Evidence of Log File Integrity

[BJ_Brooks]

A bit of a strange request... we have to provide evidence to a third party assessor that CP Audit Logs are immutable aka there is some sort of file integrity checking that is performed or something which prevents an admin from modifying a log file. Have not been able to locate any such function in the various admin guides. Has anyone else found a way to do this?

[PhoneBoy]

Traffic and Audit logs are stored in a proprietary binary format.
You can only access these logs via expert commands, which should only be provided to trusted administrators.
If you are logging expert commands, then you should be able to prove these files were not tampered with.

[BJ_Brooks]

Thanks for the info. Is there any public documentation which states that?

[PhoneBoy]

The only thing I'm aware of that even talks about the log files is: https://support.checkpoint.com/results/sk/sk127972 
I recommend you work with your local Check Point SE or possibly the TAC: https://help.checkpoint.com 

[BJ_Brooks]

Thank you, sir.