I try to config Checkpoint Security Manager forwarding to a Syslog serrver, but I cant find option to create a syslog server in object catagories.
Yuval answered in the thread below. A syslog option is in development. Sending logs to a client like the open source fw1-loggrabber that is compiled with the OPSEC SDK and uses the LEA APIs is an option.
Sending Check Point security logs to 3rd party devices via syslog
I got error when upgrade from 77.30 to r80 and qrada because of qrada dont support high encryption like sha-256. That why I try syslog.
OPSEC LEA is still probably your best option. Not sure QRadar has a syslog parser for Check Point logs. QRadar is testing their LEA client built using the SHA-256 libraries. You may be able to get an updated LEA client via their support. They plan to add SHA-256 support by the end of the year, maybe sooner. Another option is to downgrade your R80 server to SHA1 via sk103840, pasting below for your convenience.
Notes about R80 Management Server:Starting from R80, the default signing algorithm of the Internal CA (ICA) was changed from SHA-1 to SHA-256. Environments with products, which do not support SHA-256, must be manually configured to use SHA-1. Using SHA-256 will cause connectivity failure in un-supporting products.
thank you !
Retrieving data ...