topic Re: CheckPoint Umbrella Integration in Firewall and Security Management

CheckPoint Umbrella Integration

D_W — Tue, 31 May 2022 14:16:59 GMT

Hi Mates,

anyone here that uses the Cisco Umbrella CheckPoint Integration?

https://support.umbrella.com/hc/en-us/articles/231248788

We're here on GW R80.40 and Management R81.10. Script is located in $FWDIR/bin on the Gateway. UserAlert1 is defined in GlobalProperties and a ThreatPrevention Rule is set to execute UserAlert1 when matched. But issue is that the script never gets triggered.

Manually execution of the script show's that it is communication with the Umbrella destination.
Every hint is very much appreciated 🙂 !

Cheers,

David

Re: CheckPoint Umbrella Integration

the_rock — Tue, 31 May 2022 14:38:55 GMT

Just a shot in the dark here, but do you see any relevant logs in dashboard? Anything related to script not being executed? If there is specific IP related to Cisco side, you can always try run fw ctl zdebug + drop | grep x.x.x.x on CP fw (just replace with relevant IP address)

Andy

Re: CheckPoint Umbrella Integration

D_W — Tue, 31 May 2022 14:47:20 GMT

I see a log to 67.215.70.75 (s-platform.api.opendns.com) when I manually execute the script.

I see the Threat Prevention rule matches and a log is generated with Type "Alert" but not log that shows outgoing traffic to 67.215.70.75.
Also I added some code that writes into a file when the script is running for logging if the script was executed or not but nothing...

Re: CheckPoint Umbrella Integration

the_rock — Tue, 31 May 2022 15:09:48 GMT

any errors?

Andy

Re: CheckPoint Umbrella Integration

D_W — Tue, 31 May 2022 15:11:19 GMT

No - are you aware of any CheckPoint Log File for the Tracking with "UserAlert1"?

Re: CheckPoint Umbrella Integration

the_rock — Tue, 31 May 2022 16:00:41 GMT

Have not seen it in a while.

Re: CheckPoint Umbrella Integration

PhoneBoy — Tue, 31 May 2022 16:17:32 GMT

Do the scripts exist on the gateways and can you confirm they execute correctly?

Re: CheckPoint Umbrella Integration

D_W — Wed, 01 Jun 2022 07:09:09 GMT

Yes I can confirm that the script is on the GW and executes correctly when started manually... see below the details of the script and what comes back when I send bogus information executed manually.
In the curl_cli I had to add "-k" because the Let'SEncrypt Cert cannot be validated by the GW 😑

Re: CheckPoint Umbrella Integration

starmen2000 — Mon, 20 Nov 2023 09:31:03 GMT

Do you solve the problem?

Re: CheckPoint Umbrella Integration

6a8496cf-c878-4 — Wed, 22 Nov 2023 13:46:27 GMT

I'm also interested in the solution.