topic Re: Direct log forwarding from Quantum Spark to on-prem SIEM in Spark Firewall (SMB)

Direct log forwarding from Quantum Spark to on-prem SIEM

TSOL — Wed, 19 Nov 2025 01:47:54 GMT

Hi experts,

We are currently using multiple Quantum Spark appliances managed by Smart-1 Cloud.
We are planning to introduce an on-prem SIEM(include syslog feature) in order to perform correlation analysis
together with logs from our other network devices.

However, when using the Smart-1 Cloud Log Exporter, log forwarding is subject to
ingestion-based billing. To avoid additional costs, we would prefer to have the
Gateway itself send logs directly to our on-prem SIEM server.

I would like to ask for clarification on the following points:

1. Under Smart-1 Cloud management, is it possible for a Gateway to send logs
both to an external SIEM server and to Smart-1 Cloud at the same time?

2. If direct log forwarding from the Gateway is supported, does it require any
additional licenses?

Our intention is to continue using Smart-1 Cloud for management, while forwarding logs
independently from the Gateway directly to our SIEM.

If anyone has experience with this setup or detailed knowledge of the official
specifications, your guidance would be greatly appreciated.

Thank you in advance.

Re: Direct log forwarding from Quantum Spark to on-prem SIEM

Chris_Atkinson — Wed, 19 Nov 2025 10:25:11 GMT

Typically configuring a syslog server entry in GAiA OS would yield only local OS logs, security logs come via the Management.

Re: Direct log forwarding from Quantum Spark to on-prem SIEM

AkosBakos — Wed, 19 Nov 2025 10:35:34 GMT

Hi @TSOL

Maybe this is what are you looking for 🙂

https://sc1.checkpoint.com/documents/Appliances/Quantum_Spark_R82.00.X/CLI/EN/Content/Topics/add-netflow-collector.htm

Akos

Re: Direct log forwarding from Quantum Spark to on-prem SIEM

PhoneBoy — Thu, 20 Nov 2025 15:39:35 GMT

For regular (non-SMB) gateways, there is: https://support.checkpoint.com/results/sk/sk87560
Note this only gets firewall logs, not logs for other blades.
Not sure you can set an external syslog server for security logs on a centrally managed SMB.

Re: Direct log forwarding from Quantum Spark to on-prem SIEM

PhoneBoy — Thu, 20 Nov 2025 15:41:09 GMT

Not sure SIEMs can injest Netflow.
Also, Netflow only communicates active connections.

Re: Direct log forwarding from Quantum Spark to on-prem SIEM

Pedro_Espindola — Thu, 27 Nov 2025 14:08:40 GMT

Yes, you can send logs directly to a SIEM, but it is done locally on the Spark appliance, not through Smart-1 Cloud.

Just go to the WebUI and create an external log server and check the system logs and security logs boxes.

The downside is that the logs sent by Spark are a pain to parse, while Smart-1 cloud will give you a beautiful JSON.

The upside is that you can send the logs to a local forwarder with a queue/cache and not lose logs in case the internet is down.

Re: Direct log forwarding from Quantum Spark to on-prem SIEM

Pedro_Espindola — Thu, 27 Nov 2025 14:10:08 GMT

In Spark appliances, both system logs and security logs are available. They are Gaia Embedded, a whole different creature.