topic Re: Splunk Add-on for Check Point OPSEC LEA in Splunk Search

Splunk Add-on for Check Point OPSEC LEA

Navanitha — Wed, 13 Oct 2021 16:05:41 GMT

I am collecting Firewall logs using OPSEC Lea app. This add on is setup on Heavyforwarder. App is setup correctly and logs are coming onto HF but I am unable to view them on Search head. HF has connectivity to indexers is sending internal logs and other application related to indexers. How do I check what is wrong with Checkpoint logs ?

Re: Splunk Add-on for Check Point OPSEC LEA

PickleRick — Wed, 13 Oct 2021 16:25:03 GMT

Did you check that the app on HF actually pulls the logs? Did you check the app's logs? Do you have proper index configured in your input?

Re: Splunk Add-on for Check Point OPSEC LEA

Navanitha — Wed, 13 Oct 2021 16:53:32 GMT

Yes App is pulling logs and I did test is by enabling index and forward setting on HF. No errors or Warning in app logs and index is created correctly. I do see logs data transfer for this checkpoint on metrics.log also under _internal index. Unfortunately im unable to pastmetrics logs