topic Re: Harmony Browse log forwarding to on-prem SmartCenter in Browse

Harmony Browse log forwarding to on-prem SmartCenter

Sergej_Gurenko — Thu, 15 Dec 2022 13:30:01 GMT

After reading the Admin Guide Harmony-Browse-Admin-Guide>Harmony-Endpoint-Logs , watching couple of videos and setting up a trial instance of Harmony Browse (aka SBA4B) I'm confused if forwarding logs to on-prem Check Point is available. If not available today, is t in the committed roadmap? Thanks!

Re: Harmony Browse log forwarding to on-prem SmartCenter

PhoneBoy — Thu, 15 Dec 2022 15:50:06 GMT

Pretty sure we support forwarding to a SIEM, though that’s an extra cost item.
Don’t believe you can currently ingest logs from any of our Infinity Portal hosted offerings into your local management/log server.
Recommend discussing your precise requirements with your local Check Point office.

Re: Harmony Browse log forwarding to on-prem SmartCenter

Sergej_Gurenko — Thu, 15 Dec 2022 16:12:10 GMT

It seems there is some progress towards this, at least for other products of the Harmony family making steps towards SmartCenter integration. Below is some recent news from Harmony Connect What's new sk155574

October 13th, 2022 SmartConsole Management for Harmony Connect is available > Enabling SmartConsole Management > Note: Harmony Connect logs continue to be stored in the cloud.

Re: Harmony Browse log forwarding to on-prem SmartCenter

PhoneBoy — Thu, 15 Dec 2022 19:32:22 GMT

We support connecting your on-prem management to Infinity Portal.
This is required for several offerings, including SD-WAN, XDR, SOC, and others.
In the case of Harmony Connect, it's optional and allows you to manage your access policy using your on-prem management.

Re: Harmony Browse log forwarding to on-prem SmartCenter

dt7 — Tue, 20 May 2025 10:27:27 GMT

Hello @PhoneBoy, can I ask a follow-up question on this comment of yours? I have a similar question to this post but the other way around, and it relates to your reply.

For example, if I have a Harmony Endpoint on-prem setup, I see that it is possible to forward logs externally. I was wondering if I can use that to forward logs to Infinity portal directly, and have those logs compatible for use by Infinity XDR or PlayBlocks on the Infinity Portal? Or is it achieved via the Log Exporter? (https://sc1.checkpoint.com/documents/Log_Exporter/EN/Content/Topics/Introduction.htm#Introduction)

Does that integration work via direct forward and will those on-prem log be understood by those Infinity Services? When checking the documentation on this it is not very clear to me. I did see that it is possible to forward logs to a third party SIEM as well (ex: Splunk, etc.). So alternatively, it means I need to forward my Harmony Endpoint on-prem logs to an external SIEM, that then forwards it to Infinity portal for Infinity XDR? Seems very convoluted...

https://sc1.checkpoint.com/documents/R82/SmartEndpoint_OLH/EN/Content/Topics-HEP/Logs-menu.htm?Highlight=forward

Supported products for security events mentioned "products you are subscribed to in Infinity Portal", so it's not very clear to me:

https://sc1.checkpoint.com/documents/Infinity_Portal/WebAdminGuides/EN/Events-Admin-Guide/Content/Topics-Events-Admin-Guide/Events-Dashboard.htm#supported_products

Thank you in advance for any help on this.

Regards.

Re: Harmony Browse log forwarding to on-prem SmartCenter

PhoneBoy — Tue, 20 May 2025 14:07:45 GMT

Yes, you can forward your on-prem logs to Infinity Portal to a service called Infinity Events: https://sc1.checkpoint.com/documents/Infinity_Portal/WebAdminGuides/EN/Events-Admin-Guide/Content/Topics-Events-Admin-Guide/Introduction.htm

However, I don't believe we require this in order to use some of the features.
We do require a connection to Infinity Portal, which is configured in SmartConsole.

When you set up the connection, you can also set up if logs and/or configuration from your local system is shared with Infinity Portal:

Re: Harmony Browse log forwarding to on-prem SmartCenter

dt7 — Wed, 21 May 2025 06:26:05 GMT

Thanks @PhoneBoy, this is very helpful.

In that case, can I assume that if you connect your on-prem Harmony Endpoint Management server to Infinity (either via Infinity portal config you mentioned or log forwarding), that shared config and logs will be able to be used by other Infinity cloud services, like Infinity XDR?

Thank you.

Re: Harmony Browse log forwarding to on-prem SmartCenter

PhoneBoy — Wed, 21 May 2025 13:39:21 GMT

Once you've connected your on-prem management with Infinity Portal, you can configure the individual services that will leverage this connection.
Log Forwarding is meant for SIEMs (not for importing into Infinity Portal).