Pull FDE information into SIEM

Jappie — Mon, 13 Aug 2018 10:18:08 GMT

Hello Check Point community,

I have a question regarding Endpoint security and FDE. We want to pull the following information from the endpoint management server (R77.30.03):

Which machine has which authorized preboot users.

We need to pull this information in a automated way and not use the SmartConsole GUI.

I have searched the manuals and CLI reference guide but couldn't find this. Does anyone have a solution for this?

Thanks.

Re: Pull FDE information into SIEM

PhoneBoy — Fri, 17 Aug 2018 13:11:15 GMT

As far as I know, Endpoint Management does not currently have CLI/API commands for querying most of the configuration.

That said, assuming the information is logged, I assume as long as we export the relevant data, it would go to your SIEM.

Can you describe a bit more about your environment and exactly what you're trying to accomplish?