All Apps and Add-ons

Checkpoint OPSEC LEA Add-On 4.3.1 "origin_sic_name=XXXX" not in the traffic log anymore

marc_houppertz
Engager

Hi,

After upgrade of the app to 4.3.1 I notice that I don't have in trafic log the info about origin_sic_name=
For the sourcetype=opsec (for the other sourcetype, I have the info in the log)
The field I used to ID wich firewall log it belonged to in the setup of a cluster.

where is this log tag gone ? how to reactivate it ?

Marc

mvagionakis
Path Finder

the same for me. Since last update, the origin_sic_name doesn't appear anymore.
Probable there was a change in eventgen.conf since last update (?).

0 Karma
Get Updates on the Splunk Community!

Detecting Remote Code Executions With the Splunk Threat Research Team

WATCH NOWRemote code execution (RCE) vulnerabilities pose a significant risk to organizations. If exploited, ...

Enter the Splunk Community Dashboard Challenge for Your Chance to Win!

The Splunk Community Dashboard Challenge is underway! This is your chance to showcase your skills in creating ...

.conf24 | Session Scheduler is Live!!

.conf24 is happening June 11 - 14 in Las Vegas, and we are thrilled to announce that the conference catalog ...