Log Exporter Filtering

[Dan_Zada]

Hello all,

I'm happy to inform you that we added a new feature to the log exporter - the ability to filter logs.

Starting today, you will be able to configure which logs will exported, based on fields and values, including complex statements.

More information, including basic and advanced filtering instructions, can be found in SK122323.

If you have any question or comment, let me know.

Thanks!

Dan.

[Shay_Hibah]

@Antonis_Hassiot 

What format are you using as part of Log Exporter configuration?

[Antonis_Hassiot]

target-port: 12010
protocol: tcp
format: splunk
read-mode: semi-unified
export-link: false
export-attachment-link: false
export-attachment-ids: Found

[Shay_Hibah]

Please send my your FilterConfiguration.xml file to my email and we will take it offline from there.

Shayhi@checkpoint.com

[Ned_Stark]

Hello friends,

I have a 1450 appliance  Version R77.20.85 (990172755)   

How can I get the configuracion log exporter  for this appliance?  I see that sk 122323  is for R77.30 and above.

Thanks 

[PhoneBoy]

Log Exporter is not supported on SMB appliances.
The 1500 series running R80.20 code can natively export security logs via Syslog.

[Dorit_Dor]

to be clear:

Log exporter is running on the log server/management and it is agnostic to which GW generated the data.

[Ned_Stark]

Ok,  thanks a lot.  

Nice day.  

[Ned_Stark]

Thanks a lot.