What log events can CheckPoint Blades produce?

Roland_Eschenbu — Fri, 17 Nov 2017 16:02:43 GMT

As part of our corporate security monitoring initiatives we need to review all the possible log messages that can be produced by the platform across all the main blades e.g. VPN, IPS, URL Filtering, FW, Application Control etc. We currently feed all events in to our own SIEM and SOC and we require information of all possible events that can be produced by the Checkpoint Platform to the level of detail such as that from vendors like Cisco e.g. https://www.cisco.com/c/en/us/td/docs/security/asa/syslog/b_syslog.html

Many thanks,

Roland

Re: What log events can CheckPoint Blades produce?

PhoneBoy — Fri, 21 Jun 2019 09:03:05 GMT

There are a couple of different types of log messages:

Syslog from the OS: Check Point Gaia Syslog Messages Reference Guide
The security logs: These are typically imported via LEA. Much of the information we make available via LEA is here: LEA Fields‌

I don't believe we have a consolidated list of every message that can appear.

I know the LEA document is out of date (it's from 2014).

I believe this is being addressed as part of the LogOut project mentioned here: https://community.checkpoint.com/message/7996-re-is-there-a-document-that-list-all-the-possible-values-for-the-action-column-that-i-can-have-in-the-log-for-every-different-blade

topic What log events can CheckPoint Blades produce? in General Topics

What log events can CheckPoint Blades produce?

Re: What log events can CheckPoint Blades produce?