Log Field Visibility for Custom Intelligence Feeds in Check Point

[ahan]

Hello,

We are currently evaluating the Custom Intelligence Feeds feature in Check Point and would like to clarify how certain fields from the source CSV file are handled in the logs.

If the uploaded CSV contains fields such as "name", "value" (IP), and "comment", will all of these fields be included in the logs when a connection matches an entry in the feed? Or will only specific fields, such as the "value", be retained and shown in the logs?

Thank you

[PhoneBoy]

If I remember correctly, we only log the IP/domain and the feed name.
However, someone who has it running in production can comment.