{"type":"doc","content":[{"type":"extension","attrs":{"layout":"default","extensionType":"com.atlassian.confluence.macro.core","extensionKey":"toc","parameters":{"macroParams":{"maxLevel":{"value":"2"},"minLevel":{"value":"2"},"type":{"value":"flat"}},"macroMetadata":{"macroId":{"value":"e5b3942d-de76-4763-b387-da230e61cba5"},"schemaVersion":{"value":"1"},"title":"Table of Contents"}},"localId":"ef08304b-9cb0-49a1-8ba8-9e126cdc630c"}},{"type":"heading","attrs":{"level":2},"content":[{"text":"Introduction","type":"text"}]},{"type":"paragraph","content":[{"text":"The tags beginning with ","type":"text"},{"text":"firewall.checkpoint","type":"text","marks":[{"type":"strong"}]},{"text":" identify log events generated by the ","type":"text"},{"text":"Check Point","type":"text","marks":[{"type":"link","attrs":{"href":"https://www.checkpoint.com/"}}]},{"text":" firewall.","type":"text"}]},{"type":"heading","attrs":{"level":2},"content":[{"text":"Valid tags and data tables","type":"text"}]},{"type":"paragraph","content":[{"text":"The full tag must have four levels. The first two are fixed as ","type":"text"},{"text":"firewall.checkpoint","type":"text","marks":[{"type":"strong"}]},{"text":". The third level identifies the tool used to forward the events and the fourth is required but you are free to define it as you like (we suggest using it to identify the location of the machine that is the event source, for example, ","type":"text"},{"text":"dmz","type":"text","marks":[{"type":"em"}]},{"text":").","type":"text"}]},{"type":"table","attrs":{"layout":"default","localId":"e8ae8eca-2568-45f1-a9f0-9d1fc6c85a17"},"content":[{"type":"tableRow","content":[{"type":"tableHeader","attrs":{"colspan":1,"rowspan":1,"colwidth":[170.0]},"content":[{"type":"paragraph","content":[{"text":"Technology","type":"text","marks":[{"type":"strong"}]}]}]},{"type":"tableHeader","attrs":{"colspan":1,"rowspan":1,"colwidth":[170.0]},"content":[{"type":"paragraph","content":[{"text":"Brand","type":"text","marks":[{"type":"strong"}]}]}]},{"type":"tableHeader","attrs":{"colspan":1,"rowspan":1,"colwidth":[170.0]},"content":[{"type":"paragraph","content":[{"text":"Tool","type":"text","marks":[{"type":"strong"}]}]}]},{"type":"tableHeader","attrs":{"colspan":1,"rowspan":1,"colwidth":[170.0]},"content":[{"type":"paragraph","content":[{"text":"Group","type":"text","marks":[{"type":"strong"}]}]}]}]},{"type":"tableRow","content":[{"type":"tableCell","attrs":{"colspan":1,"rowspan":5,"colwidth":[170.0]},"content":[{"type":"paragraph","content":[{"text":"firewall","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":5,"colwidth":[170.0]},"content":[{"type":"paragraph","content":[{"text":"checkpoint","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[170.0]},"content":[{"type":"paragraph","content":[{"text":"fw","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[170.0]},"content":[{"type":"paragraph","content":[{"text":"","type":"text","marks":[{"type":"em"}]}]}]}]},{"type":"tableRow","content":[{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[170.0]},"content":[{"type":"paragraph","content":[{"text":"gaia","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[170.0]},"content":[{"type":"bulletList","content":[{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"a","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"group1","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"sal","type":"text"}]}]}]}]}]},{"type":"tableRow","content":[{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[170.0]},"content":[{"type":"paragraph","content":[{"text":"lea","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[170.0]},"content":[{"type":"paragraph","content":[{"text":"","type":"text","marks":[{"type":"em"}]}]}]}]},{"type":"tableRow","content":[{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[170.0]},"content":[{"type":"paragraph","content":[{"text":"log_exporter","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[170.0]},"content":[{"type":"bulletList","content":[{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"group1","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"noncsv","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"generic","type":"text"}]}]}]}]}]},{"type":"tableRow","content":[{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[170.0]},"content":[{"type":"paragraph","content":[{"text":"gaia_system","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[170.0]},"content":[{"type":"paragraph","content":[{"text":"","type":"text","marks":[{"type":"em"}]}]}]}]}]},{"type":"paragraph","content":[{"text":"These are the valid tags and corresponding data tables that will receive the parsers' data:","type":"text"}]},{"type":"table","attrs":{"layout":"default","localId":"867ab423-af8b-48e1-aa3a-7298dad3315a"},"content":[{"type":"tableRow","content":[{"type":"tableHeader","attrs":{"colspan":1,"rowspan":1,"colwidth":[380.0]},"content":[{"type":"paragraph","content":[{"text":"Tag","type":"text","marks":[{"type":"strong"}]}]}]},{"type":"tableHeader","attrs":{"colspan":1,"rowspan":1,"colwidth":[380.0]},"content":[{"type":"paragraph","content":[{"text":"Data table","type":"text","marks":[{"type":"strong"}]}]}]}]},{"type":"tableRow","content":[{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[380.0]},"content":[{"type":"paragraph","content":[{"text":"firewall.checkpoint.log_exporter.group1","type":"text","marks":[{"type":"em"}]}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[380.0]},"content":[{"type":"paragraph","content":[{"text":"firewall.checkpoint.log_exporter","type":"text"}]}]}]},{"type":"tableRow","content":[{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[380.0]},"content":[{"type":"paragraph","content":[{"text":"firewall.checkpoint.log_exporter.noncsv","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[380.0]},"content":[{"type":"paragraph","content":[{"text":"firewall.checkpoint.log_exporter","type":"text"}]}]}]},{"type":"tableRow","content":[{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[380.0]},"content":[{"type":"paragraph","content":[{"text":"firewall.checkpoint.log_exporter.generic","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[380.0]},"content":[{"type":"paragraph","content":[{"text":"firewall.checkpoint.log_exporter","type":"text"}]}]}]},{"type":"tableRow","content":[{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[380.0]},"content":[{"type":"paragraph","content":[{"text":"firewall.checkpoint.gaia.","type":"text"},{"text":"","type":"text","marks":[{"type":"em"}]}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[380.0]},"content":[{"type":"paragraph","content":[{"text":"firewall.checkpoint.gaia","type":"text"}]}]}]},{"type":"tableRow","content":[{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[380.0]},"content":[{"type":"paragraph","content":[{"text":"firewall.checkpoint.lea.","type":"text"},{"text":"","type":"text","marks":[{"type":"em"}]}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[380.0]},"content":[{"type":"paragraph","content":[{"text":"firewall.checkpoint.lea","type":"text"}]}]}]},{"type":"tableRow","content":[{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[380.0]},"content":[{"type":"paragraph","content":[{"text":"firewall.checkpoint.fw.","type":"text"},{"text":"","type":"text","marks":[{"type":"em"}]}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[380.0]},"content":[{"type":"paragraph","content":[{"text":"firewall.checkpoint.fw","type":"text"}]}]}]},{"type":"tableRow","content":[{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[380.0]},"content":[{"type":"paragraph","content":[{"text":"firewall.checkpoint.gaia_system.","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[380.0]},"content":[{"type":"paragraph","content":[{"text":"firewall.checkpoint.gaia_system","type":"text"}]}]}]}]},{"type":"paragraph","content":[{"text":"These tags are designed to accommodate the different ways that the firewall events can be exported to Devo.","type":"text"}]},{"type":"bulletList","content":[{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"If you use the ","type":"text"},{"text":"Check Point Log Exporter","type":"text","marks":[{"type":"link","attrs":{"href":"https://supportcenter.checkpoint.com/supportcenter/portal?eventSubmit_doGoviewsolutiondetails=&solutionid=sk122323"}}]},{"text":", then it is the ","type":"text"},{"text":"firewall.checkpoint.log_exporter.","type":"text","marks":[{"type":"em"}]},{"text":" tag. This is the recommended option.","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"If you use the ","type":"text"},{"text":"ArcSight SmartConnector for Check Point","type":"text","marks":[{"type":"link","attrs":{"href":"https://community.microfocus.com/t5/ArcSight-Connectors/SmartConnector-for-CheckPoint-OPSEC-NG/ta-p/1583904"}}]},{"text":", then it is the ","type":"text"},{"text":"firewall.checkpoint.gaia.","type":"text","marks":[{"type":"em"}]},{"text":" tag.","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"If you use OPSEC LEA, then it is the ","type":"text"},{"text":"firewall.checkpoint.lea.","type":"text","marks":[{"type":"em"}]},{"text":" tag.","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"If you use any other method, then it is the ","type":"text"},{"text":"firewall.checkpoint.fw.","type":"text","marks":[{"type":"em"}]},{"text":" tag.","type":"text"}]}]}]},{"type":"paragraph","content":[{"text":"Regardless of the third level of the tag, all firewall log events will be saved in the ","type":"text"},{"text":"firewall.checkpoint.fw ","type":"text","marks":[{"type":"strong"}]},{"text":"data ta","type":"text"},{"text":"ble. The fourth level of the tag will appear in the data table in a column labeled ","type":"text","marks":[{"type":"textColor","attrs":{"color":"#000000"}}]},{"text":"group","type":"text","marks":[{"type":"textColor","attrs":{"color":"#000000"}},{"type":"strong"}]},{"text":".","type":"text","marks":[{"type":"textColor","attrs":{"color":"#000000"}}]}]},{"type":"heading","attrs":{"level":2},"content":[{"text":"How is the data sent to Devo?","type":"text"}]},{"type":"paragraph","content":[{"text":"Logs generated by the Check Point firewall must be sent to the Devo platform via the ","type":"text","marks":[{"type":"textColor","attrs":{"color":"#003366"}}]},{"text":"Devo Relay ","type":"text","marks":[{"type":"textColor","attrs":{"color":"#003366"}},{"type":"link","attrs":{"href":"/wiki/spaces/latest/pages/96468993"}}]},{"text":"to secure communication and apply the correct tag. Before that, you need to export the log events in syslog format and then direct them to a relay port by configuring the ","type":"text","marks":[{"type":"textColor","attrs":{"color":"#003366"}}]},{"text":"relay rules","type":"text","marks":[{"type":"textColor","attrs":{"color":"#003366"}},{"type":"link","attrs":{"href":"/wiki/spaces/latest/pages/96469377"}}]},{"text":" as shown below:","type":"text","marks":[{"type":"textColor","attrs":{"color":"#003366"}}]}]},{"type":"heading","attrs":{"level":3},"content":[{"text":"Relay rule 1 - Check Point Firewall","type":"text"}]},{"type":"bulletList","content":[{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Source Port ","type":"text","marks":[{"type":"strong"}]},{"text":"→ any free port you can dedicate to the incoming events","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Target Tag","type":"text","marks":[{"type":"strong"}]},{"text":" → the target tag depends on the method used to export the events (we recommend you to use the ","type":"text"},{"text":"Check Point Log Exporter","type":"text","marks":[{"type":"link","attrs":{"href":"https://supportcenter.checkpoint.com/supportcenter/portal?eventSubmit_doGoviewsolutiondetails=&solutionid=sk122323"}}]},{"text":")","type":"text"}]},{"type":"bulletList","content":[{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"firewall.checkpoint.log_exporter.","type":"text","marks":[{"type":"em"}]}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"firewall.checkpoint.gaia.","type":"text","marks":[{"type":"em"}]}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"firewall.checkpoint.lea.","type":"text","marks":[{"type":"em"}]}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"firewall.checkpoint.fw.","type":"text","marks":[{"type":"em"}]}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"firewall.checkpoint.gaia_system.","type":"text","marks":[{"type":"em"}]}]}]}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Check the ","type":"text"},{"text":"Sent without syslog tag","type":"text","marks":[{"type":"strong"}]},{"text":" option.","type":"text"}]}]}]},{"type":"mediaSingle","attrs":{"layout":"align-start","width":65.0},"content":[{"type":"media","attrs":{"width":969,"id":"e0166cfe-baa2-4e7b-94fa-5343e5b2e86c","collection":"contentId-313795073","type":"file","height":746}}]},{"type":"paragraph"}],"version":1}

Browser not supported