topic Re: Does Check Point support Web Browser Agent Logging? in Firewall and Security Management

Does Check Point support Web Browser Agent Logging?

Gareth_Kik — Wed, 10 Jul 2019 13:35:38 GMT

We want to find Web Browser User Agent details in to the logging. I mean this info, picture below:

In the Application/URL Filtering logging events, I can see only "Web browser" name eg Chrome, but not the full Web Browser User Agent info.

Can we somehow log this in the rules or it is not supported feature?

Re: Does Check Point support Web Browser Agent Logging?

Nick_Doropoulos — Wed, 10 Jul 2019 18:04:18 GMT

Hi Gareth_Kik,

I believe your best bet is extended logging on the relevant rules. Is that something you have put in place already?

Thanks.

Re: Does Check Point support Web Browser Agent Logging?

Gareth_Kik — Wed, 10 Jul 2019 18:36:32 GMT

Yes, it shows only what browser was used, for example "Chrome", that's all. No details regarding Web browser user agent.

Re: Does Check Point support Web Browser Agent Logging?

Chris_Atkinson — Sat, 13 Jul 2019 03:05:16 GMT

I seem to recall the mobile security checkup report in SmartEvent leveraged something similar, perhaps look at the fields/filters it uses and dig into the logs for this detail.

I will revert after i've had a chance to check further myself but you may get to it before me.

Re: Does Check Point support Web Browser Agent Logging?

Gareth_Kik — Fri, 12 Jul 2019 15:26:58 GMT

Any news? Maybe it is something that should do Web Security Gateway / Proxy server that is specific for URL filtering and not for NG Firewall. Can you comment?

Re: Does Check Point support Web Browser Agent Logging?

Chris_Atkinson — Sat, 13 Jul 2019 10:57:40 GMT

I've reviewed some logs in my demo environment, the following Log card details may help...

Section: Application / Site
Fields: Client Type

Section: Web Traffic
Fields: User Agent, Client Type OS