topic Re: Logs forwarding in Spark Firewall (SMB)

Logs forwarding

ojuser — Thu, 25 Apr 2019 11:19:31 GMT

Can we send Check Point 730 Appliance system and security logs to AWS EC2 system directly through syslog configuration ?

Re: Logs forwarding

PhoneBoy — Thu, 25 Apr 2019 23:27:19 GMT

SMB device logs can be forwarded through syslog.
Security Logs from SMB can only be forwarded through an OPSEC LEA connection (not syslog).

Re: Logs forwarding

ojuser — Fri, 26 Apr 2019 03:44:45 GMT

Any idea how I can configure the logs from CP to AWS EC2 instance through OPSEC LEA. Do I need to configure anything extra as I don't have CP SMS licence in my environment. Please share some details / documents which can be helpful here. Thanks.

Re: Logs forwarding

PhoneBoy — Fri, 26 Apr 2019 05:07:09 GMT

You would need an SMS to receive the logs from the 730.
That SMS could run in AWS using a PAYG license.
Once on an SMS you could use Log Exporter to send the logs via syslog wherever it needs to go.

Re: Logs forwarding

Pedro_Espindola — Tue, 30 Apr 2019 20:09:25 GMT

Actually, you CAN export security logs via syslog, but it will be plain UDP syslog, without any security or guarantee of delivery.

Also, the format is not very friendly and you'd need to customize your own filter.

Re: Logs forwarding

PhoneBoy — Wed, 01 May 2019 20:54:31 GMT

Pretty sure that's only for OS logs and not Security logs.

Re: Logs forwarding

DeletedUser — Wed, 01 May 2019 23:02:33 GMT

Not sure what version we started supporting it, but yes includes the option to send security logs. Enable Show obfuscated if needed. As Pedro says not sent securely and will need to parse them to do any reporting on them.

The central log server may be the better option for both of these reasons.

Re: Logs forwarding

Vladimir — Wed, 01 May 2019 23:56:57 GMT

Yep, it's been around for a while.

I am logging to NAS-based syslog in my lab from standalone 1430:

Re: Logs forwarding

PhoneBoy — Thu, 02 May 2019 17:53:19 GMT

Well then, I'm happy to be wrong in this case.
And it must be a relatively recent feature.

Re: Logs forwarding

Pedro_Espindola — Thu, 02 May 2019 17:57:44 GMT

I think it is available since R77.20.80.