Similar logs For Identity Awareness

[JasminThejojo]

Hi,

I have searched from qradar and got similar logs as below. The only different item is "sequencenum", is this desired situation? 

Any advice would be appreciated.

Best

Jasmin

LEEF:2.0|Check Point|Identity Awareness|1.0|Log In|devTime=devtime               usrName=xxx   cat=Identity Awareness  action=Log In     ifdir=inbound               logid=logid     loguid={aaa}               origin=ip              originsicname=zzz              sequencenum=6               version=5            auth_method=User Authentication (Active Directory)            auth_status=Successful Login      client_name=Active Directory Query               client_version=R81.10     domain_name=domain_name       endpoint_ip=ip_address              identity_src=AD Query   identity_type=user           snid=sn_id   src=src              src_user_group=src_user_group               src_user_name=xxx

LEEF:2.0|Check Point|Identity Awareness|1.0|Log In|devTime=devtime               usrName=xxx   cat=Identity Awareness  action=Log In     ifdir=inbound               logid=logid     loguid={aaa}               origin=ip              originsicname=zzz              sequencenum=7            version=5            auth_method=User Authentication (Active Directory)            auth_status=Successful Login      client_name=Active Directory Query               client_version=R81.10     domain_name=domain_name       endpoint_ip=ip_address              identity_src=AD Query   identity_type=user           snid=sn_id   src=src              src_user_group=src_user_group               src_user_name=xxx

[PhoneBoy]

Is the issue you’re seeing multiple logs for what appears to be the same event?
How far apart are the logs and how many “duplicates” appear?

We do send multiple logs via Log Exporter for the same session (every 10 minutes or so).
This is probably expected behavior.

[JasminThejojo]

Hi,

Thanks for your answer. There are two events for login and logout with the same devtime. (not every 10 minutes)

Best

Jasmin

[PhoneBoy · Accepted solution]

Two logs for the same event that close to each other doesn't seem correct.
Best to check this with TAC: https://help.checkpoint.com