topic Re: Action Field in IPS Logs via Log Exporter in General Topics

Action Field in IPS Logs via Log Exporter

LostBoY — Thu, 13 Jan 2022 09:58:11 GMT

I have integrated my R80.40 Mgmt Server with Datadog SIEM.. in the IPS logs few key fields are missing such as Destination and Action.. i understand Destination field is not present by design as described in sksk136672.

However.. i am not sure if this is the case for "Action" field as well.. i am exporting raw logs via log exporter..

is there any specific setting to be enabled to get Action field or is this also a product limitation.

Thanks

Re: Action Field in IPS Logs via Log Exporter

G_W_Albrecht — Thu, 13 Jan 2022 10:45:17 GMT

The sk122323: Log Exporter - Check Point Log Export suggests: For information on Check Point's Log Fields Mapping, refer to sk144192. Here we can find the action field listed for Common Fields exported:

rule_action

Action

string

Action of the matched rule in the access policy

Also for the blades Threat Extraction - Security Gateway & SandBlast Agent and Unified Policy (VPN-1 & FireWall-1) - Security Gateway:

action

Action

int

Action of matched rule
Possible values:
0 - Drop
1 - Reject
2 - Accept
3 - Encrypt
4 - Decrypt
17 - Authorize
18 - Deauthorize
30 - Bypass
33 - Block
34 - Detect
39 - Do not send
43 - Allow
46 - Ask User
61 - Extract

Note: This field is not mandatory to every log

But there is no action field listed for Blade IPS (SmartDefense) - Security Gateway !

Re: Action Field in IPS Logs via Log Exporter

LostBoY — Fri, 21 Jan 2022 13:24:48 GMT

Thanks for the reply.. where can i find this table which you referred to ?