Report / Log of Anti-Bot and Anti-Virus Updates

[Jason_Grubbs]

Hello CheckMates!

Our audit team is looking for a report that shows that our firewalls are checking for Anti-Virus and Anti-Bot updates AND that they were successfully installed.

I dug through the reports but didn't find any.  I am attempting to dig through the logs, but haven't had much success.

If I go to Security Policies, Threat Prevention, Policy, Updates, I do see the status of the updates.  There has to be a log somewhere with this information.

Surely someone has a way to verify that the updates are successful.

[Maarten_Sjouw]

We are running through similar requirements and my colleague is working on those checks with SNMP, when you enable the Check Point SNMP daemon, this information can be collected. We are using CheckMK and we now get warnings and alerts when the updates fail.

For IPS we are working in a similar way but need to run a small script to be able to collect the data, it cannot be done through SNMP as the update is not a local thing but a management server update, which is then pushed down to the gateway.

I do have a script that takes the Domain server name and the update number into a single file so I have a overview of all domains' status. See the discussion on that here: https://community.checkpoint.com/thread/8331-ips-update-check-per-domain-r7730 

[Jason_Grubbs]

Thanks Maarten!

Can you go into any specifics as to what you are monitoring and how the alerts are setup? We use Solarwinds. I don’t see much even though SNMP is setup correctly.

[Maarten_Sjouw]

Jason, I am sorry but I cannot help you here as I have no experience in setting up the alerts myself. But as I said already you do need to go into the gateways' cpconfig and turn on Check Point SNMP.

Then you should be able to use them with Solarwinds when you download the mib files you can find here: sk90470 Check Point SNMP MIB files

When you use mibwalkyou should be able to find the right mib and set an alert for it.