Logs for SandBlast Agent Cloud

[Julian_Sanchez]

Hello, 

Anyone know how send the logs the SandBlast Agent Cloud to log server on-premise? 

I was searching and only found export log to third-parties Splunk, Arcsight, QRadar with log_exporter but if I dont have a SIEM how I have the logs in my SMS on-premise? 

Regards, 

Julian S. 

[Kobie_Bendalak]

@Julian_Sanchez  At this time this is your only option, there's no native integration to an on-premise SmartEvent - you could use Syslog (but it has drawbacks and limitations).

A major item on our short-term roadmap.

[Julian_Sanchez]

Hello Kobie, 

Thank you for the information. I hope CheckPoint can integrante it. 

[Luiz_]

Hi there!

Do we have updates on this?

Customer has a Quantum 6200 cluster connected to a virtual SMS/SmartEvent on-premise. He wants to purchase Harmony Endpoint unless if there's a way to send EPMaaS logs to his SMS/SmartEvent on-premise to have all information about his network/endpoints on the same SmartEvent.

The closer I saw about this was this SK, not sure if it works. At the very least would need TAC to setup things on the EPMaaS side: https://supportcenter.checkpoint.com/supportcenter/portal?eventSubmit_doGoviewsolutiondetails=&solut...

[_Val_]

Why don't you take this with your local Check Point office? This is obviously a sales engineering question. Let them help you.

[Chris_Atkinson]

@_Val_ is correct this likely requires an RFE and isn't a one size fits all solution.

* Some might like logs directly to their SIEM.

* Some might prefer an on-prem policy server to forward logs to SmartEvent.

* Some might prefer direct SmartEvent integration.

The later will likely occur first via a cloud hosted option.