Transfer logs to the ArcSight

[Ivan_Matreniche]

How I can transfer log messages to SIEM ArcSight ? 

[PhoneBoy]

You would have to contact HPE for assistance with configuring Arcsight to pull Check Point logs.

However, a quick Google search found this: https://hpe-sec.com/foswiki/bin/view/ArcSightActivate/CheckPointFwConfiguration 

[Timothy_Hall]

At a customer site I ran into an Arcsight SIEM integration that broke after upgrading from R77.30 to R80.  Turned out the OPSEC library used to compile that version of the Arcsight application did not support the SHA-256 algorithm, which is used by default to sign the CRL in R80 and later.  See the following for a workaround involving SHA-1: sk109618: OPSEC SIC connection fails.

--
My book "Max Power: Check Point Firewall Performance Optimization"
now available via http://maxpowerfirewalls.com.