topic Re: Logs to SIEM issues in Firewall and Security Management

Logs to SIEM issues

yrsweetspt — Mon, 21 Feb 2022 09:05:19 GMT

Hello,

We have recently integrated our CheckPoints with arcsight, though the siem receives less than expected logs.

Also, it seems like the logs that are being sent are over 4000 chars, thus they are not readable.

Have you any idea why is this happening?

Re: Logs to SIEM issues

_Val_ — Mon, 21 Feb 2022 11:49:53 GMT

Let's start from the basics. Are you using LogExporter from sk122323?

Re: Logs to SIEM issues

yrsweetspt — Mon, 21 Feb 2022 12:07:15 GMT

Yes, exactly, we are using log exporter.

Re: Logs to SIEM issues

_Val_ — Mon, 21 Feb 2022 14:50:46 GMT

Good. Look at the SK and check which parameters to enable.

I did not understand what you mean when saying: "...it seems like the logs that are being sent are over 4000 chars, thus they are not readable."

Can you elaborate?

Re: Logs to SIEM issues

Timothy_Hall — Mon, 21 Feb 2022 15:07:56 GMT

When you say "less than expected logs" are you referring to logs involving Threat Prevention? If so this is related to log suppression which can impact SIEMs, see slides 13-19 of my CPX 2022 presentation "Max Gander: The Hidden World of Log Suppression & Generation on Check Point":

https://community.checkpoint.com/t5/Member-Exclusive-Content/Max-Gander-The-Hidden-World-of-Log-Generation-and-Log/m-p/139699

It might also be related to Connection vs. Session logging which is also covered.