we are sending logs to microsoft sentinel but how to we check what logs are we sending

[chinmay12]

when I use the command cp_log_export show it does show the sentinel IP address as target server but it doesnt tell me what logs are we sending , how do I check that.

[the_rock · Accepted solution]

Its all in file below, just make sure you go to right path based on your config. Example in my lab.

Andy

[Expert@CP-MANAGEMENT:0]# cd /opt/CPrt-R82/log_exporter/targets/test-log/
[Expert@CP-MANAGEMENT:0]# vi targetConfiguration.xml
[Expert@CP-MANAGEMENT:0]#

[chinmay12]

Thanks Rock 🙂

[the_rock]

Glad we can help. Btw, I attached short video to demonstrate, its all set up via smart console now, no need to do anything via ssh actually.

Andy

[chinmay12]

Thanks Rock it helps a lot. Also please could you direct me to an article which explains how to build a .XML file for granular log forwarding.

[the_rock]

Here is one example. BUT, as TAC guy told me once, which sort of goes without saying actually, make sure to backup the original file first, in case you need it and then you can make whatever changes.

Andy

https://support.checkpoint.com/results/sk/sk174145

[chinmay12]

Thanks Rock, is there a best practice document which explains what logs can be forwarded to Sentinel. considering that there is storage limitation with Sentinel.

[the_rock]

Not that Im aware of. Best is below.

Andy

https://sc1.checkpoint.com/documents/R81/WebAdminGuides/EN/CP_R81_SecurityManagement_AdminGuide/Topi...

https://support.checkpoint.com/results/sk/sk122323

[the_rock]

I was thinking, if you need some sort of an official guide or document (apart from what I had already sent), maybe open TAC case to verify.

Andy