Is there any API endpoint to retrieve or query raw logs (also suppressed logs)

[PhoneBoy]

R80.40 JHF and R81, yes.
https://sc1.checkpoint.com/documents/latest/APIs/index.html#cli/show-logs~v1.7
If you want all logs, you’re better off using something like Log Exporter.

[Oscar_Bernat]

We have been working with the show-logs API endpoint but suppressed logs are not accessible.

Do you mean that using the log exporter we can export all logs, even suppressed logs?

We integrated the logs with Splunk without luck, the suppressed logs are not being forwarded.

We have followed this integration document https://sc1.checkpoint.com/documents/App_for_Splunk/html_frameset.htm?topic=documents/App_for_Splunk...

Can the SIEM integration be changed to forward raw logs (also suppressed logs)?

Thanks!

[PhoneBoy · Accepted solution]

As I just posted in your other thread, suppressed logs are suppressed from being written anywhere.
Which means the logs simply don't exist, no matter how you might want to acquire them.
If you need those logs, you have to disable log suppression. 

[Oscar_Bernat]

Thanks a lot!!