how to send log from Checkpoint Gaia R77.20 OPSEC LEA to Splunk/external syslog Server.

[shamimalam]

Hello Expert.

I have R77.20 Gaia. I need help to configure OPSEC LEA to send logs to externla syslog Server/Splunk.

Please guide me or share if any SK is available.

[peter_schumache]

It's difficult to get questions answered when working on unsupported Software versions, like R77.20

If you run a supported version,  sk122323 might help

[PhoneBoy]

OPSEC LEA requires a third party connector to pull the logs.
Whether Splunk still maintains their previous LEA connector, I'm not sure.
The preferred method for integration with ALL SIEMs including Splunk is Log Exporter.
Log Exporter is not available on R77.20.
You will need to upgrade to a supported release.

[Amir_Senn]

I would like to help you but my best recommendation is to upgrade and work with log exporter, at least to R77.30.

I'm also attaching a guide I have about how to connect Splunk with OPSEC LEA.

Amir Senn

[Amir_Senn]

I'll be happy to know if the guide I offered (or any other answer here) helped you.

You can also leave contact info and if you still have issues we'll be glad to help you through them.