I am in search for a document related to OPSEC configuration in checkpoint to integrate with 3rd party SIEM tools. Kindly share documents if any.
I am in search for a document related to OPSEC configuration in checkpoint to integrate with 3rd party SIEM tools. Kindly share documents if any.
Hi Sangeeth,
Are you after anything in particular? As the options you select on the OPSEC configuration may differ per product.
Or are you after a quick how to setup an OPSEC configuration?
As Kosin Usuwanthim has advised the 3rd party should have a guide on how to integrate their product with Check Point.
Regards
Mark
Hi Mark
Yes, we are using ArcSight.
But the actual issue that we are facing is that "User" field is shown as "Confidential" in logs (Clear connection is configured).
I also gone through sk101570 (3rd Scenario) which is related to our issue. I hope by following the given procedure will solve this issue. Kindly suggest...
Reference : sk101570
Some fields in logs on 3rd party LEA OPSEC client show "*** Confidential ***"
Hi Sangeeth,
Within your OPSEC configuration do you have the LEA configuration settings set to "Hide all confidential log fields"? This will cause what you are seeing.
if you can post your OPSEC configuration we can take a look and advise as necessary.
Regards
Mark
Hi Mark
As stated in earlier comment , the connection type configured is "clear" in ArcSight. I believe that we need not to create an OPSEC application for clear connection.
Regards
Sangeeth
Sounds like you're on the right track as far as the LEA options. Let us know how it works out for you.
Maybe you can search from 3rd SIEM that you need to integrate with CheckPoint.
Like this.
IBM Knowledge Center