topic Re: Splunk Add-on for Checkpoint 4.0.0 in Getting Data In

Splunk Add-on for Checkpoint 4.0.0

arkonner — Thu, 01 Sep 2016 08:36:55 GMT

I have a checkpoint cluster configuration with a single management workstation - Installing the Add-on to establish the connection I got a huge volume of data - Should be possible to "filter" the checkpoint events in order to reduce it.

Re: Splunk Add-on for Checkpoint 4.0.0

aosso — Thu, 01 Sep 2016 09:12:39 GMT

Hi,

Currently with this new version you can get this done with a props.conf/transforms.conf setup:

https://answers.splunk.com/comments/417715/view.html (this example only collects packets with status drop, reject and block)

Re: Splunk Add-on for Checkpoint 4.0.0

arrowecssupport — Thu, 01 Sep 2016 10:17:57 GMT

Are you actually running Check Point 4.0?

Re: Splunk Add-on for Checkpoint 4.0.0

arkonner — Thu, 01 Sep 2016 12:01:24 GMT

This is exactly what I am looking for -

In the example under session opsecparsing] the Regex command allows only drop, reject and block - The regex should accept a command to exclude all different by "accept" like REGEX =! (accept)

[opsecparsing]
REGEX = (drop|reject|block)

props.conf

[opsec]
TRANSFORMS-drops = opsecnull, opsecparsing

#transforms.conf
[opsecnull]
REGEX = .
DEST_KEY = queue
FORMAT = nullQueue

[opsecparsing]
REGEX = (drop|reject|block)
DEST_KEY = queue
FORMAT = indexQueue