topic Re: Sandblast Agent / Mobile, logs. in Endpoint

Sandblast Agent / Mobile, logs.

vinceneil666 — Wed, 09 Sep 2020 11:47:47 GMT

hi,

Is it really like this, or am I missing something essential here ?

SandBlast Agent Cloud

Use SmartView cloud for reports/logs/views - but ONLY for SandBlast Agent.

As pr feedback from Check Point, it is not yet possible to export this to an excisting log server. (let say you have an on prem enviromet of firewalls etc.)

SandBlast Mobile Cloud

EVENTS still in Beta, and buggy as bugs can get.

As pr feedback from Check Point, it is not yet possible to export this to an excisting log server. (let say you have an on prem enviromet of firewalls etc.)

An option to "show in smartview" is show under "Events and Alerts" - we have yet to see an implementation where this work, allways show "page cannot be displayed.."-with some domain name info etc..

So If I have a customer, with a management server on prem, 10-15 firewalls, log servers..etc etc. He will have to pull up 3 different vies to view logs, create reports ..etc ? (one for the as is, one for agent and one for mobile)

Re: Sandblast Agent / Mobile, logs.

PhoneBoy — Fri, 11 Sep 2020 23:49:45 GMT

My understanding is that SandBlast Mobile should have an export via syslog function, which could be imported into an existing management server.
Also SandBlast Agent Cloud can export via Log Exporter, but it has to be configured by TAC and isn't meant for a Check Point log server, but a third party SIEM.
Unifying all this is on the roadmap.

Re: Sandblast Agent / Mobile, logs.

Kobie_Bendalak — Sun, 13 Sep 2020 08:34:23 GMT

SandBlast Agent supports it already, you can configure it yourself.

Go to SandBlast Agent Management Platform > EndPoint Settings > Export Events.

Re: Sandblast Agent / Mobile, logs.

PhoneBoy — Mon, 14 Sep 2020 04:19:06 GMT

Ah, you learn something new every day 🙂

Re: Sandblast Agent / Mobile, logs.

Julian_Sanchez — Fri, 09 Oct 2020 03:22:19 GMT

Hello,

How I can export my logs from Sandblast Agent Cloud to my Security Management on-premise?

I have SmartEvent and I want to correlate CloudGuardSaaS, Firewalls, and SandblastAgent Cloud

Is the same with log_exporter?

Re: Sandblast Agent / Mobile, logs.

vinceneil666 — Fri, 09 Oct 2020 07:14:15 GMT

As far as I know, unless they have updated the service recentley, you cant. Only SaaS can export - but the roadmap says it will be available after a while 🙂

Re: Sandblast Agent / Mobile, logs.

Kobie_Bendalak — Wed, 14 Oct 2020 09:09:43 GMT

You can export events to your on-premise enviorment, be advised it's not a native integration.

You can export your events in the following formats: SYSLOG, CEF, LEEF, SPLUNK.

Go to SBA mgmt. platform > End Point Settings > Export Events