I have a flask application that should receive txt/xml logs from a Palo Alto Firewall. How can I receive the traffic logs?
My Python Script: main.py
import flask
from flask import request
# For development!
app = flask.Flask(__name__)
@app.route('/', methods=['GET', 'POST'])
def __index():
# Request as TEXT/XML
xml_data = None
try:
xml_data = request.form
print(f"requests.xml_data={xml_data}")
except Exception as e:
print(f"Error #2 Could not get request.form data: {e}")
if xml_data is None:
raise Exception(f"Error #3 Could not get json data because missing xml_data as post")
# Flattern
xml_data_flattern = xml_data.to_dict(flat=True)
# Log JSON data
print(f"xml_data={xml_data}")
print(f"xml_data_flattern={xml_data_flattern}")
# Finish program
return {"message": "Finished", "data": ""}
if __name__ == '__main__':
app.run(debug=False, host="0.0.0.0", port=8080)
Palo Alto:
This is the Device->HTTP->HTTP Server Profile->Servers:
- Name: MyServer
- Address: myserver.runn.app
- Protocol: HTTPS
- Port: 443
- TLS Version: 1.2
- Certificate profile: None
- HTTP Method: POST
- Username: admin
- Pasword: admin
This is the Device->HTTP->HTTP Server Profile->Payload Format for Traffic:
- Name: Traffic-Payload
- HTTP Headers: content-type text/xml
- Payload:
<request><entry><short_description> $type</short_description></entry></request>