topic Re: Harmony Connect log export/integration with SIEM in SASE and Remote Access

Harmony Connect log export/integration with SIEM

jt-jt — Thu, 04 Aug 2022 13:41:34 GMT

Hi,

We are looking at a few replacements (SASE, CASB, SIEM) and wondered if there is any way to export the logs from Harmony Connect (I guess in the Infinity portal) to a SIEM such as Microsoft Sentinel?

Many thanks in advance.

Re: Harmony Connect log export/integration with SIEM

Chris_Atkinson — Fri, 05 Aug 2022 08:31:01 GMT

Currently, getting your logs streamed to a SIEM is available by submitting a TAC support ticket.
We plan to provide a self-service UI for this configuration (coming soon).
The SIEM will need to accept Syslog, Splunk, CEF or LEEF traffic coming from the AWS hosted IP addresses (this is where our cloud POPs are located at) using the Log Exporter mechanism.

Also suggest keeping your local SE across the request.

Re: Harmony Connect log export/integration with SIEM

jt-jt — Fri, 05 Aug 2022 08:26:54 GMT

Thank you, I'll speak to our SE on it.

Re: Harmony Connect log export/integration with SIEM

dantlitz — Tue, 01 Nov 2022 20:52:54 GMT

I see our on prem MDS supports a Log Rhythm format. Is that supported from the Harmony Cloud?

Re: Harmony Connect log export/integration with SIEM

Chris_Atkinson — Wed, 02 Nov 2022 13:03:52 GMT

You can enquire via an SR other formats can be set on the backend in some instances.

Source: https://sc1.checkpoint.com/documents/Infinity_Portal/WebAdminGuides/EN/Infinity-Portal-Admin-Guide/Content/Topics-Infinity-Portal/Event-Forwarding.htm

Re: Harmony Connect log export/integration with SIEM

Chris_Atkinson — Wed, 02 Nov 2022 00:24:08 GMT

To update the UI has been made available since in Global Settings: