topic Re: Check Point Integration with FortiSIEM solution in Firewall and Security Management

Check Point Integration with FortiSIEM solution

FD — Tue, 02 Jun 2020 07:11:18 GMT

Hello members,

i have Checkpoint security firewall and would like to integrate it with FortiSIEM solution i need help as it is my first time to implement.

thanks

Re: Check Point Integration with FortiSIEM solution

_Val_ — Tue, 02 Jun 2020 13:28:19 GMT

If it takes syslog, jsut use log exporter

Re: Check Point Integration with FortiSIEM solution

egas84 — Wed, 07 Sep 2022 12:55:19 GMT

Hi,

Did you manage to integrate the logs in fortisiem via Log exporter? Is the parser correct? Can you share the settings you used?

Thanks

Re: Check Point Integration with FortiSIEM solution

peroskhan — Tue, 17 Sep 2024 16:42:24 GMT

Hi,

can you share the settings to integrate with FortiSiem

Re: Check Point Integration with FortiSIEM solution

AkosBakos — Tue, 17 Sep 2024 17:18:16 GMT

What do you mean under settings?

This is the original SK: https://support.checkpoint.com/results/sk/sk122323

You can setup based on your needs. Usually we send syslog to FortiSien, and the SIEM will parse the logs.

Have a look at in this:

https://docs.fortinet.com/document/fortisiem/7.1.4/external-systems-configuration-guide/335430/check-point-firewall-1

You need to send syslog in CEF format according to this sample:

cp_log_export add name <Name> [domain-server {mds | all}] target-server <HostName or IP address of Target Server> target-port <Port on Target Server> protocol {udp | tcp} format {syslog | splunk | cef | leef | generic | json | logrhythm | rsa} [<Optional Arguments>]

Re: Check Point Integration with FortiSIEM solution

egas84 — Tue, 17 Sep 2024 17:20:05 GMT

Hi,

I use the following:
cp_log_export add name FortiSiem target-server x.x.x.x target-port 514 protocol udp format cef
cp_log_export restart name FortiSiem

Regards,

Re: Check Point Integration with FortiSIEM solution

Lesley — Tue, 17 Sep 2024 18:01:16 GMT

https://sc1.checkpoint.com/documents/R81.10/WebAdminGuides/EN/CP_R81.10_LoggingAndMonitoring_AdminGuide/Topics-LMG/Log-Exporter-Configuration-in-SmartConsole.htm?tocpath=Log%20Exporter%7C_____2

Start with above and then:

https://support.checkpoint.com/results/sk/sk122323

Better to create object in SmartConsole. Before you always had to start from CLI but that changed and made it more easy. Still can do all via CLI but via GUI is better.

If all changes are done check with tcpdump if you see traffic being send out. tcpdump -nni any host IP port 514

Re: Check Point Integration with FortiSIEM solution

the_rock — Tue, 17 Sep 2024 18:11:14 GMT

The sk given by Akos and Lesley is your best bet.

Andy