process_name log field

[gm446]

Hello Everyone,

As part of implementing SIEM solution in our organization i got a request from the CISO to log from the endpoint what process generates traffic.
i can see in sk144192 that there is a "process_name" field under "Harmony Endpoint - Common Fields".

unfortunately, i cannot find this field in actual logs for firewall, TP, Anti-Malware or Anti-Bot blades. is there anything specific i should enable for the client to log this information?

Best Regards,
Yossi.

[the_rock]

Hey Yossi,

Let me check this in the lab later.

Best,

Andy

[the_rock]

Sorry, just working on some Azure stuff now, but have you tried below query to see if it yields anything?

Andy

blade:"Endpoint Compliance"

[gm446]

this query is works of course, but i cannot see how it is related to my issue 🙂

Thank you.

[the_rock]

No no, I get that, I was just curious if it worked or not. I will check again in a bit, but you may want to open the support case in the meantime to confirm.

Andy

[PhoneBoy]

process_name refers to the (potentially) malicious process that is being blocked, not the blade that blocked it.
Based on this SK, it would seem we don't log which blade is responsible for the block, though it can be inferred from the other fields included.

[gm446]

Hi PhoneBoy,

this is exactly the information i need, the process who is made the traffic and being blocked/allow.

Best Regards,
Yossi.

[the_rock]

Did you end up opening TAC case to see if you can verify that info, if its possible?

Best,

Andy

[PhoneBoy]

The only place it would show...when it is relevant...is in the full log card.
In any case, you may need to consult with TAC here: https://help.checkpoint.com 

[gm446]

Thank you all, i opened a ticket and wait for an answer.

[the_rock]

Let us know what they say.

Best,

Andy

[gm446]

After TAC investigation my request is not possible. so we achieve this logs through Sysmon.