All Apps and Add-ons

Check Point ingest not CIM Compatiable

jerrythoms
Explorer

I'm ingesting logs from the log exporter and bring them into a test environment which is a fresh install with the checkpoint app installed.  The data is not CIM compatiable.  For example the action values are different.

The log exporter target was set to splunk and semi_unified

Labels (3)

Dave_Splunk
Splunk Employee
Splunk Employee
The Checkpoint App produced, published and supported by the vendor (https://splunkbase.splunk.com/app/4293/) breaks CIM compatibility for the action field.
 
Recommend opening issue with Checkpoint and have them reference the lookup performed on the action field done by the legacy app Check Point Splunk CIM TA (https://splunkbase.splunk.com/app/4629/) which correctly handles the action field to make it CIM compliant. Net result is that some checkpoint events processed by the vendor will not be found when searching for the 4 allowed values of
"allowed, blocked, dropped,unknown”.
0 Karma

richgalloway
SplunkTrust
SplunkTrust
Which CheckPoint app/add-on are you using?
---
If this reply helps you, Karma would be appreciated.
0 Karma

jerrythoms
Explorer

check point app for splunk

https://splunkbase.splunk.com/app/4293/

0 Karma

richgalloway
SplunkTrust
SplunkTrust
You should let the developer know about the limitations of the app. Contact them via the link on the splunkbase page.
---
If this reply helps you, Karma would be appreciated.
0 Karma

jerrythoms
Explorer

Thanks for the info, but the developer is not responding to emails

Tags (1)
0 Karma
Get Updates on the Splunk Community!

New Splunk Observability innovations: Deeper visibility and smarter alerting to ...

You asked, we delivered. Splunk Observability Cloud has several new innovations giving you deeper visibility ...

Synthetic Monitoring: Not your Grandma’s Polyester! Tech Talk: DevOps Edition

Register today and join TekStream on Tuesday, February 28 at 11am PT/2pm ET for a demonstration of Splunk ...

Instrumenting Java Websocket Messaging

Instrumenting Java Websocket MessagingThis article is a code-based discussion of passing OpenTelemetry trace ...