https://community.splunk.com/t5/All-Apps-and-Add-ons/OPSEC-LEA-Confidential/m-p/55540#M70325 <P>To fix such issues please follow the steps below.</P> <OL> <LI><P>Open Smart Dashboard. Go to OPEC Splunk object. Then click on LEA Permissions.<BR /> Here you need to Change "Permission to read logs" to Show all log fields. By default this is set to "Hide all confidential log fields".</P></LI> <LI><P>Install Database and then Push policy</P></LI> <LI><P>reboot Check Point management server.</P></LI> </OL> <P>I tried cpstop/cpstart on management server and also re-setting LEA connection from OPSEC LEA's state settings (disable/enable) but I could still see many fileds as confidential in Check Point logs. After reboot of Check Point Management server this issue was resolved.</P> <P>Thanks <BR /> Ashok<BR /> <span class="lia-inline-image-display-wrapper" image-alt="alt text"><img src="https://community.splunk.com/t5/image/serverpage/image-id/25i1C9DF67D2A304150/image-size/large?v=v2&amp;px=999" role="button" title="alt text" alt="alt text" /></span></P> Thu, 03 Sep 2015 05:55:38 GMT ashokqos 2015-09-03T05:55:38Z https://community.splunk.com/t5/All-Apps-and-Add-ons/OPSEC-LEA-Confidential/m-p/55536#M70321 <P>I have just gotten a Splunk instance running and am working on including logs from our Check Point Smart-1 management server. I've followed the docs for the Splunk OPSEC LEA add on without any significant problems and am receiving data from the management server.</P> <P>However, many of the fields are coming across as "*** Confidential ***". Is there any way to get the real values?</P> <P>Fields affected include (but not limited to): <CODE>user, src_user_name, src_machine_name, dst_user_name, dst_machine_name, appi_name, app_desc, app_risk, app_rule_id</CODE></P> <P>Here's a sample record:</P> <PRE><CODE>loc=33292 filename=fw.log fileid=1337354883 time=18May2012 12:31:28 action=reject orig=UTM1 i/f_dir=inbound i/f_name=Internal has_accounting=0 product=VPN-1 &amp; FireWall-1 __policy_id_tag=product=VPN-1 &amp; FireWall-1[db_tag={9E77F78D-A0EE-12E1-97FE-000000001819};mgmt=fwmgmt;date=1337355553;policy_name=Standard] user=*** Confidential *** src_user_name=*** Confidential *** src_machine_name=*** Confidential *** dst_user_name=*** Confidential *** dst_machine_name=*** Confidential *** snid=7f006812 rule=74 rule_uid={3CEEDB7D-72AE-469C-862B-A329CE4F2E2C} src=userpc1 s_port=17500 dst=255.255.255.255 service=17500 proto=udp </CODE></PRE> Fri, 18 May 2012 17:17:24 GMT https://community.splunk.com/t5/All-Apps-and-Add-ons/OPSEC-LEA-Confidential/m-p/55536#M70321 PunchMonkey 2012-05-18T17:17:24Z https://community.splunk.com/t5/All-Apps-and-Add-ons/OPSEC-LEA-Confidential/m-p/55537#M70322 <P>After speaking with our Check Point support team, it seems this is an issue introduced in R75.20 as a "feature". To get the expected behaviour, you need to apply a hot fix to the management server.</P> <P>I've applied the fix in our environment and it's working well.</P> Tue, 22 May 2012 21:42:34 GMT https://community.splunk.com/t5/All-Apps-and-Add-ons/OPSEC-LEA-Confidential/m-p/55537#M70322 PunchMonkey 2012-05-22T21:42:34Z https://community.splunk.com/t5/All-Apps-and-Add-ons/OPSEC-LEA-Confidential/m-p/55538#M70323 <P>just curious ... which hot fix id or version did you happen to apply to the mgmt server?</P> Tue, 22 May 2012 21:46:07 GMT https://community.splunk.com/t5/All-Apps-and-Add-ons/OPSEC-LEA-Confidential/m-p/55538#M70323 Chubbybunny 2012-05-22T21:46:07Z https://community.splunk.com/t5/All-Apps-and-Add-ons/OPSEC-LEA-Confidential/m-p/55539#M70324 <P>Looks like now in R77 there is no need for the hot fix but if you see "Confidential" in the logs it is because the OPSEC application object in SmartDashboard is not set to the "Show all log fields" option in the "LEA Permissions" tab. See <A href="https://supportcenter.checkpoint.com/supportcenter/portal?eventSubmit_doGoviewsolutiondetails=&amp;solutionid=sk101570&amp;js_peid=P-14d3e6d9e20-10001&amp;partition=Advanced&amp;product=Security">sk101570</A></P> Tue, 26 May 2015 16:38:29 GMT https://community.splunk.com/t5/All-Apps-and-Add-ons/OPSEC-LEA-Confidential/m-p/55539#M70324 worshamn 2015-05-26T16:38:29Z https://community.splunk.com/t5/All-Apps-and-Add-ons/OPSEC-LEA-Confidential/m-p/55540#M70325 <P>To fix such issues please follow the steps below.</P> <OL> <LI><P>Open Smart Dashboard. Go to OPEC Splunk object. Then click on LEA Permissions.<BR /> Here you need to Change "Permission to read logs" to Show all log fields. By default this is set to "Hide all confidential log fields".</P></LI> <LI><P>Install Database and then Push policy</P></LI> <LI><P>reboot Check Point management server.</P></LI> </OL> <P>I tried cpstop/cpstart on management server and also re-setting LEA connection from OPSEC LEA's state settings (disable/enable) but I could still see many fileds as confidential in Check Point logs. After reboot of Check Point Management server this issue was resolved.</P> <P>Thanks <BR /> Ashok<BR /> <span class="lia-inline-image-display-wrapper" image-alt="alt text"><img src="https://community.splunk.com/t5/image/serverpage/image-id/25i1C9DF67D2A304150/image-size/large?v=v2&amp;px=999" role="button" title="alt text" alt="alt text" /></span></P> Thu, 03 Sep 2015 05:55:38 GMT https://community.splunk.com/t5/All-Apps-and-Add-ons/OPSEC-LEA-Confidential/m-p/55540#M70325 ashokqos 2015-09-03T05:55:38Z https://community.splunk.com/t5/All-Apps-and-Add-ons/OPSEC-LEA-Confidential/m-p/55541#M70326 <P>If the issue still persists please refer Checkpoint's sk103758 and sk101570</P> Fri, 04 Sep 2015 09:54:05 GMT https://community.splunk.com/t5/All-Apps-and-Add-ons/OPSEC-LEA-Confidential/m-p/55541#M70326 ashokqos 2015-09-04T09:54:05Z https://community.splunk.com/t5/All-Apps-and-Add-ons/OPSEC-LEA-Confidential/m-p/55542#M70327 <P>Upvoted. Rebooting the Check Point managent server helped.</P> Thu, 24 May 2018 10:57:04 GMT https://community.splunk.com/t5/All-Apps-and-Add-ons/OPSEC-LEA-Confidential/m-p/55542#M70327 Yunagi 2018-05-24T10:57:04Z