topic Re: process_name log field in Endpoint

process_name log field

gm446 — Mon, 05 Feb 2024 10:36:07 GMT

Hello Everyone,

As part of implementing SIEM solution in our organization i got a request from the CISO to log from the endpoint what process generates traffic.
i can see in sk144192 that there is a "process_name" field under "Harmony Endpoint - Common Fields".

unfortunately, i cannot find this field in actual logs for firewall, TP, Anti-Malware or Anti-Bot blades. is there anything specific i should enable for the client to log this information?

Best Regards,
Yossi.

Re: process_name log field

the_rock — Mon, 05 Feb 2024 12:07:06 GMT

Hey Yossi,

Let me check this in the lab later.

Best,

Andy

Re: process_name log field

the_rock — Mon, 05 Feb 2024 13:41:27 GMT

Sorry, just working on some Azure stuff now, but have you tried below query to see if it yields anything?

Andy

blade:"Endpoint Compliance"

Re: process_name log field

gm446 — Mon, 05 Feb 2024 13:47:42 GMT

this query is works of course, but i cannot see how it is related to my issue 🙂

Thank you.

Re: process_name log field

the_rock — Mon, 05 Feb 2024 13:52:13 GMT

No no, I get that, I was just curious if it worked or not. I will check again in a bit, but you may want to open the support case in the meantime to confirm.

Andy

Re: process_name log field

PhoneBoy — Mon, 05 Feb 2024 21:25:44 GMT

process_name refers to the (potentially) malicious process that is being blocked, not the blade that blocked it.
Based on this SK, it would seem we don't log which blade is responsible for the block, though it can be inferred from the other fields included.

Re: process_name log field

gm446 — Tue, 06 Feb 2024 07:58:37 GMT

Hi PhoneBoy,

this is exactly the information i need, the process who is made the traffic and being blocked/allow.

Best Regards,
Yossi.

Re: process_name log field

the_rock — Tue, 06 Feb 2024 12:04:42 GMT

Did you end up opening TAC case to see if you can verify that info, if its possible?

Best,

Andy

Re: process_name log field

PhoneBoy — Tue, 06 Feb 2024 19:16:06 GMT

The only place it would show...when it is relevant...is in the full log card.
In any case, you may need to consult with TAC here: https://help.checkpoint.com

Re: process_name log field

gm446 — Wed, 07 Feb 2024 11:12:55 GMT

Thank you all, i opened a ticket and wait for an answer.

Re: process_name log field

the_rock — Wed, 07 Feb 2024 12:22:42 GMT

Let us know what they say.

Best,

Andy

Re: process_name log field

gm446 — Wed, 03 Apr 2024 10:51:30 GMT

After TAC investigation my request is not possible. so we achieve this logs through Sysmon.