Logs forwarding

[ojuser]

Can we send Check Point 730 Appliance system and security logs to AWS EC2 system directly through syslog configuration ?

[PhoneBoy]

SMB device logs can be forwarded through syslog.
Security Logs from SMB can only be forwarded through an OPSEC LEA connection (not syslog).

[ojuser]

Any idea how I can configure the logs from CP to AWS EC2 instance through OPSEC LEA. Do I need to configure anything extra as I don't have CP SMS licence in my environment. Please share some details / documents which can be helpful here. Thanks.

[PhoneBoy]

You would need an SMS to receive the logs from the 730.
That SMS could run in AWS using a PAYG license.
Once on an SMS you could use Log Exporter to send the logs via syslog wherever it needs to go.

[Pedro_Espindola]

Actually, you CAN export security logs via syslog, but it will be plain UDP syslog, without any security or guarantee of delivery.

Also, the format is not very friendly and you'd need to customize your own filter.

[PhoneBoy]

Pretty sure that's only for OS logs and not Security logs.

[DeletedUser]

Not sure what version we started supporting it, but yes includes the option to send security logs. Enable Show obfuscated if needed. As Pedro says not sent securely and will need to parse them to do any reporting on them.

The central log server may be the better option for both of these reasons.

[Vladimir]

Yep, it's been around for a while.

I am logging to NAS-based syslog in my lab from standalone 1430:

[PhoneBoy]

Well then, I'm happy to be wrong in this case.
And it must be a relatively recent feature.

[Pedro_Espindola]

I think it is available since R77.20.80.