topic Re: Exclude networks from log export in General Topics

Exclude networks from log export

Verac — Wed, 25 Aug 2021 12:51:10 GMT

Hello all.

I'm trying to trim up logs being sent from the Checkpoint to our SIEM. I have a log_export setup to forward everything to it currently.

I have a series of Public Wifi networks that I'd rather not send the logs for.

Is it possible to exclude all these networks (I have a a series of CIDRS and a supernet) from the log_export?

Running R81 on the management server.

Any help is appreciated!

Re: Exclude networks from log export

the_rock — Wed, 25 Aug 2021 13:33:58 GMT

Thats actually excellent question. Let me check with my colleague who is SIEM guru and see what he says. I will update the thread once I hear back.

Re: Exclude networks from log export

the_rock — Wed, 25 Aug 2021 14:16:59 GMT

Hi,

MY colleague got back to me and he does not believe you can do so on CP side, but you can on SIEM using filters. I did find below on CP article, not sure if its helpful, but you may need to confirm with TAC.

cp_log_export

Re: Exclude networks from log export

Verac — Wed, 25 Aug 2021 17:11:03 GMT

Thanks! That is what I was afraid of. I check back in periodically to see if the filtering has been improved any.

Re: Exclude networks from log export

the_rock — Thu, 26 Aug 2021 00:16:31 GMT

Yea, sorry about that...but it might be worth checking with TAC, just so you get official confirmation.