topic Re: Which firewall logs are supported in Splunk? in Security

Which firewall logs are supported in Splunk?

Sagar0511 — Wed, 18 Oct 2017 06:11:45 GMT

May I know which firewalls logs are supported and which format it should be. In my organization there is Checkpoint firewall. The logs of it will get upload or not and in which format.

Re: Which firewall logs are supported in Splunk?

gcusello — Wed, 18 Oct 2017 06:43:39 GMT

Hi Sagar0511,

You can ingest all logs in text format, there isn't a supported format!

For the most used logs there already are also technical Addons (TAs) for ingesting and parsing logs, you can find them in apps.splunk.com.
Otherwise you can build your own parsing with just a little effort.

Anyway for Check Point, as you can see, there's a TA for OPSEC ( https://splunkbase.splunk.com/app/3197 ) and one for syslogs ( https://splunkbase.splunk.com/app/2996 ), in addition there are some Apps for monitoring ( https://splunkbase.splunk.com/app/2670 https://splunkbase.splunk.com/app/3054 https://splunkbase.splunk.com/app/2844 ).

Bye.
Giuseppe

Re: Which firewall logs are supported in Splunk?

Sagar0511 — Wed, 18 Oct 2017 10:59:14 GMT

Thanks. The Information and Links were really helpful.