Explorer III

Solved

Integration Checkpoint in FortiSIEM

Forum|Forum|2 years ago
May 21, 2024
10 replies
4367 views

Hi,

Please can you help to integrate checkpoint firewall to my FortiSIEM.

I have logs in my siem but it's unknown_EventType .

How can I parse thé logs?

Best answer by cdurkin_FTNT

Thank you.

So I believe the issue here is that we require syslog in CEF format.

The above sample is not CEF.

https://docs.fortinet.com/document/fortisiem/7.1.6/external-systems-configuration-guide/335430/check-point-firewall-1

cdurkin_FTNT

Staff

Can you provide more information!

Version of Checkpoint?

Is it Syslog your sending?

What do the logs look like?
Is it all logs or just individual logs that are not parsing?

Waloo5Author

Explorer III

Hi, thank you for your replay

- Checkpoint Version 81.20

- log sending are syslog

- logs are like: <134>1 2024-05-21T13:29:35Z Jidar CheckPoint 14762 - [action:"HTTPS Bypass"; flags:"393216"; ifdir:"inbound"; ifname:"eth0"; loguid:"{0x664ca1bf,0x12,0x296960a,0x1d08b9aa}"; origin:"10.150.150.2"; originsicname:"cn=cp_mgmt,o=jidar.ont.org"; sequencenum:"1"; time:"1716298175"; version:"5"; __policy_id_tag:"product=VPN-1 & FireWall-1[db_tag={6FD6C417-5FBC-1549-A5D1-3C30245C2AD5};mgmt=jidar;date=1715777317;policy_name=package_17022020\]"; dst:"23.47.189.163"; https_inspection_action:"Bypass"; https_inspection_rule_id:"{A7204184-CDFF-4532-A30C-50490D6296AB}"; https_inspection_rule_name:"Predefined Rule"; product:"HTTPS Inspection"; proto:"6"; s_port:"63591"; service:"443"; src:"172.16.21.174"; log_link:"

- all logs are not parsing and showed as Unknown_EventType

cdurkin_FTNTAnswer

Staff

Thank you.

So I believe the issue here is that we require syslog in CEF format.

The above sample is not CEF.

https://docs.fortinet.com/document/fortisiem/7.1.6/external-systems-configuration-guide/335430/check-point-firewall-1

Waloo5Author

Explorer III

Hi,

I apply change in my Checkpoint FW to send CEF format but still Unknown

FYI : in Fortisiem CMDB the device is in category "Generic"

cdurkin_FTNT

Staff

Can you give a few new sample events in CEF format.

Waloo5Author

Explorer III

Hi, I clicked by error

Here is log

<134>1 2024-05-21T15:54:11Z Jidar CheckPoint 14762 - [action:"Accept"; flags:"417028"; ifdir:"inbound"; ifname:"eth0"; logid:"0"; loguid:"{0x9a21907,0xa430b040,0xe8b082dc,0x2ffdd8d0}"; origin:"10.150.150.2"; originsicname:"cn=cp_mgmt,o=jidar.ont.orgm7kic3"; sequencenum:"6"; time:"1716306851"; version:"5"; __policy_id_tag:"product=VPN-1 & FireWall-1[db_tag={BD8249E2-5B97-8243-9A5D-2AC67F5694C2};mgmt=jidar;date=1716305572;policy_name=package_17022020\]"; dst:"192.168.3.110"; inzone:"Internal"; layer_name:"package_17022020 Security"; layer_uuid:"8a3192b4-5c30-4dd2-9d87-2678ac934224"; match_id:"49"; parent_rule:"0"; rule_action:"Accept"; rule_uid:"1f0ca9bd-c881-4295-8b4a-0f50d18644ca"; outzone:"External"; product:"VPN-1 & FireWall-1"; proto:"17"; s_port:"43578"; service:"161"; service_id:"snmp"; src:"192.168.1.148";

Sign up

Login with SSO

Login to the community

Login with SSO