topic Re: Harmony connect logs -> on prem smartevent in General Topics

Harmony connect logs -> on prem smartevent

D_TK — Wed, 24 May 2023 18:40:43 GMT

Good Day everyone.

I have an on-prem log/sme server which is receiving logs from 14 different gateways. We also use the harmony connect product and on a typical day we have between 150-200 users on it.

On the on-prem SME server, i have a daily threat report that goes out to staff, but on the harmony portal that email report will only be sent weekly - no option to change to daily. I see that there's a way to send the logs from harmony to on-prem via a generic syslog method.

If received via syslog, does anyone know if the on-prem SME will actually process these logs and report/alert on them, or will they just be viewable as generic messages in the log viewer?

TIA.

Re: Harmony connect logs -> on prem smartevent

the_rock — Wed, 24 May 2023 20:16:35 GMT

I believe we have a customer where all those logs get sent to SIEM, but I was not involved in it, rather couple of my other colleagues. I can check if there was anyone we did this for as far as smartevent and update you.

Re: Harmony connect logs -> on prem smartevent

D_TK — Wed, 24 May 2023 20:24:58 GMT

We do send the on-prem logs to a SIEM with the exporter just in case we ever need that correlation with other entities in our environment. But..for day to day, real time info we live in smartlogs so i really want to get those harmony traffic logs into that so we can have one pane of glass for the CP infrastructure.

Re: Harmony connect logs -> on prem smartevent

PhoneBoy — Wed, 24 May 2023 22:24:07 GMT

Unfortunately, we do not support exporting logs from any of our Infinity Portal-hosted solutions to on-prem logging/SmartEvent.

Re: Harmony connect logs -> on prem smartevent

D_TK — Wed, 24 May 2023 22:32:02 GMT

Bummer. Any idea if it's planned? Short of getting the logs into SME, getting this report daily would be great. How do i go about requesting that?

Re: Harmony connect logs -> on prem smartevent

PhoneBoy — Wed, 24 May 2023 22:38:11 GMT

I'll check internally on getting the report more frequently.
You may also want to follow up with your local Check Point office for this request as well.

Re: Harmony connect logs -> on prem smartevent

D_TK — Thu, 25 May 2023 00:19:12 GMT

Thanks, i will hit up my local account team as well. Just wondering....can we flip this around. We've been thinking about evaluating the cloud smart-1 for awhile. I assume there's a cloud SME as well? If so, would the harmony connect logs be able to feed directly into that cloud smart-1 instance providing one log view for all on-prem gateways + harmony traffic?

Thanks again.

Re: Harmony connect logs -> on prem smartevent

PhoneBoy — Thu, 25 May 2023 00:27:02 GMT

SmartEvent in the cloud: Horizon Events.
And yes, this is the use case for it.