Creating a report based on anti-spoofing drops

[G-]

I understand it might be possible to add the 'message information' field to the event correlator but I'm having trouble working out how to do that.

I can add that field to the log view profile in SMC Log tab, I just can't seem to be able to use it in the Report section widgets.

We're on r.82, is there an up to date set of instructions on how to do this, has anyone ever managed to get it to work (create a report of anti-spoofing drops) ?

[PhoneBoy]

Anti-spoofing logs are considered connection logs, which are not indexed by default.
See: https://support.checkpoint.com/results/sk/sk150452
Even if you index these logs, not sure the "Message Information" field will be indexed. 

[G-]

Thanks Phoneboy, I suspected this would be the case. I'm dealing with a very large OT estate which has a wide variety of deployment models (being polite here) and remediation of underlying issues is going to be essential to reducing the logs to the point where we can afford to ingest them into a decent analysis tool/data lake.

Poor local network configuration is generating a lot of logs (120k/hour just for anti-spoofing). I'd rather not just turn the logging off, kind of defeats the purpose, but we also don't have a large support team so it's hard to generate consumable data for management on a regular basis.

I mention these details because it occurred there may be other ways to generate the logs that I'm not experienced enough to realise and someone else might go 'oh, if that's all you want to do you could just do 'x'' 🙂 (I'm an optimist obvs.)

I did find an article (which I've now lost) that explained how to go about adding 'Message Information' to the indexing, but it didn't work. Whether I did it wrong, the instructions were old or it was never going to work I'm not clear on, but it sounds like it's going to be the latter.

Appreciate the quick response.

G.

[emmap]

A very long time ago I did some similar log assessment by exporting the logs to csv and using MS Access to manage them and help me do the required analysis. Even some raw excel pivot tables could help. 

[G-]

Hi emmap, unfortunately that means exporting the logs manually from Smartview. The only way I know of to automate exporting logs is from SMC and the use of reports. I guess it's just going to have to be a manual approach.

[emmap]

Unfortunately yes I think that will be the case for this one.