topic Re: Cloudguard Azure Smartevents in Cloud Firewall

Cloudguard Azure Smartevents

dehaasm — Fri, 27 Jan 2023 13:47:52 GMT

We have a VMSS cluster deployed in Azure with SMS, now we are looking to deploy a seperate Smartevents server in Azure.

What would be the best way to implement the Smartevent solution in Azure and integrate it into the current CME/SMS configuration? Is there a Azure template available and some documentation?

Re: Cloudguard Azure Smartevents

PhoneBoy — Mon, 30 Jan 2023 05:41:31 GMT

There isn't a template for management configuration, generally speaking.
You would spin up a new management instance with just SmartEvent installed.
Or, you can also add SmartEvent to your existing management VM, though you might want to spin up a larger instance if you go that route.

Re: Cloudguard Azure Smartevents

Bryan-Smith — Tue, 31 Jan 2023 17:52:35 GMT

@dehaasm as @PhoneBoy mentioned there is no specific template for an Azure SmartEvent server. I would definitely recommend spinning up a separate SmartEvent server using premium SSD for the IOPS.

In Azure you can select the Check Point Security Management template then chose to configure manually. (See screenshot below) At this point you would follow the traditional setup instructions with the first time wizard (FTW).

It's worth noting that MDS has an installation type that is specific to the log server setup. (mds-logserver)

Re: Cloudguard Azure Smartevents

dehaasm — Wed, 01 Feb 2023 10:05:15 GMT

Hi Bryan,

Thanks for sharing your knowledge. At the moment we have management server+smartevents license on single SMS IP, would it be possible to transfer the Smartevent license/component to the dedicated smartevents server with the new IP address?

Re: Cloudguard Azure Smartevents

Bryan-Smith — Wed, 01 Feb 2023 20:03:18 GMT

@dehaasm that is a good question. I would double check with your account team to make sure you are licensed to run a dedicated SmartEvent server. I believe you need to have a dedicated SmartEvent server license to split it out.

Re: Cloudguard Azure Smartevents

dehaasm — Wed, 08 Mar 2023 10:30:56 GMT

we decided to enable smartevent on the SMS, so we can simply enable the blade Smartevent server on the SMS in Azure?

Re: Cloudguard Azure Smartevents

PhoneBoy — Wed, 08 Mar 2023 16:17:23 GMT

Assuming you have a license for it, yes.

Re: Cloudguard Azure Smartevents

dehaasm — Wed, 15 Mar 2023 11:06:14 GMT

Hi Bryan,

We want to install Smartevent server on the same SMS what would you recommend for the system requriements, we currently have 4 CPU / 16GB mem and the there are about 150 log events per second.

Re: Cloudguard Azure Smartevents

PhoneBoy — Wed, 15 Mar 2023 12:48:57 GMT

That is the configuration I use for my lab installation of SMS+SmartEvent, which I consider a bare minimum installation.
It should suffice as a starting point, but doesn't give you a ton of headroom.

Re: Cloudguard Azure Smartevents

dehaasm — Wed, 15 Mar 2023 12:55:11 GMT

should we go for 8CPU with 32GB RAM doubling it?

Re: Cloudguard Azure Smartevents

PhoneBoy — Wed, 15 Mar 2023 12:59:26 GMT

If it were me, I would.

Re: Cloudguard Azure Smartevents

Bryan-Smith — Thu, 16 Mar 2023 15:21:07 GMT

@dehaasm 8 vCPU / 32GB RAM is a great starting point to run the correlation unit.

High Level Overview of Event Identification (checkpoint.com)