CheckPoint SmartView is a good tool for log reviews with its templates like Attacks Allowed by Policy. During IPS profile testing on the 1550 - you had to limit IPS protections in a special SMB profile with the older Embedded GAiA models while 1550 / R80.20 now has a TP policy like all GAiA GWs do - i also used SmartView. This gave me an odd encounter i would not have expected: hosts encountered an exploit attempt ! Have a look:
![list.png list.png](https://community.checkpoint.com/t5/image/serverpage/image-id/3512iB1ABD757A6D6B0C6/image-size/large?v=v2&px=999)
The 1550 FifteenFifty 😊 is managed by SMS7520 🙃 and set to send Security Logs and Syslog there. Seems not to be easy with Syslog, though:
![card.png card.png](https://community.checkpoint.com/t5/image/serverpage/image-id/3514iF4E25C38ED32DC7B/image-size/large?v=v2&px=999)
Matthaeus 5:30:
And if thy right hand offend thee, cut it off, and cast it from thee 😎
CCSE / CCTE / CCME / CCSM Elite / SMB Specialist