Events from SmartEvent to SIEM

[Johan_van_Somme]

Hi All,

Yes I know, Check Point is working or doing a survey on how to forward events to 3rd party SIEM tools.

However we can't wait this long, currently we filter the logs using the logforwarder to our SIEM (using Syslog), however data ingest is reasonable.

Furthermore, our deployement consists of a reasonable amount of Quantum Gateways which forwards those logs to our SmartEvent server within an MDS system. So integration with Smart-1 Cloud is an feasible option right now.

We could however forward the logs only to the Smart-1 Cloud, but we're unsure if we can create a link to our SIEM solution. Does anyone created a solution to forward events and alerts only from an mostly onprem environment to a 3rd party SIEM. 

Other then forwarding the raw syslogs into the 3rd party SIEM datalake and do the filtering right there.

btw we do some filtering on the SmartEvent logforwarder also, however this is pretty cumbersome.

Hope anyone can help, thanks for the assistance in advance.

Greetz, Johan

[AkosBakos]

Hi @Johan_van_Somme 

The cp_log_export solution is not suitable for this?

https://support.checkpoint.com/results/sk/sk122323

Akos

[Johan_van_Somme]

Thanks AkosBakos,

Thanks for the quick reply, we've already using the log_forwarder currently and doing a lot of filtering in the log_forwarder configuration already. However this doesn't bring us to the bare necessity just yet. What we're trying to achieve is not raw logs into the SIEM, but only actionable alerts and events to our 3rd party SIEM. And keep intelligence in Check Point and only forward actionable events to the SIEM with metadata on the alert. So we've have some correlation on events. 
Otherwise the data ingest from our gateways will increase the cost of hot storage on our SIEM considerably. 
Hope anyone else has some more insight on how to accomplish this.

[PhoneBoy]

As far as I know, only raw logs can be forwarded to an external SIEM.
The correlations made in SmartEvent are not forwarded.
This is most likely an RFE that should be discussed with your local Check Point office.

[Johan_van_Somme]

Hi Dameon,

Thanks for your input, we're talking to our local SE and CP AM already about this use case. And already issued a RFE to R&D on this topic. 
I could imagine that this use case is of an issue with other customers, so hopefully this can be addressed somehow.

For now keep me posted

[PhoneBoy]

At a high level, I'm curious how these would be communicated to the SIEM...beyond just sending the logs relevant to what was correlated.
This is where understanding the necessary use case(s) is key.