Refer to the official documentation below to configure log forwarding from Palo Alto Global Protect.
The Scope application supports ingestion of Palo Alto Global Protect logs in the Syslog format.
1,2019/11/23 00:44:44,01234567890,AUTHENTICATION,login,2561,2019/11/23 00:44:44,vsys1,fe80::4e7:1ab2:f6aa:82fa,user,normalize-user,object,auth-policy,12345,auth-id,vendor,log-action,server-profile
Nov 30 16:09:08 PA-220 1,2018/11/30 16:09:07,012801096514,TRAFFIC,end,2049,2018/11/30 16:09:07,192.168.15.207,175.16.199.1,192.168.1.63,175.16.199.1,new_outbound_from_trust,,,apple-maps,vsys1,trust,untrust,...,allow,...
2024-02-07T23:55:31-05:00 REDACTED-FW.xxx.lan - 1,2024/02/07 23:55:30,012001056196,GLOBALPROTECT,0,2561,2024/02/07 23:55:30,vsys1,portal-auth,login
676 <14>1 2024-08-26T20:39:30-04:00 Panorama-VA.redact.local - - - - 1,2024/08/26 20:39:29,011901020494,TRAFFIC,drop,2816,2024/08/26 20:39:29,10.1.134.31,20.190.155.1