Logs sent to a SIEM

[Itzel_Gtz26]

If I use a log exporter, what is the relationship between the logs that I see in my console and the logs that are sent to the configured SIEM?

That is, for each log that I see in my console, how many logs are sent to the SIEM?

Is the same amount always sent? or what does it depend on?

[BikeMan]

Hi,

Do not understand the question.

Log exporter send received logs to the SIEM. You can filter logs send to SIEM, but without filter all logs received by the log server are sent to the SIEM. 

[Itzel_Gtz26]

Example:

If I search for a communication from the smartview, it shows me 2 logs, however if I perform the same search in the SIEM, it gives me up to 6 logs, that is why I want to know if there is a relationship or why the SIEM receives many more logs than the ones I see on the smartview?

[the_rock]

That definitely does not sound right to me. Is this for every filter you do or just something random?

Regards,

Andy

[Lloyd_Braun]

Check Point has multi-part logs that update with more information as time goes by.  These can result in multiple log messages at the SIEM for the same event.

There is a pretty good recent thread discussing it here: https://community.checkpoint.com/t5/Management/Aggregate-log-updates-before-export-Log-Exporter-opti...

You want to set your read-mode to semi-unified in your cp_log_export config or turn on "Aggregate log updates before export" if you are using a Log Exporter/SIEM object in the GUI.

I like this description from r81.10 log exporter docs: https://sc1.checkpoint.com/documents/R81.10/WebAdminGuides/EN/CP_R81.10_LoggingAndMonitoring_AdminGu...

field:loguid
Log Unification ID.
Some Check Point logs are updated over time.
Updated logs have the same Log UID value.
Check Point SmartLog client correlates those updates into a single unified log.

When the update logs are sent to 3rd party servers, they arrive as distinct logs.

Administrators can use the "loguid" field to correlate updated logs and get the full eventClosed chain.

Note - Log Exporter's new semi-unified mode correlates all previous logs into one, so the latest log always shows the complete data.

Examples of updated logs:

-The total amount of bytes sent and received over time.
-The severity field which is updated over time as more information becomes available.

[PhoneBoy]

You can expect to receive multiple logs for the same session if any one of the following is true:

• Logging is Detailed or Extended
• Accounting is enabled

In this case, you can generally expect to receive a log for:

• The initial session is opened
• A log entry every 10 minutes thereafter with updated data about bytes sent/received
• A final log after the connection has been closed/expired