Forum Discussion

Max Boella's avatar
Max Boella
Copper Contributor
Jan 07, 2019

Checkpoint firewall - automatic log collection - recommended method ?

Hi - is there a recommended/supported method to achieve automatic Checkpoint firewall log collection ?   On the Checkpoint side it seems there are 2 main log export mechanisms. 1. CPLOGTOSYSLOG to...
Cloud App Security
Cloud Discovery
Danny Kadyshevitch's avatar
Danny Kadyshevitch
Former Employee
Jan 07, 2019

Hi Max,

 

Thanks for reaching out.

Few comments on that:

  1. The general answer depends on the log format that each of these tools exports. While I'm not familiar with the format exported by "Log Exporter", MCAS do support formats exported from CPLOGTOSYSLOG.
  2. If possible, please share the format provided by the "Log Exporter", to see whether are also supported out of the box or by MCAS custom log parser.
  3. Can you elaborate some more on the meaning of "Checkpoint side Log Exporter tool is their preferred method going forward"?

 

Thanks,

Danny.

David Caddick's avatar
David Caddick
Iron Contributor
Nov 24, 2019

Hi Danny Kadyshevitch just wondering how this might play out?

 

From what we can see this was raised some time ago as well?

https://techcommunity.microsoft.com/t5/Microsoft-Cloud-App-Security/Cloud-App-Security-lack-of-integration-with-checkpoint-FW/m-p/113808

 

We can see that just using the Snapshot tool we can take a "Smart Tracker" formatted download from the Checkpoint Firewall and then upload it into MCAS and it has plenty of detail, and yet looking thru the  details here: https://docs.microsoft.com/en-us/cloud-app-security/set-up-cloud-discovery it appears that by using the AutoCollector method all we are going to see is Target and Origin IP Address only? How come there is such a disparity of the detail in the two different approaches?

 

It looks like we can get a Graduate to maually do this process as a daily task and then end up getting a decent amount of worthwhile data ingested into MCAS, but if we automate it then the level of detail falls off considerably - it could be that we've misunderstood this - but this doesn't seem to make sense? Is there possibly another way of semi-automating the upload of the Samrt Tracker logs into MCAS for ingestation? It would not be ideal as it would keep having to reference the specific snapshot....

Regards,
Dave C