topic Re: Evidence of Log File Integrity in General Topics

Evidence of Log File Integrity

BJ_Brooks — Mon, 25 Sep 2023 16:31:44 GMT

A bit of a strange request... we have to provide evidence to a third party assessor that CP Audit Logs are immutable aka there is some sort of file integrity checking that is performed or something which prevents an admin from modifying a log file. Have not been able to locate any such function in the various admin guides. Has anyone else found a way to do this?

Re: Evidence of Log File Integrity

PhoneBoy — Mon, 25 Sep 2023 17:46:48 GMT

Traffic and Audit logs are stored in a proprietary binary format.
You can only access these logs via expert commands, which should only be provided to trusted administrators.
If you are logging expert commands, then you should be able to prove these files were not tampered with.

Re: Evidence of Log File Integrity

BJ_Brooks — Mon, 25 Sep 2023 17:48:43 GMT

Thanks for the info. Is there any public documentation which states that?

Re: Evidence of Log File Integrity

PhoneBoy — Mon, 25 Sep 2023 18:06:43 GMT

The only thing I'm aware of that even talks about the log files is: https://support.checkpoint.com/results/sk/sk127972
I recommend you work with your local Check Point SE or possibly the TAC: https://help.checkpoint.com

Re: Evidence of Log File Integrity

BJ_Brooks — Mon, 25 Sep 2023 18:14:23 GMT

Thank you, sir.