Not find field Source port, destination port in raw logs to QRadar

[TaylorHung]

Hello everyone,

I configured syslog through Log exports on Checkpoint R81.10, but on qradar not find fields source port and destination port.

Tell me if you know. Thanks a lot

Regards,

Taylor

[_Val_]

There are two fields in your raw log entry: s_port and service. You must be using the wrong parser.

[TaylorHung]

What format does Checkpoint support log normalization ? and How can I change format log ? 

Thanks a lot

[_Val_]

I don't think you will resolve this on Check Point side. This is an obvious IBM QRadar config question

[_Val_]

Yet, you are welcome to check the relevant parts of the Logging and Monitoring guide for your CP version, for example: https://sc1.checkpoint.com/documents/R81/WebAdminGuides/EN/CP_R81_LoggingAndMonitoring_AdminGuide/To...

Look under "Log Exporter Advanced Configuration Parameters" in the guide

[TaylorHung]

Thank you, I will check Qradar config