Palo Alto Networks AIOps and Telemetry Overview

🤖 What is AIOps for NGFW?

Artificial Intelligence for IT Operations (AIOps) for Next-Generation Firewalls (NGFW) is a solution by Palo Alto Networks that leverages machine learning and analytics to automate and enhance IT operations. It provides comprehensive visibility into firewall health, performance, and security posture by analyzing telemetry data collected from devices.

Key benefits include:

Proactive identification of misconfigurations and anomalies.
Automated best practice assessments and policy recommendations.
Enhanced visibility into network threats and performance metrics.

Learn more: What is AIOps for NGFW?

📡 Understanding Device Telemetry

Device telemetry refers to the data collected from Palo Alto Networks firewalls and Panorama, which is then analyzed by AIOps to provide insights into device health and security posture.

Types of telemetry data collected include:

Configuration and policy information.
Performance metrics and system health indicators.
Threat logs and security events.
Product usage statistics.

This data is securely transmitted to Palo Alto Networks' cloud services for analysis.

Detailed information: Device Telemetry Overview

🔒 Security and Privacy of Telemetry Data

Palo Alto Networks ensures the security and privacy of telemetry data through:

Encryption in transit using TLS 1.3.
Encryption at rest with AES-256 in Google Cloud Platform.
Access controls limiting data access to authorized personnel only.
Compliance with SOC 2 Type II certification standards.

For more details: How does AIOps secure the telemetry data?

⚙️ Enabling Telemetry on Devices

To enable telemetry on your devices:

Ensure the device is registered in the Customer Support Portal.
Install a device certificate on the firewall or Panorama.
Enable telemetry sharing on the device.

After enabling telemetry, it may take a few hours for insights to appear on the AIOps dashboard.

Step-by-step guide: Device Telemetry for AIOps for NGFW

🌐 Required Domains for Telemetry

If your devices access the internet through a proxy, ensure the following domains are allowed to enable telemetry data transmission:

*.prod.di.paloaltonetworks.cloud
*.paloaltonetworks.com
*.prod.di.paloaltonetworks.com
*.prod.reporting.paloaltonetworks.com
*.receiver.telemetry.paloaltonetworks.com
https://storage.googleapis.com

Region-specific domains should also be allowed based on your geographic location.

Full list: Domains Required for AIOps for NGFW

📈 Utilizing AIOps Insights

Once telemetry is enabled and data is being collected, AIOps provides:

Visual dashboards displaying device health and performance.
Alerts for anomalies and potential issues.
Recommendations for configuration improvements.
Best Practice Assessments (BPA) with heatmaps illustrating security posture.

These insights help in proactively managing and securing your network infrastructure.