IBM QRadar

IBM QRadar

Join this online user group to communicate across Security product users and IBM experts by sharing advice and best practices with peers and staying up to date regarding product enhancements.

 View Only

  • 1.  Receive log from Checkpoint

    Posted Fri September 27, 2019 03:41 AM
    Edited by MAC Strater Fri September 27, 2019 03:43 AM
    Hi Guy,
    I have two options for receiving log from checkpoint (R8.2) which is log sending by using syslog format and LEAF format. I configured both option but Qradar show N/A status on Log source page. However, Log activity show "Unknow generic log event"

    Remark - I alrealdy restart service on checkpoint but It still doesn't work

    Which one should be use for this case?

    ------------------------------
    MAC Strater
    ------------------------------


  • 2.  RE: Receive log from Checkpoint

    Posted Fri September 27, 2019 06:47 AM

    We use the OPSEC/LEA protocol for our logs.  Following the IBM guide (linked below) worked for us:

    https://www.ibm.com/support/knowledgecenter/en/SS42VS_DSM/com.ibm.dsm.doc/c_DSM_guide_Checkpoint_firewall1_intro.html?cp=SS42VS_7.3.2#c_dsm_guide_checkpoint_firewall1_intro



    ------------------------------
    T
    ------------------------------

    Original Message


  • 3.  RE: Receive log from Checkpoint

    Posted Mon September 30, 2019 07:38 AM
    I does work for me 
    Thank you! 

    Another way, I found these artical "https://www.ibm.com/support/pages/troubleshooting-check-point-syslog-leef-events-log-exporter-cplogexport-utility" You can send syslog by using leef format but you also need to edit XML file on checkpoint. Plain syslog (eg. firewall accept/reject)can be read! in the same time complex syslog still can't be read.

    ------------------------------
    MAC Strater
    ------------------------------

    Original Message


  • 4.  RE: Receive log from Checkpoint

    Posted Mon October 07, 2019 09:01 AM
    Edited by Stefan Lindén Sat October 12, 2019 07:40 AM
    Interesting, ​I'm told by both IBM and CheckPoint that OPSEC/LEA is obsolete and we should use LEEF.
    I hope that the "out-of-the-box" support for CheckPoint LEEF will become more stable for, not only the FW events which works well, but also CheckPoint SmartDefense, URl Filtering etc.

    ------------------------------
    Stefan
    ------------------------------

    Original Message


Related Content