topic Re: Geolocation details in Checkpoint Syslogs in General Topics

Geolocation details in Checkpoint Syslogs

LostBoY — Wed, 29 Dec 2021 12:05:51 GMT

I have integrated Checkpoint R80.40 with an SIEM tool via log exporter configuration.

SIEM teams is looking for Geo Location information from these syslogs..is it possible to get this information from syslogs ?

Re: Geolocation details in Checkpoint Syslogs

Chris_Atkinson — Wed, 29 Dec 2021 12:39:24 GMT

Are you using geo objects in your access policy?

Search for src_country / dst_country in sk144192 to understand the mappings.

Re: Geolocation details in Checkpoint Syslogs

LostBoY — Wed, 29 Dec 2021 13:37:51 GMT

Thanks for the reply.. no i am not using geo objects but i was wondering if any location information can be filtered from syslogs ..like in smartconsole logs we can see a location flag against source and destination IPs

Re: Geolocation details in Checkpoint Syslogs

the_rock — Wed, 29 Dec 2021 15:20:22 GMT

I am not SIEM guy by any means, but from what I know, dont believe you can do it that way, though I could ask one of my colleagues, as I know he did something even better for a customer.

Re: Geolocation details in Checkpoint Syslogs

the_rock — Wed, 29 Dec 2021 16:07:59 GMT

I emailed my colleague your question, so will see what he says.

Re: Geolocation details in Checkpoint Syslogs

LostBoY — Wed, 29 Dec 2021 18:46:46 GMT

Thanks 🙂

Re: Geolocation details in Checkpoint Syslogs

the_rock — Wed, 29 Dec 2021 19:02:14 GMT

Well, dont thank me yet :-). I did ask, but lets see if I get the answer...if this is something he put lots of work into, I cant guarantee he can share it, but I will let you know either way.

Cheers.

Re: Geolocation details in Checkpoint Syslogs

the_rock — Fri, 31 Dec 2021 02:18:33 GMT

Hey @LostBoY . This is a response I got from my colleague to your initial question:

"You can only get external IP and then the SIEM should have the capability to map the IP to country and city name etc. Usually SIEM tools are equipped with GEOIP databases and lookups. Syslog will include only external IPs"