Create a Post
cancel
Showing results for 
Search instead for 
Did you mean: 
Advisor

Log Exporter Checkpoint R80.40

Hello,

 

I want to integrate my Checkpoint instance to DataDog.. i am wondering what is the best way to do so.. should i just configure a syslog server , forward all Checkpoint logs to that syslog and integrate that syslog server with datadog.

 

Additionally, i also came across "Log Exporter" feature in Checkpoint but i didnt get it completely. Does log exporter enables integration directly with SIEM tools ? do i need to install any additional plugins on the GWs for it to function.

0 Kudos
Reply
7 Replies
Contributor

Hi,

There are many approaches that you can do to achieve this. So far I've used a syslog server to export logs and then ship them to the right platform (e.g. Azure Log Analytics), and in some cases I have used OPSEC integration with some vendors and systems. In essence it boils down to your preference, needs and specifications.

Cheers,

Predrag

Advisor

Thanks for the reply... so it means i should export the logs to a syslog server... then add that syslog server to the SIEM Also, there is an option to create a syslog server in SmartConsole via New Object -Server and so on.. is it one and the same thing.
0 Kudos
Reply
Contributor

As I have said there are multiple ways to do this. What is the most logical way its up to you... When using cp_log_export tool after adding the log export just restart the added export and it will start exporting the logs. Ensure that necessary ports are open (e.g. Azure NSG's or AWS SecurityGroups where the Syslog is located).

cp_log_export add name to_RemoteServer target-server X.X.X.X target-port 514 protocol udp format syslog

cp_log_export restart name to_RemoteServer

After what you do from the syslog its up to you and DataDog agent 🙂

Advisor

Thanks, i have configured log exporter like this.. however, at the syslog  server i can just see the process id and management server hostname displayed but no connection logs.. do i need to enable any thing else vis log exporter commands.

Thanks

0 Kudos
Reply
Advisor

Hi @LostBoY ,

I would suggest to use Log Exporter. It is really easy to configure and you can use filter as well.

If you use the Log Exporter, the remote SIEM tool will be recieve logs through syslog. You don't need to install any other plugins.

Please find sk122323 

 

 

Advisor

Thanks for the reply.. so if i understand this correctly i need to use log exporter to send all the logs from Mgmt Server to a syslog server... i can then add that syslog server to the SIEM tool ?
0 Kudos
Reply
Advisor

Alright so i configured a log exporter in Mgmt Server.. the syslog server is in the same vlan as that of MGMT Server. I can see the process running via commands - cp_log_export status cp_log_export server However, at the syslog server end no logs are visible it is just showing the Mgmt Firewall hostname and the process id.. am i missing something here ? Thanks
0 Kudos
Reply