Create a Post
cancel
Showing results for 
Search instead for 
Did you mean: 
Arturxr
Explorer

Sending syslog from CheckPoint R81 to SIEM

Hi, tell me, is it possible to configure syslog so that administration data is also transmitted to SIEM (actions performed by administrators on the management server, events related to changing system objects?

0 Kudos
9 Replies
Wolfgang
Mentor
Mentor

@Arturxr 

 Log Exporter - Check Point Log Export will be the tool for your need. You can forward audit logs only .

 

Arturxr
Explorer

Yes, I studied this sk, only security and audit logs are sent, it turns out that they do not contain administration data and cannot be sent to siem in any way?

0 Kudos
Wolfgang
Mentor
Mentor

@Arturxr please explain "administration data", maybe with an example which information do you need to send to the SIEM.

If you change something in the rulebase or change objects, these changes are collected in the audit log.

0 Kudos
Arturxr
Explorer

In SIEM, it is necessary to transfer information on changing objects (rules, hosts, subnets, etc.)
This information comes through OPSEC, but can it be configured through the Log Exporter?

0 Kudos
Wolfgang
Mentor
Mentor

@Arturxr as I wrote in my post, this information"changing objects (rules, hosts, subnets, etc." is logged in the audit logs of  your SMS and it's possible to send them to SIEM . Have a look at the audit log view in Smartconsole, every information shown there can be send to SIEM. There is no need for the use of the OPSEC interface, LogExporter does this. 

Arturxr
Explorer

I understand correctly? is it set up here?

Снимок.PNG

0 Kudos
Wolfgang
Mentor
Mentor

Yes, that's correct. If you want to send audit logs only you have to do advanced configuration and change the configuration xml file. Change <log_types> all </log_types> to  <log_types> audit </log_types>.

0 Kudos
Arturxr
Explorer

Thanks, where can I find this xml file?

0 Kudos
Wolfgang
Mentor
Mentor

Everything you need is found here, please read this.

 Log Exporter - Check Point Log Export 

The Log Exporter configuration for the target server is saved in:
$EXPORTERDIR/targets/<Name of Log Exporter Configuration>/targetConfiguration.xml

 

0 Kudos