topic Re: Log Exporter filter in Firewall and Security Management

Log Exporter filter

snghoshi — Thu, 28 May 2020 18:12:06 GMT

Hi, I'm experiencing issues with filtering the logs to export to my external Syslog server from the R80.40.

It seems like any filtering command/option that I enter then all export stops. I am trying to not export traffic events(allowed or denied traffic).

Can someone please share sample config or syntax that I can use?

Re: Log Exporter filter

PhoneBoy — Sun, 31 May 2020 05:09:27 GMT

I think there is a few examples (or a link to an SK with them) here: https://community.checkpoint.com/t5/Logging-and-Reporting/Log-Exporter-Filtering/m-p/10359

Re: Log Exporter filter

Dan_Zada — Tue, 02 Jun 2020 08:54:03 GMT

Can you please share the commend/filter configuration you used?

Thanks!

Re: Log Exporter filter

Shay_Hibah — Tue, 02 Jun 2020 09:23:10 GMT

Hi,

From your question I can only guess that:

1. Maybe your filtering file is incorrect.

2. Maybe you use a wrong field names to filter on and therefore not traffic is seen on your syslog server.

Can you please share your filterConfiguration.xml and targetConfiguration.xml files?

Shay

Re: Log Exporter filter

snghoshi — Wed, 03 Jun 2020 16:38:28 GMT

Hi All,

here is my targetConfiguration.xmll file

The logs are indeed coming through however, i am also receiving connection logs. i.e accepted traffic connections.

<?xml version="1.0" encoding="utf-8"?>
<export id="targetObjectUID">
<version>5</version> 
<is_enabled>true</is_enabled>

<destination type="syslog"> 
<ip>x.x.x.x</ip>
<port>1514</port>
<protocol>udp</protocol>

<transport>
<security></security>

<pem_ca_file></pem_ca_file>
<p12_certificate_file></p12_certificate_file>
<client_certificate_challenge_phrase></client_certificate_challenge_phrase>
</transport>
</destination>

<dynamicFilter>conf/FilterConfiguration.xml</dynamicFilter>

<source>
<log_files>1</log_files>
<log_types></log_types>
<folder></folder>
<read_mode>raw</read_mode>
</source>
<export_log_link>true</export_log_link> 
<export_attachment_link>false</export_attachment_link> 
<export_link_ip></export_link_ip> 

<format type="cef"> 
<resolver>
<mappingConfiguration></mappingConfiguration>
<exportAllFields>true</exportAllFields> 
</resolver>

<formatHeaderFile></formatHeaderFile>
</format>

<!-- The following section is for future use of log filtering, please do not modify these values -
->
<filter filter_out_by_connection="true">
<field name="product">
<value>VPN-1 & FireWall-1</value>
<value>HTTPS Inspection</value>
<value>VPN-1</value>
<value>Security Gateway/Management</value>
<value>Firewall</value>
<value>FG</value>
</field>
<field name="fw_subproduct">
<value>VPN-1 & FireWall-1</value>
<value>HTTPS Inspection</value>
<value>VPN-1</value>
<value>Security Gateway/Management</value>
<value>Firewall</value>
<value>FG</value>
</field>
</filter>

</export>

Re: Log Exporter filter

Shay_Hibah — Wed, 03 Jun 2020 19:46:51 GMT

Hi,

Your target configuration looks OK.
Can you please share your FilterConfiguration.xml file?
I also want to make sure you have configured it correctly.

Thanks,
Shay

Re: Log Exporter filter

snghoshi — Thu, 04 Jun 2020 06:33:39 GMT

here is my FilterConfiguration.xml

<filters>
<filterGroup operator="and">
<field name="action" operator="and">
</field>
<field name="origin" operator="and">
</field>
<field name="product" operator="and">
</field>
</filterGroup>
</filters>
~

Re: Log Exporter filter

Shay_Hibah — Thu, 04 Jun 2020 06:41:42 GMT

Based on those 2 files it looks that you did not filter anything out and you should see all your logs in syslog server.

1. is that the case? if so, what do you want to filter?
2. If not, lets take it offline you and I (shayhi@checkpoint.com).

Shay

Re: Log Exporter filter

Cody_Von_Seelen — Mon, 28 Sep 2020 20:21:22 GMT

Per SK160754 it states that Filtering is not supported yet on R80.40.

Has this changed?

https://supportcenter.checkpoint.com/supportcenter/portal?eventSubmit_doGoviewsolutiondetails=&solutionid=sk160754

Log Exporter SK122323 also states:

Filtering: choose what to export based on field values.
(Note: Filtering ability is integrated to Jumbo Hotfix Accumulator for R80.30 since Take_107, and to Jumbo Hotfix Accumulator for R80.20 since Take_103.)

Re: Log Exporter filter

Yaakov_Ohayon — Tue, 29 Sep 2020 06:18:32 GMT

@Cody_Von_Seelen

You are totally right, Log Exporter filtering is supported in R80.40 and the documentation should be updated.

Thank you for noticing.

Re: Log Exporter filter

Svendsen — Wed, 17 Mar 2021 14:58:41 GMT

But have the SK been updated yet - thats the question 🙂

Re: Log Exporter filter

Yaakov_Ohayon — Thu, 18 Mar 2021 14:07:42 GMT

The SK will be updated in few days, we changed more sections there and added more details about new functionalities.