I'm working on a SmartEvent View (first draft attached) that allows assessing the inbound and outbound connections by GEO locations of a firewall gateway. The resulting view is meant to help understand what connection types to which geo locations are made in in- and outbound. With this info a Geo Policy (see below) can be created as ordered layer as advised by @Tomer_Sole of Check Point.
I'm currently struggling to find the correct log fields to locate the GEO locations of all firewall log entries. I tried 'Source Country' and 'Destination Country' which only shows a view logs. When I compare this with the number of logs that have country flags as shown in standard log view, there are many more that don't appear in my SmartEvent view yet. Which these flags might be just a cosmetic feature (sk120261) I'd still like to read them out for my GEO assessment view. Any ideas?
Info: I filtered out standard communications, such as HTTP/HTTPS/NTP/SNMP, as these would be most likely always allowed from/to any country.
| User | Count |
|---|---|
| 6 | |
| 5 | |
| 5 | |
| 4 | |
| 3 | |
| 3 | |
| 3 | |
| 2 | |
| 2 | |
| 2 |
Thu 02 May 2024 @ 04:00 PM (CEST)
CheckMates Live DACH - Keine Kompromisse - Sicheres SD-WANThu 02 May 2024 @ 05:00 PM (CEST)
SASE Masters: Deploying Harmony SASE for a 6,000-Strong Workforce in a Single Weekend
