topic Re: Is there any API endpoint to retrieve or query raw logs (also suppressed logs) in API / CLI Discussion

Is there any API endpoint to retrieve or query raw logs (also suppressed logs)

Oscar_Bernat — Fri, 22 Jan 2021 16:09:07 GMT

Re: Is there any API endpoint to retrieve or query raw logs (also suppressed logs)

PhoneBoy — Fri, 22 Jan 2021 17:28:24 GMT

R80.40 JHF and R81, yes.
https://sc1.checkpoint.com/documents/latest/APIs/index.html#cli/show-logs~v1.7
If you want all logs, you’re better off using something like Log Exporter.

Re: Is there any API endpoint to retrieve or query raw logs (also suppressed logs)

Oscar_Bernat — Mon, 25 Jan 2021 08:04:54 GMT

We have been working with the show-logs API endpoint but suppressed logs are not accessible.

Do you mean that using the log exporter we can export all logs, even suppressed logs?

We integrated the logs with Splunk without luck, the suppressed logs are not being forwarded.

We have followed this integration document https://sc1.checkpoint.com/documents/App_for_Splunk/html_frameset.htm?topic=documents/App_for_Splunk/207353

Can the SIEM integration be changed to forward raw logs (also suppressed logs)?

Thanks!

Re: Is there any API endpoint to retrieve or query raw logs (also suppressed logs)

PhoneBoy — Mon, 25 Jan 2021 08:15:48 GMT

As I just posted in your other thread, suppressed logs are suppressed from being written anywhere.
Which means the logs simply don't exist, no matter how you might want to acquire them.
If you need those logs, you have to disable log suppression.

Re: Is there any API endpoint to retrieve or query raw logs (also suppressed logs)

Oscar_Bernat — Fri, 29 Jan 2021 07:56:59 GMT

Thanks a lot!!