topic Re: How to send log from Checkpoint moreover Opsec LEA in Spark Firewall (SMB)

How to send log from Checkpoint moreover Opsec LEA

Pattarachai_Kho — Fri, 01 Feb 2019 09:55:15 GMT

Hi All I would like to know how to send log moreover opseclea ? such as Syslog also if send from Syslog should add plug-in or add-on or not , could you please suggest to me Firmware R77.20 The logging server is Splunk Thank you

Re: How to send log from Checkpoint moreover Opsec LEA

Pedro_Espindola — Fri, 01 Feb 2019 14:02:05 GMT

If you use central management, you can use Log Exporter (check sk122323) or connect using the Splunk Check Point addon.

You can also send syslog to a log server directly from SMB appliances in both locally and centrally managed SMBs:

Re: How to send log from Checkpoint moreover Opsec LEA

Pattarachai_Kho — Sat, 02 Feb 2019 10:46:26 GMT

HI R77.20 Can install Log export plug-in? Thank you

Re: How to send log from Checkpoint moreover Opsec LEA

PhoneBoy — Sat, 02 Feb 2019 17:57:39 GMT

Log Exporter is only available from R77.30 and not available for locally managed SMB appliances.

The syslog support will only get device logs (not security logs).

You cannot to my knowledge, configure a LEA connection between an SMB appliance and Splunk.

You can configure a LEA connection with a Check Point log server and configure Splunk to pull from that.

Re: How to send log from Checkpoint moreover Opsec LEA

Pedro_Espindola — Mon, 04 Feb 2019 00:47:17 GMT

You can install Log Export or use LEA on a R77.30 or R80.X security management server which manages a SMB appliance.

If locally managed, you have to send Syslog directly from the appliance as shown in the screenshot. No support for LEA then.

Re: How to send log from Checkpoint moreover Opsec LEA

Pattarachai_Kho — Mon, 04 Feb 2019 03:09:43 GMT

Hi thank for answer I have a little bit question now I have to integrate send a log from mgmt with opseclea application to Splunk server but I have found an issue about the Splunk server on window base is support opsec lea or not .

Re: How to send log from Checkpoint moreover Opsec LEA

PhoneBoy — Mon, 04 Feb 2019 11:02:49 GMT

If you are pulling the logs from a Check Point management/log server R77.30 and above, use Log Exporter: Log Exporter - Splunk Integration Update‌

This does not require LEA at all as it uses syslog.

Re: How to send log from Checkpoint moreover Opsec LEA

Pattarachai_Kho — Tue, 05 Feb 2019 07:58:49 GMT

Hi Dameon Welch-Abernathy‌ Limitation of Syslog can get log such as firewall log or just device log if use log exporter

Thank you

Re: How to send log from Checkpoint moreover Opsec LEA

G_W_Albrecht — Tue, 05 Feb 2019 11:56:00 GMT

You will get the security logs into splunk. For more information see this discussion: *New* Splunk App for Check Point Logs.

Re: How to send log from Checkpoint moreover Opsec LEA

Pedro_Espindola — Tue, 05 Feb 2019 15:20:10 GMT

You can send all the security logs you seen in SmartLog with Log Exporter.

The advantage is that now MGMT is actively sending logs to Splunk, whereas with LEA Splunk has to actively collects logs from MGMT.