All Apps and Add-ons

Check Point ingest not CIM Compatiable

jerrythoms
Explorer

I'm ingesting logs from the log exporter and bring them into a test environment which is a fresh install with the checkpoint app installed.  The data is not CIM compatiable.  For example the action values are different.

The log exporter target was set to splunk and semi_unified

Labels (3)

Dave_Splunk
Splunk Employee
Splunk Employee
The Checkpoint App produced, published and supported by the vendor (https://splunkbase.splunk.com/app/4293/) breaks CIM compatibility for the action field.
 
Recommend opening issue with Checkpoint and have them reference the lookup performed on the action field done by the legacy app Check Point Splunk CIM TA (https://splunkbase.splunk.com/app/4629/) which correctly handles the action field to make it CIM compliant. Net result is that some checkpoint events processed by the vendor will not be found when searching for the 4 allowed values of
"allowed, blocked, dropped,unknown”.
0 Karma

richgalloway
SplunkTrust
SplunkTrust
Which CheckPoint app/add-on are you using?
---
If this reply helps you, Karma would be appreciated.
0 Karma

jerrythoms
Explorer

check point app for splunk

https://splunkbase.splunk.com/app/4293/

0 Karma

richgalloway
SplunkTrust
SplunkTrust
You should let the developer know about the limitations of the app. Contact them via the link on the splunkbase page.
---
If this reply helps you, Karma would be appreciated.
0 Karma

jerrythoms
Explorer

Thanks for the info, but the developer is not responding to emails

Tags (1)
0 Karma
Get Updates on the Splunk Community!

.conf24 | Day 0

Hello Splunk Community! My name is Chris, and I'm based in Canberra, Australia's capital, and I travelled for ...

Enhance Security Visibility with Splunk Enterprise Security 7.1 through Threat ...

 (view in My Videos)Struggling with alert fatigue, lack of context, and prioritization around security ...

Troubleshooting the OpenTelemetry Collector

  In this tech talk, you’ll learn how to troubleshoot the OpenTelemetry collector - from checking the ...