Direct log forwarding from Quantum Spark to on-prem SIEM

[TSOL]

Hi experts,

We are currently using multiple Quantum Spark appliances managed by Smart-1 Cloud.
We are planning to introduce an on-prem SIEM(include syslog feature) in order to perform correlation analysis
together with logs from our other network devices.

However, when using the Smart-1 Cloud Log Exporter, log forwarding is subject to
ingestion-based billing. To avoid additional costs, we would prefer to have the
Gateway itself send logs directly to our on-prem SIEM server.

I would like to ask for clarification on the following points:

1. Under Smart-1 Cloud management, is it possible for a Gateway to send logs
both to an external SIEM server and to Smart-1 Cloud at the same time?

2. If direct log forwarding from the Gateway is supported, does it require any
additional licenses?

Our intention is to continue using Smart-1 Cloud for management, while forwarding logs
independently from the Gateway directly to our SIEM.

If anyone has experience with this setup or detailed knowledge of the official
specifications, your guidance would be greatly appreciated.

Thank you in advance.

[Chris_Atkinson]

Typically configuring a syslog server entry in GAiA OS would yield only local OS logs, security logs come via the Management.

[Pedro_Espindola]

In Spark appliances, both system logs and security logs are available. They are Gaia Embedded, a whole different creature.

[AkosBakos]

Hi @TSOL 

Maybe this is what are you looking for 🙂

https://sc1.checkpoint.com/documents/Appliances/Quantum_Spark_R82.00.X/CLI/EN/Content/Topics/add-net...

Akos

[PhoneBoy]

Not sure SIEMs can injest Netflow.
Also, Netflow only communicates active connections.

[PhoneBoy]

For regular (non-SMB) gateways, there is: https://support.checkpoint.com/results/sk/sk87560 
Note this only gets firewall logs, not logs for other blades.
Not sure you can set an external syslog server for security logs on a centrally managed SMB.

[Pedro_Espindola]

Yes, you can send logs directly to a SIEM, but it is done locally on the Spark appliance, not through Smart-1 Cloud.

Just go to the WebUI and create an external log server and check the system logs and security logs boxes.

The downside is that the logs sent by Spark are a pain to parse, while Smart-1 cloud will give you a beautiful JSON.

The upside is that you can send the logs to a local forwarder with a queue/cache and not lose logs in case the internet is down.