topic Re: Newbie on Phantom on Check Point in Splunk SOAR

Newbie on Phantom on Check Point

poctalk — Wed, 12 Dec 2018 13:24:45 GMT

I'm working on building a POC to test gateways with Phantom and I can't seem to get this working. I've created an asset and a Check Point Management, but I keep getting this error message. I must be skipping a step and there isn't much documentation to work with.

App 'Check Point Firewall' started successfully (id: 1544619295625) on asset: 'chkpfw'(id: 7)
Loaded action execution configuration
Using base URL 'https://10.1.1.101:443/web_api/'
Connecting to https://10.1.1.101:443/web_api/...
Could not connect to Check Point. Connectivity test failed. No action executions found.

Re: Newbie on Phantom on Check Point

manrodriguez — Wed, 17 Jul 2019 13:00:52 GMT

Hello poctalk!!!

Any answer for this issue? how can you resolved this issue? in this moment i have the same problem with a checkpoint version R77.30, i tried differents ways to connect but nothing.

I appreciate your feedback.

Regards!

Re: Newbie on Phantom on Check Point

cblumer_splunk — Wed, 28 Aug 2019 18:31:20 GMT

It's recommended to check the logs on the Phantom host whenever there are issues with connectivity for an integration:
/var/log/phantom/spawn.log
/var/log/phantom/wsgi.log

A netcat test can also be executed from the Phantom host to confirm network connectivity:
sudo nc -vz 192.168.28.121 443

Re: Newbie on Phantom on Check Point

cblumer_splunk — Wed, 30 Sep 2020 01:59:56 GMT

It looks like the Management API feature was introduced in the R80 Check Point Release:
https://sc1.checkpoint.com/documents/latest/APIs/index.html#api_versions~v1.5%20

Here are the Checkpoint API Docs:
https://sc1.checkpoint.com/documents/latest/APIs/index.html#cli/introduction~v1.5%20

Checkpoint App for Phantom:
https://my.phantom.us/4.5/docs/app_reference/phantom_checkpoint