Check Point ingest not CIM Compatiable

[jerrythoms]

I'm ingesting logs from the log exporter and bring them into a test environment which is a fresh install with the checkpoint app installed.  The data is not CIM compatiable.  For example the action values are different.

The log exporter target was set to splunk and semi_unified

[Dave_Splunk]

The Checkpoint App produced, published and supported by the vendor (https://splunkbase.splunk.com/app/4293/) breaks CIM compatibility for the action field.

Recommend opening issue with Checkpoint and have them reference the lookup performed on the action field done by the legacy app Check Point Splunk CIM TA (https://splunkbase.splunk.com/app/4629/) which correctly handles the action field to make it CIM compliant. Net result is that some checkpoint events processed by the vendor will not be found when searching for the 4 allowed values of

"allowed, blocked, dropped,unknown”.

[richgalloway]

Which CheckPoint app/add-on are you using?

[jerrythoms]

check point app for splunk

https://splunkbase.splunk.com/app/4293/

[richgalloway]

You should let the developer know about the limitations of the app. Contact them via the link on the splunkbase page.

[jerrythoms]

Thanks for the info, but the developer is not responding to emails