- Products
- Learn
- Local User Groups
- Partners
- More
Welcome to Maestro Masters!
Talk to Masters, Engage with Masters, Be a Maestro Master!
Join our TechTalk: Malware 2021 to Present Day
Building a Preventative Cyber Program
Be a CloudMate!
Check out our cloud security exclusive space!
Check Point's Cyber Park is Now Open
Let the Games Begin!
As YOU DESERVE THE BEST SECURITY
Upgrade to our latest GA Jumbo
CheckFlix!
All Videos In One Space
In our company, we monitor CheckPoint. To determine the source of the event, it is important for us to know the value of the "ProductName" field, that is, to know the name of the blade. At the end of some logs we see characters like " id=...] " . How can we fix this problem? An example of the full log is below.
Log [Fields@X.X.X.X.X.X.X duration="*** Confidential ***" last_hit_time="*** Confidential ***" update_count="*** Confidential ***" creation_time="*** Confidential ***" connection_count="*** Confidential ***" aggregated_log_count="*** Confidential ***" url_count="*** Confidential ***" src="*** Confidential ***" dst="*** Confidential ***" proto="*** Confidential ***" client_type_os="*** Confidential ***" web_client_type="*** Confidential ***" web_server_type="*** Confidential ***" user="*** Confidential ***" src_user_name="*** Confidential ***" src_machine_name="*** Confidential ***" src_user_dn="*** Confidential ***" snid="*** Confidential ***" dst_user_name="*** Confidential ***" dst_machine_name="*** Confidential ***" dst_user_dn="*** Confidential ***" UserCheck_incident_uid="*** Confidential ***" UserCheck="*** Confidential ***" log_id="*** Confidential ***" user_status="*** Confidential ***" portal_message="*** Confidential ***" UserCheck_Confirmation_Level="*** Confidential ***" frequency="*** Confidential ***" UserCheck_Interaction_name="*** Confidential ***" service_id="*** Confidential ***" https_inspection_action="Inspect" inzone="*** Confidential ***" outzone="*** Confidential ***" UP_match_table="*** Confidential ***" ROW_START="*** Confidential ***" match_id="*** Confidential ***" layer_uuid="*** Confidential ***" layer_name="*** Confidential ***" rule_uid="*** Confidential ***" rule_name="Internet for PC" ROW_END="*** Confidential ***" ROW_START="*** Confidential ***" match_id="*** Confidential ***" layer_uuid="*** Confidential ***" layer_name="*** Confidential ***" rule_uid="*** Confidential ***" rule_name="White List for ALL" ROW_END="*** Confidential ***" UP_match_table="*** Confidential ***" UP_action_table="*** Confidential ***" ROW_START="*** Confidential ***" action="*** Confidential ***" ROW_END="*** Confidential ***" ROW_START="*** Confidential ***" action="*** Confidential ***" ROW_END="*** Confidential ***" UP_action_table="*** Confidential ***" UP_par...]
Thanks in advance for your reply!
It looks like sk101570
Thanks for your quick answer!
But I'm afraid sk101570 doesn't solve the underlying problem. This article talks about ***Confidential*** fields. For me, this is not a solution to a non-primary problem. It is important for me to receive logs in full, without "...]" at the end.
I'll add another example. This is the end of the log, which contains fields that are important to us.
...log_uid="{36DA12B2-419E-AF4B-8FAA-36FCB53D7F12}" Extracted_file_types="" Extracted_file_names="" Extracted_file_hash="" Extracted_file_verdict="" Extracted_file_uid="" parent_file_hash="" parent_file_name="" parent_file_uid="" malware_type="" malware_family="" similar_iocs="" similar_hashes="" similar_strings="" similar_communication="" mitre_initial_access="" mitre_execution="" ...]
It’s not clear exactly how these logs are being monitored.
Can you elaborate on what tool(a) are being used and the precise process used?
About CheckMates
Learn Check Point
Advanced Learning
YOU DESERVE THE BEST SECURITY