All Apps and Add-ons

Check Point ingest not CIM Compatiable

jerrythoms
Explorer

I'm ingesting logs from the log exporter and bring them into a test environment which is a fresh install with the checkpoint app installed.  The data is not CIM compatiable.  For example the action values are different.

The log exporter target was set to splunk and semi_unified

Labels (3)

Dave_Splunk
Splunk Employee
Splunk Employee
The Checkpoint App produced, published and supported by the vendor (https://splunkbase.splunk.com/app/4293/) breaks CIM compatibility for the action field.
 
Recommend opening issue with Checkpoint and have them reference the lookup performed on the action field done by the legacy app Check Point Splunk CIM TA (https://splunkbase.splunk.com/app/4629/) which correctly handles the action field to make it CIM compliant. Net result is that some checkpoint events processed by the vendor will not be found when searching for the 4 allowed values of
"allowed, blocked, dropped,unknown”.
0 Karma

richgalloway
SplunkTrust
SplunkTrust
Which CheckPoint app/add-on are you using?
---
If this reply helps you, an upvote would be appreciated.
0 Karma

jerrythoms
Explorer

check point app for splunk

https://splunkbase.splunk.com/app/4293/

0 Karma

richgalloway
SplunkTrust
SplunkTrust
You should let the developer know about the limitations of the app. Contact them via the link on the splunkbase page.
---
If this reply helps you, an upvote would be appreciated.
0 Karma

jerrythoms
Explorer

Thanks for the info, but the developer is not responding to emails

Tags (1)
0 Karma
Register for .conf21 Now! Go Vegas or Go Virtual!

How will you .conf21? You decide! Go in-person in Las Vegas, 10/18-10/21, or go online with .conf21 Virtual, 10/19-10/20.