OPSEC/LEA will be discontinued or not

[egas84]

Hi all,

I saw a long time ago that the OPSEC/LEA protocol was going to be discontinued. Is it confirmed? Are there dates?

Regards, 

Edgar

[G_W_Albrecht]

sk117087: How to Configure and Troubleshoot OPSEC shows it is supported in all current versions up to R81.10. BUt we also have sk122323: Log Exporter - Check Point Log Export

[egas84]

Hi @G_W_Albrecht , 

Thanks.

R81.10 is not the latest version?

I can't use the log exporter for now, hence my question.

[G_W_Albrecht]

R81.20 is EA - so R81.10 is the latest version.

[Chris_Atkinson]

What is your use case for OPSEC?

Log Exporter & APIs should be the preference where available.

[egas84]

We use it to send the log to SIEM.

The problem is that SIEM is not able to "separate" the logs of each instance of fw, that is, it creates only one source in the siem (with the Ip/host of the log manager) and puts the logs of all the instances of fw in that source log, instead of creating one log source per FW instance.

[Chris_Atkinson]

For SIEM use cases Log Exporter is the modern & preferred approach. Please see sk122323 for more info.

[egas84]

Unfortunately I can't use the log exporter for the reason I mentioned above.

[Chris_Atkinson]

You should speak with the SIEM vendor about a parser for Check Point, most major SIEMs already support it.

Which SIEM is it and I will enquire if it is one we have a working partnership with to assist?

[Roman_Russland]

We've had the same issue when trying to switch from OPSEC to syslog! 
I don't know if all firewalls have to run R81.10 in Order for syslog to work properly?! Currently only a few of our fw run R81.10. Most are R80s

[Chris_Atkinson]

Which SIEM?

Log Exporter was introduced in R80.x and the security logs are exported from the management 

[Roman_Russland]

Hello Chris,
IBM QRadar. While configuring OPSEC is a pain in the butt, it works. Trying with Syslog gave us strange logs. They were incomplete, and not separable from each other.  
We went back to OPSEC then.

[PhoneBoy]

As I'm pretty sure we use LEA in the product still, LEA hasn't been formally deprecated...yet.
However, I can say there are no plans to extend LEA further and existing integrations via LEA may break at some point in the future.
All formal integration efforts with SIEMs done in the last few years were with Log Exporter, not LEA.
If you require a precise commitment on our support for LEA and/or (better) support for a specific SIEM in Log Exporter, I recommend reaching out to your local Check Point office.

[_Val_ · Accepted solution]

OPSEC and LEA are still supported with all the currently supported versions. There is no solid decommission date, although I cannot promise it will not happen.

Most importantly, you should be able to achieve your goals via Log Exporter, as already mentioned. The info is there, it is just a matter of parsing it, as @PhoneBoy said.

If you share with us which SIEM you are using, we might have better info for you.

[egas84]

sorry all for delay. i am using QRadar.

[Chris_Atkinson]

QRadar is supported by Log Exporter and I'm aware of customers who use the same.

[egas84]

Yes I know. I have several clients using log exporter and qradar. in this case the customer has its FW at R80.40 and ibm said it only supports up to R80.20. I think it's weird but...

[PhoneBoy]

R80.20 sounds about right in terms of the first version where we supported it.
It should be supported in later versions unless there's been changes on the QRadar end since then.