Harmony connect logs -> on prem smartevent

[D_TK]

Good Day everyone.

I have an on-prem log/sme server which is receiving logs from 14 different gateways.  We also use the harmony connect product and on a typical day we have between 150-200 users on it.  

On the on-prem SME server, i have a daily threat report that goes out to staff, but on the harmony portal that email report will only be sent weekly - no option to change to daily. I see that there's a way to send the logs from harmony to on-prem via a generic syslog method.    

If received via syslog, does anyone know if the on-prem SME will actually process these logs and report/alert on them, or will they just be viewable as generic messages in the log viewer?

TIA.

[the_rock]

I believe we have a customer where all those logs get sent to SIEM, but I was not involved in it, rather couple of my other colleagues. I can check if there was anyone we did this for as far as smartevent and update you.

[D_TK]

We do send the on-prem logs to a SIEM with the exporter just in case we ever need that correlation with other entities in our environment.  But..for day to day, real time info we live in smartlogs so i really want to get those harmony traffic logs into that so we can have one pane of glass for the CP infrastructure.

[PhoneBoy · Accepted solution]

Unfortunately, we do not support exporting logs from any of our Infinity Portal-hosted solutions to on-prem logging/SmartEvent.

[D_TK]

Bummer.  Any idea if it's planned?  Short of getting the logs into SME, getting this report daily would be great.  How do i go about requesting that?

[PhoneBoy]

I'll check internally on getting the report more frequently.
You may also want to follow up with your local Check Point office for this request as well.

[D_TK]

Thanks, i will hit up my local account team as well.  Just wondering....can we flip this around.  We've been thinking about evaluating the cloud smart-1 for awhile.  I assume there's a cloud SME as well?  If so, would the harmony connect logs be able to feed directly into that cloud smart-1 instance providing one log view for all on-prem gateways + harmony traffic?  

Thanks again.

[PhoneBoy]

SmartEvent in the cloud: Horizon Events.
And yes, this is the use case for it.