Does the Splunk Add-on for Check Point OPSEC LEA support the CPLogToSyslog format?

georgen_splunk — Fri, 03 Aug 2018 17:13:55 GMT

per CP Solution ID, sk11539: How to export Check Point logs to a Syslog server using CPLogToSyslog. I've configured our management server to send FW logs to syslogd, but the current Add-on for Check Point OPSEC LEA v4.3.1 does not appear to support the new log format. This also prevents us from normalizing the syslog data to support the Common Information Model for Enterprise Security.

Does anyone happen to have an ETA to fully support this new log format?

Here is an example of the two formats.

sourcetype=opsec

time=1533315360|loc=1280|fileid=1533279600|action=accept|orig=192.168.1.201|i/f_dir=inbound|i/f_name=eth0|has_accounting=0|logId=0|log_type=connection|log_sequence_num=1|is_first_for_luuid=131072|log_version=5|origin_sic_name=cn=cp_mgmt,o=gw-e0c5cb..8ah3wt|uuid=<5b648920,00000000,c901a8c0,c0000002>|product=VPN-1 & FireWall-1|__policy_id_tag=product=VPN-1 & FireWall-1[db_tag={1866F03E-955A-2C4C-91BD-22FA52339AB9};mgmt=gw-e0c5cb;date=1532556482;policy_name=Standard]|inzone=Internal|outzone=Local|service_id=FW1_lea|src=192.168.1.250|s_port=46108|dst=192.168.1.201|service=18184|proto=tcp|match_id=2|match_table.match_id=2|layer_uuid=8a5e96fb-c793-457f-b78f-c667074223a5|match_table.layer_uuid=8a5e96fb-c793-457f-b78f-c667074223a5|layer_name=Network|match_table.layer_name=Network|rule_uid=88caafe8-df4c-4239-9087-75a612de2c9b|match_table.rule_uid=88caafe8-df4c-4239-9087-75a612de2c9b|rule_name=Splunk LEA|match_table.rule_name=Splunk LEA|rule_action=2|match_table.rule_action=2|parent_rule=0|match_table.parent_rule=0

sourcetype=syslog.opsec

Aug  3 10:00:21 192.168.1.201  Fri Aug  3 10:00:21  Log host CPLogToSyslog:  ContentVersion: 5; Uuid: {0x5b648a23,0x0,0xc901a8c0,0xc0000001}; SequenceNum: 1; Flags: 49152; Action: accept; Origin: 192.168.1.201; IfDir: <; InterfaceName: eth0; Alert: ; LogId: 0; OriginSicName: cn=cp_mgmt,o=gw-e0c5cb..8ah3wt; OriginSicName: cn=cp_mgmt,o=gw-e0c5cb..8ah3wt; log_type: connection; is_first_for_luuid: 131072; inzone: Local; outzone: Internal; service_id: cp_udp_85FA60B6_96D2_4AD7_ABCE_61C392C2F3F1; src: 192.168.1.201; dst: 192.168.1.250; proto: 17; match_id: 3; match_table.match_id: 3; layer_uuid: 8a5e96fb-c793-457f-b78f-c667074223a5; match_table.layer_uuid: 8a5e96fb-c793-457f-b78f-c667074223a5; layer_name: Network; match_table.layer_name: Network; rule_uid: 725d9a70-e3a2-4e3f-b313-737c6d53c754; match_table.rule_uid: 725d9a70-e3a2-4e3f-b313-737c6d53c754; rule_name: SIEM logging; match_table.rule_name: SIEM logging; rule_action: 2; match_table.rule_action: 2; parent_rule: 0; match_table.parent_rule: 0; aba_customer: SMC User; date: 3Aug2018; hour: 10:00:19; type: connection; Interface: > eth0; ProductName: VPN-1 & FireWall-1; svc: 9514; sport_svc: 53164;

Using simple field extractions, we've been able to identify all the notable fields, but I'm sure there's a bit more that's required here.

Sample current props + transforms
props.conf

[syslog.opsec]
REPORT-extractfields = extract_opsec_fields

transforms.conf

[extract_opsec_fields]
DELIMS = ";", ":"

Re: Does the Splunk Add-on for Check Point OPSEC LEA support the CPLogToSyslog format?

georgen_splunk — Fri, 03 Aug 2018 18:43:51 GMT

an Enhancement request has been filed with our Products team to support this new format in the future, please open a Support case and reference ADDON-18988 for current status.

Re: Does the Splunk Add-on for Check Point OPSEC LEA support the CPLogToSyslog format?

tkopchak — Fri, 28 Sep 2018 12:54:04 GMT

There is an app that supports using Check Point log exporter (sk122323, sending logs via syslog): https://splunkbase.splunk.com/app/4180

This should allow you to collect logs via syslog and have them normalized to the CIM.

topic Does the Splunk Add-on for Check Point OPSEC LEA support the CPLogToSyslog format? in All Apps and Add-ons

Does the Splunk Add-on for Check Point OPSEC LEA support the CPLogToSyslog format?

Re: Does the Splunk Add-on for Check Point OPSEC LEA support the CPLogToSyslog format?

Re: Does the Splunk Add-on for Check Point OPSEC LEA support the CPLogToSyslog format?