GEO Assessment with SmartEvent

Discover the Future of Cyber Security:
What’s New in Check Point’s Quantum R82

Pick the Best of the Best of
CheckMates 2024!

Vote Now!

Share your Cyber Security Insights
On-Stage at CPX 2025

Learn More

Simplifying Zero Trust Security
with Infinity Identity!

Watch Now

Zero Trust Implementation
Help us with the Short-Term Roadmap

Take the Survey

CheckMates Go:
What's New in R82

LISTEN NOW

Create a Post

I'm working on a SmartEvent View (first draft attached) that allows assessing the inbound and outbound connections by GEO locations of a firewall gateway. The resulting view is meant to help understand what connection types to which geo locations are made in in- and outbound. With this info a Geo Policy (see below) can be created as ordered layer as advised by @Tomer_Sole of Check Point.

I'm currently struggling to find the correct log fields to locate the GEO locations of all firewall log entries. I tried 'Source Country' and 'Destination Country' which only shows a view logs. When I compare this with the number of logs that have country flags as shown in standard log view, there are many more that don't appear in my SmartEvent view yet. Which these flags might be just a cosmetic feature (sk120261) I'd still like to read them out for my GEO assessment view. Any ideas?

Info: I filtered out standard communications, such as HTTP/HTTPS/NTP/SNMP, as these would be most likely always allowed from/to any country.