Checkpoint Log exporter to Microsoft Cloud apps discovery

[furi]

Hi Team,

We've been trying to set things up to automate the log upload process for Microsoft Cloud apps discovery. We first tried setting the checkpoint log format to Syslog and set the Microsoft receiver type to syslog. But we saw that the Microsoft side did not parse it correctly. Return it as an error.

Is someone who makes it happen, except using a custom log parser? We try to make it by using a continuous log upload procedure.

Regards

[the_rock]

Can you send us an error, please?

Andy

[furi]

Hi Andy,

 we have uploaded successfully, but microsoft did not parse it and throw the above error out as you will see. microsoft side say that they support checkpoint. But they can not parse it. We want to use the feature.
End of the line is disappear in the pic, it is 

CHECKPOINT_CEF_SYSLOG

[the_rock]

So its complaining about the log format. Can you send output of cp_log_export show?

Andy

[furi]

name: MicrosoftCloudApp-logcollector
      enabled: false
      target-server: 10.X.X.X
      target-port: 514
      protocol: udp
      format: syslog
      read-mode: semi-unified
      export-attachment-ids: false
      export-link: false
      export-attachment-link: false
      time-in-milli: false
      export-log-position: false
      reconnect-interval: Not configured, using default

[the_rock]

Not sure then why it does not parse it on the other side, since you selected syslog. Did you reach out to their support?

Andy

[furi]

nope, the checkpoint side has already published a SK for that purpose?https://support.checkpoint.com/results/sk/sk177524

However, some say that they achieve this by using the CEF format. https://community.checkpoint.com/t5/Management/Log-Exporter-to-Microsoft-Defender-for-Cloud-Apps/td-...

We also tried it, but still no chance. I just open it to check if someone who is achieve also.

Regards

[the_rock]

Not sure if that sk would be 100% applicable in your case, but I would certainly try with different formats to see if it makes any difference.

Andy

[furi]

When I followed up on the SK, I saw the Microsoft Side report.  They correctly parse the data I have uploaded.  But I just want to do it with the auto way.

[the_rock]

Thats fine for the report, but question is does it work regardless of what log format you use?

Andy

[furi]

You need a CSV file from the checkpoint side by using logexport. then you have to tell the Microsoft which column header you need to parse and also the delimiter. just it. then you will upload the CSV file you get from the checkpoint. It will upload and try to parse it. and will notify you.

[the_rock]

K, sounds good.