Harmony Browse log forwarding to on-prem SmartCenter

[Sergej_Gurenko]

After reading the Admin Guide Harmony-Browse-Admin-Guide>Harmony-Endpoint-Logs , watching couple of videos and setting up a trial instance of Harmony Browse (aka SBA4B) I'm confused if forwarding logs to on-prem Check Point is available. If not available today, is t in the committed roadmap? Thanks!

[PhoneBoy · Accepted solution]

Pretty sure we support forwarding to a SIEM, though that’s an extra cost item.
Don’t believe you can currently ingest logs from any of our Infinity Portal hosted offerings into your local management/log server.
Recommend discussing your precise requirements with your local Check Point office.

[Sergej_Gurenko]

It seems there is some progress towards this, at least for other products of the Harmony family making steps towards SmartCenter integration. Below is some recent news from Harmony Connect What's new sk155574

• October 13th, 2022 SmartConsole Management for Harmony Connect is available > Enabling SmartConsole Management >  Note: Harmony Connect logs continue to be stored in the cloud.

[PhoneBoy]

We support connecting your on-prem management to Infinity Portal.
This is required for several offerings, including SD-WAN, XDR, SOC, and others.
In the case of Harmony Connect, it's optional and allows you to manage your access policy using your on-prem management.

[dt7]

Hello @PhoneBoy, can I ask a follow-up question on this comment of yours? I have a similar question to this post but the other way around, and it relates to your reply.

For example, if I have a Harmony Endpoint on-prem setup, I see that it is possible to forward logs externally. I was wondering if I can use that to forward logs to Infinity portal directly, and have those logs compatible for use by Infinity XDR or PlayBlocks on the Infinity Portal? Or is it achieved via the Log Exporter? (https://sc1.checkpoint.com/documents/Log_Exporter/EN/Content/Topics/Introduction.htm#Introduction)

Does that integration work via direct forward and will those on-prem log be understood by those Infinity Services? When checking the documentation on this it is not very clear to me. I did see that it is possible to forward logs to a third party SIEM as well (ex: Splunk, etc.). So alternatively, it means I need to forward my Harmony Endpoint on-prem logs to an external SIEM, that then forwards it to Infinity portal for Infinity XDR? Seems very convoluted... 

https://sc1.checkpoint.com/documents/R82/SmartEndpoint_OLH/EN/Content/Topics-HEP/Logs-menu.htm?Highl...

Supported products for security events mentioned "products you are subscribed to in Infinity Portal", so it's not very clear to me:

https://sc1.checkpoint.com/documents/Infinity_Portal/WebAdminGuides/EN/Events-Admin-Guide/Content/To...

Thank you in advance for any help on this.

Regards.

[PhoneBoy]

Yes, you can forward your on-prem logs to Infinity Portal to a service called Infinity Events: https://sc1.checkpoint.com/documents/Infinity_Portal/WebAdminGuides/EN/Events-Admin-Guide/Content/To... 

However, I don't believe we require this in order to use some of the features.
We do require a connection to Infinity Portal, which is configured in SmartConsole.

When you set up the connection, you can also set up if logs and/or configuration from your local system is shared with Infinity Portal:

[dt7]

Thanks @PhoneBoy, this is very helpful.

In that case, can I assume that if you connect your on-prem Harmony Endpoint Management server to Infinity (either via Infinity portal config you mentioned or log forwarding), that shared config and logs will be able to be used by other Infinity cloud services, like Infinity XDR?

Thank you.

[PhoneBoy]

Once you've connected your on-prem management with Infinity Portal, you can configure the individual services that will leverage this connection.
Log Forwarding is meant for SIEMs (not for importing into Infinity Portal).