topic Re: Logs for SandBlast Agent Cloud in Endpoint

Logs for SandBlast Agent Cloud

Julian_Sanchez — Thu, 15 Oct 2020 02:12:43 GMT

Hello,

Anyone know how send the logs the SandBlast Agent Cloud to log server on-premise?

I was searching and only found export log to third-parties Splunk, Arcsight, QRadar with log_exporter but if I dont have a SIEM how I have the logs in my SMS on-premise?

Regards,

Julian S.

Re: Logs for SandBlast Agent Cloud

Kobie_Bendalak — Thu, 15 Oct 2020 07:11:20 GMT

@Julian_Sanchez At this time this is your only option, there's no native integration to an on-premise SmartEvent - you could use Syslog (but it has drawbacks and limitations).

A major item on our short-term roadmap.

Re: Logs for SandBlast Agent Cloud

Julian_Sanchez — Thu, 15 Oct 2020 21:55:38 GMT

Hello Kobie,

Thank you for the information. I hope CheckPoint can integrante it.

Re: Logs for SandBlast Agent Cloud

Luiz_ — Sun, 20 Feb 2022 15:42:31 GMT

Hi there!

Do we have updates on this?

Customer has a Quantum 6200 cluster connected to a virtual SMS/SmartEvent on-premise. He wants to purchase Harmony Endpoint unless if there's a way to send EPMaaS logs to his SMS/SmartEvent on-premise to have all information about his network/endpoints on the same SmartEvent.

The closer I saw about this was this SK, not sure if it works. At the very least would need TAC to setup things on the EPMaaS side: https://supportcenter.checkpoint.com/supportcenter/portal?eventSubmit_doGoviewsolutiondetails=&solutionid=sk35288&partition=Basic&product=SmartEvent

Re: Logs for SandBlast Agent Cloud

_Val_ — Mon, 21 Feb 2022 07:28:20 GMT

Why don't you take this with your local Check Point office? This is obviously a sales engineering question. Let them help you.

Re: Logs for SandBlast Agent Cloud

Chris_Atkinson — Mon, 21 Feb 2022 07:49:20 GMT

@_Val_ is correct this likely requires an RFE and isn't a one size fits all solution.

* Some might like logs directly to their SIEM.

* Some might prefer an on-prem policy server to forward logs to SmartEvent.

* Some might prefer direct SmartEvent integration.

The later will likely occur first via a cloud hosted option.