- Products
- Learn
- Local User Groups
- Partners
- More
Check Point Jump-Start Online Training
Now Available on CheckMates for Beginners!
Why do Hackers Love IoT Devices so Much?
Join our TechTalk on Aug 17, at 5PM CET | 11AM EST
Welcome to Maestro Masters!
Talk to Masters, Engage with Masters, Be a Maestro Master!
ZTNA Buyer’s Guide
Zero Trust essentials for your most valuable assets
The SMB Cyber Master
Boost your knowledge on Quantum Spark SMB gateways!
As YOU DESERVE THE BEST SECURITY
Upgrade to our latest GA Jumbo
CheckFlix!
All Videos In One Space
In our company, we monitor CheckPoint. To determine the source of the event, it is important for us to know the value of the "ProductName" field, that is, to know the name of the blade. At the end of some logs we see characters like " id=...] " . How can we fix this problem? An example of the full log is below.
Log [Fields@X.X.X.X.X.X.X duration="*** Confidential ***" last_hit_time="*** Confidential ***" update_count="*** Confidential ***" creation_time="*** Confidential ***" connection_count="*** Confidential ***" aggregated_log_count="*** Confidential ***" url_count="*** Confidential ***" src="*** Confidential ***" dst="*** Confidential ***" proto="*** Confidential ***" client_type_os="*** Confidential ***" web_client_type="*** Confidential ***" web_server_type="*** Confidential ***" user="*** Confidential ***" src_user_name="*** Confidential ***" src_machine_name="*** Confidential ***" src_user_dn="*** Confidential ***" snid="*** Confidential ***" dst_user_name="*** Confidential ***" dst_machine_name="*** Confidential ***" dst_user_dn="*** Confidential ***" UserCheck_incident_uid="*** Confidential ***" UserCheck="*** Confidential ***" log_id="*** Confidential ***" user_status="*** Confidential ***" portal_message="*** Confidential ***" UserCheck_Confirmation_Level="*** Confidential ***" frequency="*** Confidential ***" UserCheck_Interaction_name="*** Confidential ***" service_id="*** Confidential ***" https_inspection_action="Inspect" inzone="*** Confidential ***" outzone="*** Confidential ***" UP_match_table="*** Confidential ***" ROW_START="*** Confidential ***" match_id="*** Confidential ***" layer_uuid="*** Confidential ***" layer_name="*** Confidential ***" rule_uid="*** Confidential ***" rule_name="Internet for PC" ROW_END="*** Confidential ***" ROW_START="*** Confidential ***" match_id="*** Confidential ***" layer_uuid="*** Confidential ***" layer_name="*** Confidential ***" rule_uid="*** Confidential ***" rule_name="White List for ALL" ROW_END="*** Confidential ***" UP_match_table="*** Confidential ***" UP_action_table="*** Confidential ***" ROW_START="*** Confidential ***" action="*** Confidential ***" ROW_END="*** Confidential ***" ROW_START="*** Confidential ***" action="*** Confidential ***" ROW_END="*** Confidential ***" UP_action_table="*** Confidential ***" UP_par...]
Thanks in advance for your reply!
It looks like sk101570
Thanks for your quick answer!
But I'm afraid sk101570 doesn't solve the underlying problem. This article talks about ***Confidential*** fields. For me, this is not a solution to a non-primary problem. It is important for me to receive logs in full, without "...]" at the end.
I'll add another example. This is the end of the log, which contains fields that are important to us.
...log_uid="{36DA12B2-419E-AF4B-8FAA-36FCB53D7F12}" Extracted_file_types="" Extracted_file_names="" Extracted_file_hash="" Extracted_file_verdict="" Extracted_file_uid="" parent_file_hash="" parent_file_name="" parent_file_uid="" malware_type="" malware_family="" similar_iocs="" similar_hashes="" similar_strings="" similar_communication="" mitre_initial_access="" mitre_execution="" ...]
It’s not clear exactly how these logs are being monitored.
Can you elaborate on what tool(a) are being used and the precise process used?
About CheckMates
Learn Check Point
Advanced Learning
YOU DESERVE THE BEST SECURITY