topic Need help to configure log forwarding to syslog server SIEM from checkpoint management server in General Topics

Need help to configure log forwarding to syslog server SIEM from checkpoint management server

Prime — Thu, 29 Apr 2021 10:17:54 GMT

Need help to configure log forwarding to syslog server SIEM from checkpoint management server.

Re: Need help to configure log forwarding to syslog server SIEM from checkpoint management server

_Val_ — Thu, 29 Apr 2021 10:36:18 GMT

Start here: sk122323

Re: Need help to configure log forwarding to syslog server SIEM from checkpoint management server

Prime — Thu, 29 Apr 2021 11:59:45 GMT

We want to forwards udp-514 syslog message to target server

Re: Need help to configure log forwarding to syslog server SIEM from checkpoint management server

Mike_A — Thu, 29 Apr 2021 13:39:53 GMT

syslog messages from your gateways/mgmt to a syslog server, or firewall logs to a syslog server? If its the gateway/mgmt to a syslog sever the string is below.

add syslog log-remote-address <target server> level <level>

If its traffic logs, then per the SK Val posted you would use a syntax like below specifying syslog as the format.

For you I would assume the string to look something like this

cp_log_export add name SYSLOG-EXPORT-TO-SIEM target-server 10.10.10.10 target-port 514 protocol udp format syslog

Re: Need help to configure log forwarding to syslog server SIEM from checkpoint management server

Prime — Mon, 03 May 2021 09:04:43 GMT