All Apps and Add-ons

Check Point ingest not CIM Compatiable

jerrythoms
Explorer

I'm ingesting logs from the log exporter and bring them into a test environment which is a fresh install with the checkpoint app installed.  The data is not CIM compatiable.  For example the action values are different.

The log exporter target was set to splunk and semi_unified

Labels (3)

Dave_Splunk
Splunk Employee
Splunk Employee
The Checkpoint App produced, published and supported by the vendor (https://splunkbase.splunk.com/app/4293/) breaks CIM compatibility for the action field.
 
Recommend opening issue with Checkpoint and have them reference the lookup performed on the action field done by the legacy app Check Point Splunk CIM TA (https://splunkbase.splunk.com/app/4629/) which correctly handles the action field to make it CIM compliant. Net result is that some checkpoint events processed by the vendor will not be found when searching for the 4 allowed values of
"allowed, blocked, dropped,unknown”.
0 Karma

richgalloway
SplunkTrust
SplunkTrust
Which CheckPoint app/add-on are you using?
---
If this reply helps you, Karma would be appreciated.
0 Karma

jerrythoms
Explorer

check point app for splunk

https://splunkbase.splunk.com/app/4293/

0 Karma

richgalloway
SplunkTrust
SplunkTrust
You should let the developer know about the limitations of the app. Contact them via the link on the splunkbase page.
---
If this reply helps you, Karma would be appreciated.
0 Karma

jerrythoms
Explorer

Thanks for the info, but the developer is not responding to emails

Tags (1)
0 Karma
Get Updates on the Splunk Community!

Splunk Training for All: Meet Aspiring Cybersecurity Analyst, Marc Alicea

Splunk Education believes in the value of training and certification in today’s rapidly-changing data-driven ...

The Splunk Success Framework: Your Guide to Successful Splunk Implementations

Splunk Lantern is a customer success center that provides advice from Splunk experts on valuable data ...

Investigate Security and Threat Detection with VirusTotal and Splunk Integration

As security threats and their complexities surge, security analysts deal with increased challenges and ...