topic Re: Logs are encrypted in Security

Logs are encrypted

changhieuzi — Thu, 15 Nov 2012 04:48:27 GMT

Hi,
I collect logs from Checkpoint firewall and these logs are encrypted. How do Splunk read and analyze this log ?

Re: Logs are encrypted

martin_mueller — Thu, 15 Nov 2012 10:28:27 GMT

You can write a decrypting script and run it as a scripted input.

Re: Logs are encrypted

Ayn — Thu, 15 Nov 2012 10:39:32 GMT

Really encrypted or just in Checkpoint's binary format?

Re: Logs are encrypted

changhieuzi — Wed, 21 Nov 2012 03:14:12 GMT

Hi !
I will explain in detail my network diagram and my problem below

Network diagram
Checkpoint FW >> Syslog server >> Splunk
(mean: The first Checkpoint FW generates logs >> These logs are forwarded to syslog server which is Windows server 2k8(then user copies these logs to storage device) >> upload offline to Splunk server to index).

My problem is the logs data which is encrypted when they came out from FW

How do I do to read the logs?

Thank you !!

Re: Logs are encrypted

changhieuzi — Wed, 21 Nov 2012 03:21:37 GMT

There are 2 pics which are logs in display. I uploaded they to my dropbox
https://www.dropbox.com/s/iyoht5ttyz02w9k/logviewer1.png

https://www.dropbox.com/s/qftwn15y12bguws/logviewer2.png

Re: Logs are encrypted

changhieuzi — Thu, 22 Nov 2012 03:09:17 GMT

Hi !
I will explain in detail my network diagram and my problem below
Network diagram
Checkpoint FW >> Syslog server >> Splunk
(mean: The first Checkpoint FW generates logs >> These logs are forwarded to syslog server which is Windows server 2k8(then user copies these logs to storage device) >> upload offline to Splunk server to index).
My problem is the logs data which is encrypted when they came out from FW
How do I do to read the logs?
Thank you !!

There are 2 pics which are logs in display. I uploaded they to my dropbox
https://www.dropbox.com/s/iyoht5ttyz02w9k/logviewer1.png
https://www.dropbox.com/s/qftwn15y12bguws/logviewer2.png

Re: Logs are encrypted

sowings — Thu, 22 Nov 2012 04:55:10 GMT

Do you need the Checkpoint LEA log grabber?

http://splunk-base.splunk.com/apps/22386/opsec-lea-for-check-point-linux