Hey everyone, new to the security side of things but deep-diving into monitoring. We're starting to deploy Palo Alto NGFWs (VM Series) in AWS alongside our on-prem physical firewalls.
I'm trying to figure out the best way to get a unified view. Right now I'm pulling metrics from Panorama into Prometheus with a custom exporter I found, and building dashboards in Grafana. It's... okay.
Has anyone actually run this in production? My main questions:
* Any major pitfalls with the VM Series in cloud vs on-prem, especially for metrics/log consistency?
* Is there a better way to get logs into my observability stack than Syslog forwarding? The volume is huge.
* How do you handle dashboarding for security policies across both environments?
Here's a basic panel I made for threat logs, but it feels too simplistic:
```promql
sum(panw_threat_logs) by (severity)
```
Would love to see real examples or learn from your mistakes 😅