topic Re: How do you send CheckPoint log to ELK? in General Topics

How do you send CheckPoint log to ELK?

Wang — Fri, 25 Oct 2019 07:04:06 GMT

Hello, engineers,How do you send CheckPoint log to ELK?Thank you very much for your support

Re: How do you send CheckPoint log to ELK?

Nick_Doropoulos — Fri, 25 Oct 2019 09:45:01 GMT

Hey Wang,

You might want to have a look at the documentation provided by @PhoneBoy in the link below:

https://community.checkpoint.com/t5/Logging-and-Reporting/Exporting-R80-10-logs-to-Logstash-ElasticSearch-integration/m-p/5595#M607

I hope this helps.

Re: How do you send CheckPoint log to ELK?

Wang — Fri, 25 Oct 2019 12:33:17 GMT

Thank you very much

Re: How do you send CheckPoint log to ELK?

Nick_Doropoulos — Fri, 25 Oct 2019 12:34:56 GMT

No problem at all, if you could accept it as a solution and give a kudos even it would be much appreciated 🙂

Re: How do you send CheckPoint log to ELK?

PhoneBoy — Fri, 25 Oct 2019 15:40:57 GMT

The problem with this thread is it's still being done with LEA.
Really, you should be using Log Exporter to do this.
I presume ELK can take logs over syslog?
Whether it can parse them is a different story.

Re: How do you send CheckPoint log to ELK?

FedericoMeiners — Fri, 25 Oct 2019 19:19:42 GMT

Log Exporter works like a charm to send logs to ELK, I used syslog in one of our customers.

As PhoneBoy said, true challenge is on the parsing side. I suggest you to look the new SIEM feature from the ELK team, maybe it has some nive out of the box parsers.

Re: How do you send CheckPoint log to ELK?

Wang — Tue, 29 Oct 2019 06:28:00 GMT

Thank you