There are no Advanced Threat Prevention log events in a company's SIEM instance.

Understanding the Problem:

The issue is that Advanced Threat Prevention (ATP) logs are visible on the firewall but are not being ingested into the company’s SIEM.

This implies that the ATP subscription is working and generating logs on the firewall but the logs are not being forwarded properly to the SIEM.

Action to Resolve:

Log Forwarding Configuration:

Verify that the Security policy rules configured to inspect traffic using Advanced Threat Prevention are set to forward logs to the SIEM instance.

This is a common oversight. Even if the logs are generated locally, they will not be forwarded unless explicitly configured.

Configuration steps to verify in the Palo Alto Networks firewall:

Go to Policies > Security Policies and check the "Log Forwarding" profile applied.

Ensure the "Log Forwarding" profile includes the correct settings to forward Threat Logs to the SIEM.

Go to Device > Log Settings and ensure the firewall is set to forward Threat logs to the desired Syslog or SIEM destination.

Why Not the Other Options?

A (Enable the Threat Prevention license):

The problem does not relate to the license; the administrator already confirmed the license is active.

B (Check with the SIEM vendor):

While verifying SIEM functionality is important, the first step is to ensure the logs are being forwarded correctly from the firewall to the SIEM. This is under the systems administrator’s control.

C (Have the SIEM vendor troubleshoot):

This step should only be taken after confirming the logs are forwarded properly from the firewall.

References from Palo Alto Networks Documentation:

Log Forwarding and Security Policy Configuration

Advanced Threat Prevention Configuration Guide