topic Similar logs For Identity Awareness in SASE and Remote Access

Similar logs For Identity Awareness

JasminThejojo — Fri, 01 Dec 2023 14:40:15 GMT

Hi,

I have searched from qradar and got similar logs as below. The only different item is "sequencenum", is this desired situation?

Any advice would be appreciated.

Best

Jasmin

LEEF:2.0|Check Point|Identity Awareness|1.0|Log In|devTime=devtime usrName=xxx cat=Identity Awareness action=Log In ifdir=inbound logid=logid loguid={aaa} origin=ip originsicname=zzz sequencenum=6 version=5 auth_method=User Authentication (Active Directory) auth_status=Successful Login client_name=Active Directory Query client_version=R81.10 domain_name=domain_name endpoint_ip=ip_address identity_src=AD Query identity_type=user snid=sn_id src=src src_user_group=src_user_group src_user_name=xxx LEEF:2.0|Check Point|Identity Awareness|1.0|Log In|devTime=devtime usrName=xxx cat=Identity Awareness action=Log In ifdir=inbound logid=logid loguid={aaa} origin=ip originsicname=zzz sequencenum=7 version=5 auth_method=User Authentication (Active Directory) auth_status=Successful Login client_name=Active Directory Query client_version=R81.10 domain_name=domain_name endpoint_ip=ip_address identity_src=AD Query identity_type=user snid=sn_id src=src src_user_group=src_user_group src_user_name=xxx

Re: Similar logs For Identity Awareness

PhoneBoy — Fri, 01 Dec 2023 15:05:07 GMT

Is the issue you’re seeing multiple logs for what appears to be the same event?
How far apart are the logs and how many “duplicates” appear?

We do send multiple logs via Log Exporter for the same session (every 10 minutes or so).
This is probably expected behavior.

Re: Similar logs For Identity Awareness

JasminThejojo — Fri, 01 Dec 2023 15:39:12 GMT

Hi,

Thanks for your answer. There are two events for login and logout with the same devtime. (not every 10 minutes)

Best

Jasmin

Re: Similar logs For Identity Awareness

PhoneBoy — Fri, 01 Dec 2023 15:42:11 GMT

Two logs for the same event that close to each other doesn't seem correct.
Best to check this with TAC: https://help.checkpoint.com