topic Re: Notify logins by email in Firewall and Security Management

Notify logins by email

Matlu — Thu, 08 Jan 2026 17:24:22 GMT

Hello, community.

Is there a way to receive email notifications when someone logs in or out of my Check Point FW via WebUI and SSH?

We want to receive an alert in our personal @gmail emails... so we can be “aware” of an administrator's access to our FW, whether they are logging in through GAIA PORTAL or through SSH to the device.

We currently have a FW managed from Smart-1 Cloud.

Thank you for your comments.

Re: Notify logins by email

the_rock — Thu, 08 Jan 2026 18:02:01 GMT

I know we do that through SIEM.

Re: Notify logins by email

Vincent_Bacher — Thu, 08 Jan 2026 18:05:20 GMT

afaik, there is no native, out-of-the-box functionality in Check Point to send email notifications on administrator logins or logouts (Gaia WebUI or SSH), for both on-prem management and Smart-1 Cloud.

Administrator access is recorded in the Audit logs. By forwarding these logs using Log Exporter to an external system that supports events and actions, such notifications can be implemented.

For example:

Export Audit logs via Log Exporter to a syslog server
Ingest them into an analytics platform (e.g. Elastic Stack)
Use alerting features (e.g. Watcher) to generate email notifications

As we don’t use Smart-1 cloud please anybody correct me if I am wrong.

Re: Notify logins by email

Matlu — Thu, 08 Jan 2026 18:13:43 GMT

Hello.

In my scenario, where should the LOG EXPORTER be “configured”?

Because I only have full access to the FW, but not to the Smart-1 Cloud.

Is it possible that by configuring the LOG EXPORTER, we can “decide” which logs to send to the server?

Since we are only interested in the “Log in” and “Log out” that certain administrators do on our FW.

Re: Notify logins by email

the_rock — Thu, 08 Jan 2026 18:15:53 GMT

Hey bro,

This would be file you need to modify for those things once all is configured. Example in my lab:

[Expert@CP-MANAGEMENT:0]# cd /opt/CPrt-R82/log_exporter/
[Expert@CP-MANAGEMENT:0]# cd targets/
[Expert@CP-MANAGEMENT:0]# ls
SentinelOne-XDR test-log
[Expert@CP-MANAGEMENT:0]# more SentinelOne-XDR/

*** SentinelOne-XDR/: directory ***

[Expert@CP-MANAGEMENT:0]# cd SentinelOne-XDR/
[Expert@CP-MANAGEMENT:0]# ls
conf data fieldsMapping.xml log log_exporter log_indexer_custom_settings.conf targetConfiguration.xml tmp
[Expert@CP-MANAGEMENT:0]# more targetConfiguration.xml
<?xml version="1.0" encoding="utf-8"?>
<export id="targetObjectUID">
<version>9</version> 
<is_enabled>true</is_enabled>

<destination type="syslog"> 
<ip>172.16.10.108</ip>
<port>8002</port>
<protocol>udp</protocol>
<local_addr_ip></local_addr_ip>

<transport>
<security></security>

<pem_ca_file></pem_ca_file>
<p12_certificate_file></p12_certificate_file>
<client_certificate_challenge_phrase></client_certificate_challenge_phrase>
</transport>
<reconnect_interval></reconnect_interval>
</destination>

<data_enrichment>
<export_domain>false</export_domain>
<export_orig_log_server>false</export_orig_log_server>
</data_enrichment>

<dynamicFilter>conf/FilterConfiguration.xml</dynamicFilter>

<source>
<log_files>1</log_files>
<log_types></log_types>
<folder></folder>
<read_mode>semi-unified</read_mode>
</source>
<export_log_position>false</export_log_position> 
<export_log_link>false</export_log_link> 
<export_attachment_link>false</export_attachment_link> 
<export_link_ip></export_link_ip> 
<export_attachment_ids>false</export_attachment_ids> 

<format type="syslog"> 
<resolver>
<mappingConfiguration></mappingConfiguration>
<exportAllFields>true</exportAllFields> 
</resolver>

<formatHeaderFile></formatHeaderFile>
</format>

<time_in_milli>false</time_in_milli>

<skip_failed_logs>false</skip_failed_logs>

<filter filter_out_by_connection="false">
<field name="product">
<value>VPN-1 & FireWall-1</value>
<value>HTTPS Inspection</value>
<value>VPN-1</value>
<value>Security Gateway/Management</value>
<value>Firewall</value>
<value>FG</value>
</field>
<field name="fw_subproduct">
<value>VPN-1 & FireWall-1</value>
<value>HTTPS Inspection</value>
<value>VPN-1</value>
<value>Security Gateway/Management</value>
<value>Firewall</value>
<value>FG</value>
</field>
</filter>

</export>

[Expert@CP-MANAGEMENT:0]#

Re: Notify logins by email

Matlu — Thu, 08 Jan 2026 18:19:52 GMT

Is LOG EXPORTER configured in Management?

So in my scenario, should I seek support from TAC?

I have no way to access my Smart-1 Cloud Tenant via CLI. 😑

Re: Notify logins by email

the_rock — Thu, 08 Jan 2026 18:22:27 GMT

You can configure it in smart console, will take a video and share.

Re: Notify logins by email

Vincent_Bacher — Thu, 08 Jan 2026 18:23:08 GMT

https://sc1.checkpoint.com/documents/Infinity_Portal/WebAdminGuides/EN/Check-Point-SmartCloud-Admin-Guide/Topics-Smart-1-Cloud/Using-the-Settings.htm

i researched by mobile so no guarantee but maybe you can check this guide to see how log forward to siem is configured in the cloud.

Re: Notify logins by email

the_rock — Thu, 08 Jan 2026 18:33:24 GMT

@Matlu

(view in My Videos)

Re: Notify logins by email

Vincent_Bacher — Thu, 08 Jan 2026 18:42:02 GMT

Nice

Re: Notify logins by email

the_rock — Thu, 08 Jan 2026 18:44:22 GMT

I always feel video is good reference.

Re: Notify logins by email

Matlu — Thu, 08 Jan 2026 18:47:02 GMT

Thanks for the tip. 😊😁

I'll give it a try. 🤗

Re: Notify logins by email

Vincent_Bacher — Thu, 08 Jan 2026 18:48:18 GMT

100 % agree.
I would do that too, but since it's a bit more complicated for us (as is everything, really), I can only do so in very few cases and have to limit myself to text and links.

Re: Notify logins by email

the_rock — Thu, 08 Jan 2026 18:52:20 GMT

Excellent.

Re: Notify logins by email

the_rock — Thu, 08 Jan 2026 18:53:10 GMT

I totally get it. I do it since its a lab anyway, so nothing secretive...at least that I know of 😂😂

Re: Notify logins by email

Vincent_Bacher — Thu, 08 Jan 2026 18:59:52 GMT

Even setting up a lab is complicated for us. 😉

Re: Notify logins by email

the_rock — Thu, 08 Jan 2026 19:27:25 GMT

I get it, too many regulations, right? : - )

Re: Notify logins by email

Matlu — Thu, 08 Jan 2026 19:49:19 GMT

The option works well but in on-premise environments, because it turns out that in Smart-1 Cloud, I don't have the Management “object” option in SmartConsole.

It seems that at this point, I have to rely on TAC. 😅

Re: Notify logins by email

Vincent_Bacher — Thu, 08 Jan 2026 19:50:07 GMT

That too. And above all, overly complicated processes.
(At least if you want to make it official 😉 )

Re: Notify logins by email

the_rock — Thu, 08 Jan 2026 22:02:28 GMT

Forgot about that, sorry mate. Yes, then TAC would be needed.