Event Forwarding License

[biskit]

Can anyone confirm whether a license is required to enable Event Forwarding in Infinity Portal?

I can successfully create an Event Forwarder at the top MSSP level and it works.  But when I try from the tenant level, the connectivity test fails with an EF002 Connection Timeout error, and tcpdump on the syslog server shows zero traffic.

I suspect I'm missing a license and wanted some confirmation.  

[Martijn]

Hi,

Is this Smart-1 Cloud or another Infinity Portal product? And, do you mean forward evens or export logs to a SIEM solution?

In the Product Catalog there is a Smart-1 Cloud add-on:

CPSM-CLOUD-1GB-LOGEXP-1Y

Description: Enables log export to external SIEM

This what you are looking for?

Martijn

[biskit]

Hi Martijn,

Specifically I'm trying to forward logs for Harmony Endpoint (Managed via the Infinity Portal), as our SIEM doesn't currently have an API integration for Endpoint.

I'm trying here...

At the top MSSP level this works great, but it fails to connect when I do this at a tenant level.

I suspect I need the license.  $300 for the license is a little disappointing when virtually every other vendor has syslog as a standard feature.  I presume I'd need a license per tenant?  That's going to get expensive for what is free in other products 🙄

[Martijn]

Hi,

Can you check:

sk182879 - Infinity Portal Event Forwarding - Troubleshooting

This is mentioned there:

"To set up Event Forwarding, you must purchase a required contract for log forwarding / exporter and use certificates to establish secure communication between Infinity Portal and your SIEM server."

You need the following contract:

CPSM-EVENT-FRWD-PUSH-GB to push to a SIEM solution. Not sure there are MSSP licenses available. You could contact you local Check Point team.

Martijn