topic Re: Export log from 6200 appliance to SIEM Server in Firewall and Security Management

Export log from 6200 appliance to SIEM Server

Mk_83 — Wed, 30 Oct 2024 08:56:01 GMT

Hello everyone,

Currently, I have question about export log from the 6200 appliance (security log + system log) to Splunk server.

Product: 6200 appliance + cluster + distributed manage by Smart-1 Cloud
Version: R81.20 take 84

Cluster 6200 placed at HO ; The Splunk server placed at our Data Center.
The Splunk server is the internal server => can't public (our internal policy + high risk) => can't use Smart-1 Cloud export log to it (Smart-1 Cloud require to public server if you want export log to it).
The only way is export log direct from 6200 cluster to Splunk Server using VPN tunnel. But I can't find any feature or document say about it.
Does anyone facing this problem before? Please help me.

Noted: My company already using 12 SMB appliance and it's have the feature External Log Servers > add syslog server (I used this feature export log to Splunk Server through VPN tunnel)

Thanks & Best Regards,

Do Nhat Kha

Re: Export log from 6200 appliance to SIEM Server

PhoneBoy — Wed, 30 Oct 2024 21:08:04 GMT

You can export Firewall (not other blade logs) directly from a gateway.
See: https://support.checkpoint.com/results/sk/sk87560

For logs from other blades, you are subject to the restrictions of Smart-1 Cloud.

Re: Export log from 6200 appliance to SIEM Server

Mk_83 — Thu, 31 Oct 2024 04:28:40 GMT

Thank you, I will try the sk87560 that you suggest and will respond with results later today.

Re: Export log from 6200 appliance to SIEM Server

JP_Rex — Thu, 31 Oct 2024 06:26:00 GMT

Another solution might be to setup a dedicated log server (CPSM-NGSM5-LOG). Not cheap ,but you can place it where you need it.

Regards

Peter

Re: Export log from 6200 appliance to SIEM Server

PhoneBoy — Thu, 31 Oct 2024 16:14:41 GMT

Don't believe this is possible with Smart-1 Cloud, but I'll double check.