Issues with malachiteingestion-pa.googleapis.com?

Question

We successfully established HTTPS log forwarding profiles within Palo Alto Strata Logging Service last year using https://malachiteingestion-pa.googleapis.com/v2/unstructuredlogentries:batchCreate. Although these profiles continue to forward logs to our SecOps environment, we can no longer manage the profile within Strata due to the following error that follows when testing the connection:

This wasn’t an issue when the forwarding profiles were established and it certainly wasn’t an issue the many times we made adjustments to the profiles throughout last year. It’s probably been 4-6 months since we last touched these profiles, so it’s unclear when this behavior started.

I also noticed SSL Labs is having issues obtaining detail for malachiteingestion-pa.googleapis.com. Not sure if this is the expected behavior, but figured it was worth mentioning.

I have a support case open with Palo first, but figured I’d ask here as well before opening a Google support case.

CoryCousins · Accepted Answer

Palo Alto has confirmed this is a known issue on their end. It will be addressed eventually, but the workaround for now is to manually add a .PEM certificateto the log forwarding profile. It sounded like any .PEM file will work, but Palo Alto can also provide afile. You can reference case03955093 if needed.

Task_failed_successfully · Answer

This was super helpful, what’s odd is when I make an un-authenticatedcURL request to the endpoint “https://malachiteingestion-pa.googleapis.com/v2/unstructuredlogentries:batchCreate”I receive a 404, I would expect a 401 or similar given I haven’t authenticated prior?

Sign up

Login with SSO

Login to the community

Login with SSO

Scanning file for viruses.

This file cannot be downloaded