Check Point Integration with FortiSIEM solution

[FD]

Hello members,

i have Checkpoint security firewall and would like to integrate it with FortiSIEM solution i need help as it is my first time to implement.

thanks

[_Val_]

If it takes syslog, jsut use log exporter

[peroskhan]

Hi,

can you share the settings to integrate with FortiSiem

[AkosBakos]

What do you mean under settings?

This is the original SK: https://support.checkpoint.com/results/sk/sk122323

You can  setup based on your needs. Usually we send syslog to FortiSien, and the SIEM will parse the logs. 

Have a look at in this:

https://docs.fortinet.com/document/fortisiem/7.1.4/external-systems-configuration-guide/335430/check...

You need to send syslog in CEF format according to this sample:

cp_log_export add name <Name> [domain-server {mds | all}] target-server <HostName or IP address of Target Server> target-port <Port on Target Server> protocol {udp | tcp} format {syslog | splunk | cef | leef | generic | json | logrhythm | rsa} [<Optional Arguments>]

[egas84]

Hi,

I use the following:
cp_log_export add name FortiSiem target-server x.x.x.x target-port 514 protocol udp format cef
cp_log_export restart name FortiSiem

Regards,

[Lesley]

https://sc1.checkpoint.com/documents/R81.10/WebAdminGuides/EN/CP_R81.10_LoggingAndMonitoring_AdminGu...

Start with above and then:

https://support.checkpoint.com/results/sk/sk122323

Better to create object in SmartConsole. Before you always had to start from CLI but that changed and made it more easy. Still can do all via CLI but via GUI is better. 

If all changes are done check with tcpdump if you see traffic being send out. tcpdump -nni any host IP port 514

[the_rock]

The sk given by Akos and Lesley is your best bet.

Andy

[egas84]

Hi,

Did you manage to integrate the logs in fortisiem via Log exporter? Is the parser correct? Can you share the settings you used?

Thanks