Devo 360 for Palo Alto

To help organizations enhance Palo Alto Networks security solutions, Devo provides the Devo 360 for Palo Alto application, where cloud-native logging and security analytics meets Palo Alto Networks firewall technology.

The Devo 360 for Palo Alto application, available in Devo Exchange, brings centralized insights from Palo Alto firewall products. It is a pre-built knowledge base of dashboards and alerts that delivers real-time visibility and expedites analysis of Devo users’ Palo Alto firewall activity. It helps you use the Devo Platform to optimize resources and detect threats by automatically aggregating Palo Alto threat definitions, which increases analysts’ efficiency and reduces fatigue as they address alerts.

Open

Installing Devo 360 for Palo Alto

Installing the application is easy thanks to Devo Exchange. All you need to do once inside Exchange is find the application, click the Install button, and assign it to your role. You can find the whole process carefully explained in Installing content.

Pre-requisites

To use the Devo 360 Palo Alto, you must have the following Lookups installed in your domain:

• SecOps GWL Lookup

• SecOps Location Lookup

• SecOps Alert Description Lookup

• SecOpsAssetRole Lookup

Accessing Devo 360 for Palo Alto

The application is easily accessible from the Navigation pane. Select Applications → Devo 360 for Palo Alto and you will land on the General Overview, the application’s main view.

Open

Working with Devo 360 for Palo Alto

In this application, you can find three different views, which are divided in tabs to better categorize the different information displayed and thus make it easier to find what you need. Visit the articles below for an in-depth analysis of the content each view presents:

Operations in all views

In all of the views you have a time picker at the top left so you can visualize the data for the desired period. You can choose either a Time Preset from the list or you can select a Custom Range and specific a date on the calendar.

There are several widgets in all views and all of them have some common features. You can see the query that feeds the widgets by clicking on the ellipsis menu and selecting Show Query.

They also have some particularities and they can be categorized in different types according to the degree of interaction they allow and the type of insight they offer about data.

Column and line charts provide insights on the data distribution over time. These are the widgets with the highest degree of interaction. See the picture below for the different actions you can carry out.