What log events can CheckPoint Blades produce?

[Roland_Eschenbu]

As part of our corporate security monitoring initiatives we need to review all the possible log messages that can be produced by the platform across all the main blades e.g. VPN, IPS, URL Filtering, FW, Application Control etc. We currently feed all events in to our own SIEM and SOC and we require information of all possible events that can be produced by the Checkpoint Platform to the level of detail such as that from vendors like Cisco e.g. https://www.cisco.com/c/en/us/td/docs/security/asa/syslog/b_syslog.html

Many thanks,

Roland

[PhoneBoy]

There are a couple of different types of log messages:

• Syslog from the OS: Check Point Gaia Syslog Messages Reference Guide 
• The security logs: These are typically imported via LEA. Much of the information we make available via LEA is here: LEA Fields‌

I don't believe we have a consolidated list of every message that can appear.

I know the LEA document is out of date (it's from 2014).

I believe this is being addressed as part of the LogOut project mentioned here: https://community.checkpoint.com/message/7996-re-is-there-a-document-that-list-all-the-possible-valu...