Hello all,
Thanks for any help in advanced
We are trying to export log files to Azure Sentinel using cp_log_export utility which appear to be working until we add filtering based on origin. When running tcpdump with the filter we only see a handful of packet then nothing but when removing the origin filter we appear to be getting thousands of alerts passing through. I am trying to run the cp_log_export on the log server that is setup under the gateway (cp_info is shown below around the HFA applied)
I have tried both the cp_log_export switch "filter-origin-in" and modifying "FilterConfiguration.xml" but when added no logs appear to be exported into Azure Sentinel and tcpdump shows no traffic after filtering based on origin.
Logs show the following origin within Smartconsole:
Blade: Firewall
Origin: fw-hq-cluster2
Service: TCP/80
Product Family: Access
Logid: 0
Access Rule Name: Clean Up Rule
Access Rule Number: 156
Filtering configuration to shows but we not appear to see any logs or syslogs sent. I am wondering if i am filter based on the value?
more FilterConfiguration.xml
<filters>
<filterGroup operator="and">
<field name="action" operator="and">
</field>
<field name="origin" operator="or">
<value operation="eq">fw-hq-cluster1</value>
<value operation="eq">fw-hq-cluster2</value>
</field>
<field name="product" operator="or">
<value operation="eq">Anti-Bot</value>
<value operation="eq">Anti Malware</value>
<value operation="eq">Threat Emulation</value>
<value operation="eq">IPS</value>
<value operation="eq">IPS-1</value>
<value operation="eq">SmartDefense</value>
<value operation="eq">MTA</value>
<value operation="eq">Anti-Virus</value>
<value operation="eq">New Anti Virus</value>
<value operation="eq">Anti Virus</value>
<value operation="eq">Anti-Spam and Email Security</value>
<value operation="eq">Threat Extraction</value>
<value operation="eq">MTA</value>
</field>
</filterGroup>
</filters>
cpinfo -y all
This is Check Point CPinfo Build 914000215 for GAIA
[IDA]
No hotfixes..
[MGMT]
HOTFIX_R80_40_JUMBO_HF_MAIN Take: 94
[CPFC]
No hotfixes..
[FW1]
HOTFIX_R80_40_JUMBO_HF_MAIN Take: 94
HOTFIX_GOT_TPCONF_MGMT_AUTOUPDATE
FW1 build number:
This is Check Point Security Management Server R80.40 - Build 037
This is Check Point's software version R80.40 - Build 118
[SecurePlatform]
HOTFIX_R80_40_JUMBO_HF_MAIN Take: 94
[CPinfo]
No hotfixes..
[AutoUpdater]
No hotfixes..
[Reporting Module]
HOTFIX_R80_40_JUMBO_HF_MAIN Take: 94
[CPuepm]
HOTFIX_R80_40_JUMBO_HF_MAIN Take: 94
[VSEC]
HOTFIX_R80_40_JUMBO_HF_MAIN Take: 94
[SmartLog]
HOTFIX_R80_40_JUMBO_HF_MAIN Take: 94
[R7520CMP]
No hotfixes..
[R7540CMP]
No hotfixes..
[R76CMP]
No hotfixes..
[SFWR77CMP]
No hotfixes..
[SFWR80CMP]
HOTFIX_R80_40_JHF_COMP Take: 94
[R77CMP]
HOTFIX_R80_40_JHF_COMP Take: 94
[R75CMP]
No hotfixes..
[NGXCMP]
No hotfixes..
[SFWCMP]
No hotfixes..
[FLICMP]
No hotfixes..
[SFWR75CMP]
No hotfixes..
[MGMTAPI]
No hotfixes..
[CPDepInst]
No hotfixes..
[CPUpdates]
BUNDLE_R80_40_JUMBO_HF_MAIN Take: 94
BUNDLE_HCP_AUTOUPDATE Take: 29
BUNDLE_GOT_TPCONF_MGMT_AUTOUPDATE Take: 32
BUNDLE_INFRA_AUTOUPDATE Take: 44
BUNDLE_DC_INFRA_AUTOUPDATE Take: 26
BUNDLE_DEP_INSTALLER_AUTOUPDATE Take: 23
[hcp_wrapper]
HOTFIX_HCP_AUTOUPDATE
[DIAG]
No hotfixes..
tail /opt/CPrt-R80.40/log_exporter/targets/AZ-SEN/log/log_indexer.elg
[14 Jul 13:27:13] LogsFormater::Process Log Skipped
[14 Jul 13:27:13] LogsFormater::Process Log Skipped
[14 Jul 13:27:13] LogsFormater::Process Log Skipped
[14 Jul 13:27:13] LogsFormater::Process Log Skipped
[14 Jul 13:27:13] LogsFormater::Process Log Skipped
[14 Jul 13:27:13] LogsFormater::Process Log Skipped
[14 Jul 13:27:13] LogsFormater::Process Log Skipped
[14 Jul 13:27:13] LogsFormater::Process Log Skipped
[14 Jul 13:27:13] LogsFormater::Process Log Skipped
[14 Jul 13:27:13] LogsFormater::Process Log Skipped
