Create a Post
cancel
Showing results for 
Search instead for 
Did you mean: 
HEMA2K
Explorer

Problem in logging CheckPoint R80.30 Gaia events

In our company, we monitor CheckPoint. To determine the source of the event, it is important for us to know the value of the "ProductName" field, that is, to know the name of the blade. At the end of some logs we see characters like " id=...]  " . How can we fix this problem? An example of the full log is below.

Log [Fields@X.X.X.X.X.X.X duration="*** Confidential ***" last_hit_time="*** Confidential ***" update_count="*** Confidential ***" creation_time="*** Confidential ***" connection_count="*** Confidential ***" aggregated_log_count="*** Confidential ***" url_count="*** Confidential ***" src="*** Confidential ***" dst="*** Confidential ***" proto="*** Confidential ***" client_type_os="*** Confidential ***" web_client_type="*** Confidential ***" web_server_type="*** Confidential ***" user="*** Confidential ***" src_user_name="*** Confidential ***" src_machine_name="*** Confidential ***" src_user_dn="*** Confidential ***" snid="*** Confidential ***" dst_user_name="*** Confidential ***" dst_machine_name="*** Confidential ***" dst_user_dn="*** Confidential ***" UserCheck_incident_uid="*** Confidential ***" UserCheck="*** Confidential ***" log_id="*** Confidential ***" user_status="*** Confidential ***" portal_message="*** Confidential ***" UserCheck_Confirmation_Level="*** Confidential ***" frequency="*** Confidential ***" UserCheck_Interaction_name="*** Confidential ***" service_id="*** Confidential ***" https_inspection_action="Inspect" inzone="*** Confidential ***" outzone="*** Confidential ***" UP_match_table="*** Confidential ***" ROW_START="*** Confidential ***" match_id="*** Confidential ***" layer_uuid="*** Confidential ***" layer_name="*** Confidential ***" rule_uid="*** Confidential ***" rule_name="Internet for PC" ROW_END="*** Confidential ***" ROW_START="*** Confidential ***" match_id="*** Confidential ***" layer_uuid="*** Confidential ***" layer_name="*** Confidential ***" rule_uid="*** Confidential ***" rule_name="White List for ALL" ROW_END="*** Confidential ***" UP_match_table="*** Confidential ***" UP_action_table="*** Confidential ***" ROW_START="*** Confidential ***" action="*** Confidential ***" ROW_END="*** Confidential ***" ROW_START="*** Confidential ***" action="*** Confidential ***" ROW_END="*** Confidential ***" UP_action_table="*** Confidential ***" UP_par...]

Thanks in advance for your reply!

0 Kudos
3 Replies
_Val_
Admin
Admin

It looks like sk101570

0 Kudos
HEMA2K
Explorer

Thanks for your quick answer!
But I'm afraid sk101570 doesn't solve the underlying problem. This article talks about ***Confidential*** fields. For me, this is not a solution to a non-primary problem. It is important for me to receive logs in full, without "...]" at the end.

I'll add another example. This is the end of the log, which contains fields that are important to us.

...log_uid="{36DA12B2-419E-AF4B-8FAA-36FCB53D7F12}" Extracted_file_types="" Extracted_file_names="" Extracted_file_hash="" Extracted_file_verdict="" Extracted_file_uid="" parent_file_hash="" parent_file_name="" parent_file_uid="" malware_type="" malware_family="" similar_iocs="" similar_hashes="" similar_strings="" similar_communication="" mitre_initial_access="" mitre_execution="" ...]

0 Kudos
PhoneBoy
Admin
Admin

It’s not clear exactly how these logs are being monitored.
Can you elaborate on what tool(a) are being used and the precise process used?

0 Kudos