST="NZ-AUK-4342-01" DEVICE_TIME="2025-11-19T17:47:39.135Z"
MSG="pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0
tty=ssh ruser= rhost=192.168.1.100 user=admin"
SEVERITY="minor" PROCESS_NAME="sshd" FACILITY="authpriv"
ELEMENT_ID="17249535962630020"

VPN Link Down Alert

text
Wrap: OnCopyFullscreen
ION_HOST="US-CH3-SDW-203" DEVICE_TIME="2025-11-19T17:47:44.121Z"
STATUS="Not clear" CODE="NETWORK_VPNLINK_DOWN" Severity="major"
VPN_LINK_ID="1742910199997015396" AL_ID="1742909979692020596"
REASON="NETWORK_VPNBFD_DOWN" IDENTIFIER="1742910199995015196"
ELEMENT_ID="1697819626867008996"

VPN Link Restored

text
Wrap: OnCopyFullscreen
ION_HOST="US-DA7-SDW-202" DEVICE_TIME="2025-11-19T17:47:50.390Z"
STATUS="cleared" CODE="NETWORK_VPNLINK_DOWN" Severity="major"
VPN_LINK_ID="1742910199080011596" AL_ID="1742909979973021796"
REASON="NETWORK_VPNBFD_DOWN" IDENTIFIER="1742910199053011396"
ELEMENT_ID="1706032829676008596"

Flow Log (Allowed)

text
Wrap: OnCopyFullscreen
2020-01-28T23:46:17,10.2.53.102,52520,10.2.13.100,80,tcp,,,0,0,0,0,,
LondonPriWI1,15796434157670062,enterprise-http,New Flow,Allow-All:allow:1

Flow Log (Denied)

text
Wrap: OnCopyFullscreen
2020-01-28T23:50:00,192.168.1.50,44123,8.8.8.8,53,udp,,,0,0,0,0,,WAN1,
15796434157670099,dns,New Flow,Block-DNS:deny:2

Triggers