topic Re: need checkpoint document that has details of all field that are in logs in General Topics

need checkpoint document that has details of all field that are in logs

Ankur_Datta — Fri, 26 Apr 2019 06:18:49 GMT

Hi All,

I am searching for a document that has details of all fields that are in log according to R80.10 version.

Can anyone please help me in this.

Thanks

Re: need checkpoint document that has details of all field that are in logs

Maik — Fri, 26 Apr 2019 06:40:19 GMT

The Logging & Monitoring R80 Admin Guide is probably what you are looking for.

Re: need checkpoint document that has details of all field that are in logs

Ankur_Datta — Fri, 26 Apr 2019 06:45:52 GMT

Thanks for reply Maik.

No i am not looking for logging and monitoring admin guide.

The requirement is client want to know all fields that are in log file so those can be used in SIEM tool to receive historical and real time logs.

I think the document is related to LEA.

i found old document but i need for R80.10 version.

Thanks

Re: need checkpoint document that has details of all field that are in logs

Maik — Fri, 26 Apr 2019 06:57:18 GMT

Ah okay, I see. Could you link the old document that you have found?

This would allow the community to understand more precisely what you are looking for. 🙂

Re: need checkpoint document that has details of all field that are in logs

masher — Fri, 26 Apr 2019 12:58:19 GMT

While I don't think that we have a published document for all fields available to log_exporter, there have been several posts already on Check Mates that cover some of this question.

It is also possible to review the LogFields.xml file as it includes the field definitions with a display name. It can be found in the /opt/CPrt-R80.*0/log_exporter/conf directory.

Re: need checkpoint document that has details of all field that are in logs

Cyber_Serge — Fri, 26 Apr 2019 13:51:00 GMT

This is a great collection of info, thank you for sharing! By any chance do we know where to find more additional view to import such as outlined in sk134634 SmartView's Cyber Attack View? I did a search but maybe my search criteria need to be refine/use correct key word.

Re: need checkpoint document that has details of all field that are in logs

Ankur_Datta — Thu, 02 May 2019 06:48:43 GMT

Sorry for late reply.

Here is link for document.

https://community.checkpoint.com/t5/Logging-and-Reporting/LEA-Fields/td-p/38365

Basically i am looking for control logs fields.

Can anyone please help me in this.

Thanks

Re: need checkpoint document that has details of all field that are in logs

Ankur_Datta — Thu, 02 May 2019 08:25:38 GMT

Thanks Masher,

The first link is not opening.

I am checking LogFields.xml file. i hope this should resolve my query.

Thanks