topic Splunk add-on for Check Point OPSEC LEA: Change HOST field to be firewall IP not the management station ip in All Apps and Add-ons

Splunk add-on for Check Point OPSEC LEA: Change HOST field to be firewall IP not the management station ip

gstefancyk — Tue, 13 Feb 2018 17:19:39 GMT

We have been ingesting our Check Point logs via the Check Point OPSEC LEA add-on and finally realized that the HOST being reported is always our management station IP where we are pulling logs from... Is there a way to change this in the OPSEC Lea add on or would we be better off doing this in transforms.conf and props.conf on the heavy forwarder?

Re: Splunk add-on for Check Point OPSEC LEA: Change HOST field to be firewall IP not the management station ip

FrankVl — Wed, 28 Feb 2018 12:22:09 GMT

You can use props and transforms to overwrite it (e.g. based on the orig= field).
See this recent discussion: https://answers.splunk.com/answers/615561/how-to-overwrite-the-host-field-value-with-dvc-fie.html

Re: Splunk add-on for Check Point OPSEC LEA: Change HOST field to be firewall IP not the management station ip

gstefancyk — Wed, 28 Feb 2018 12:42:20 GMT

Thanks FrankVI, exactly what I expected but nice to get some re-assurance.

Re: Splunk add-on for Check Point OPSEC LEA: Change HOST field to be firewall IP not the management station ip

mathieuamos — Mon, 21 May 2018 18:48:39 GMT

What field was your fw coming into Splunk as? And did you have to change logging on mgmt server to get the fw info to be sent to Splunk?