topic Re: Logs - API in API / CLI Discussion

Logs - API

Joshua_Boerum — Tue, 12 Jul 2016 20:15:02 GMT

Are the logs accessible via the API?

-Josh

Re: Logs - API

Uri_Bialik — Wed, 13 Jul 2016 19:58:26 GMT

R80 does doesn't have APIs that can read logs.

This is on our to-do list for a future release.

Re: Logs - API

Rasool_Irfan — Fri, 26 May 2017 07:57:01 GMT

Does checkpoint support open and standard API to export internal logs and security events to SIEM

Re: Logs - API

PhoneBoy — Fri, 26 May 2017 15:19:23 GMT

A number of third party SIEMs support pulling logs from Check Point management devices.

It is done through the Log Export API (LEA), which is part of the OPSEC SDK.

fw1-loggrabber is an open source tool that pulls logs from Check Point devices.

Re: Logs - API

Julie_Paul — Tue, 27 Oct 2020 13:57:27 GMT

Yes we do today in R80.40 with latest JHF and with R81. Check out https://sc1.checkpoint.com/documents/latest/APIs/index.html#cli/show-logs~v1.6.1%20

Re: Logs - API

Douglas_Rich — Mon, 20 Jun 2022 22:27:52 GMT

Will the API ever support grabbing logs by specific position, similar to how it was done with the OPSEC LEA... position as in the epoch value tracked by fw.logtrack?

Currently the API only supports custom-start and custom-end with ISO8601 format, which isn't very helpful when you want to write code making it impossible to miss a single log or avoid creating duplicates.

Maybe I'm missing something??

Re: Logs - API

PhoneBoy — Tue, 21 Jun 2022 01:44:59 GMT

The logs API as it exists today is more about pulling specific logs versus streaming, which is what OPSEC LEA does.
Perhaps in the future we will have a different endpoint for streaming the logs beyond using Log Exporter.