All Apps and Add-ons

Does the Splunk Add-on for Check Point OPSEC LEA support the CPLogToSyslog format?

georgen_splunk
Splunk Employee
Splunk Employee

per CP Solution ID, sk11539: How to export Check Point logs to a Syslog server using CPLogToSyslog. I've configured our management server to send FW logs to syslogd, but the current Add-on for Check Point OPSEC LEA v4.3.1 does not appear to support the new log format. This also prevents us from normalizing the syslog data to support the Common Information Model for Enterprise Security.

Does anyone happen to have an ETA to fully support this new log format?

Here is an example of the two formats.

sourcetype=opsec

time=1533315360|loc=1280|fileid=1533279600|action=accept|orig=192.168.1.201|i/f_dir=inbound|i/f_name=eth0|has_accounting=0|logId=0|log_type=connection|log_sequence_num=1|is_first_for_luuid=131072|log_version=5|origin_sic_name=cn=cp_mgmt,o=gw-e0c5cb..8ah3wt|uuid=<5b648920,00000000,c901a8c0,c0000002>|product=VPN-1 & FireWall-1|__policy_id_tag=product=VPN-1 & FireWall-1[db_tag={1866F03E-955A-2C4C-91BD-22FA52339AB9};mgmt=gw-e0c5cb;date=1532556482;policy_name=Standard]|inzone=Internal|outzone=Local|service_id=FW1_lea|src=192.168.1.250|s_port=46108|dst=192.168.1.201|service=18184|proto=tcp|match_id=2|match_table.match_id=2|layer_uuid=8a5e96fb-c793-457f-b78f-c667074223a5|match_table.layer_uuid=8a5e96fb-c793-457f-b78f-c667074223a5|layer_name=Network|match_table.layer_name=Network|rule_uid=88caafe8-df4c-4239-9087-75a612de2c9b|match_table.rule_uid=88caafe8-df4c-4239-9087-75a612de2c9b|rule_name=Splunk LEA|match_table.rule_name=Splunk LEA|rule_action=2|match_table.rule_action=2|parent_rule=0|match_table.parent_rule=0

sourcetype=syslog.opsec

Aug  3 10:00:21 192.168.1.201  Fri Aug  3 10:00:21  Log host CPLogToSyslog:  ContentVersion: 5; Uuid: {0x5b648a23,0x0,0xc901a8c0,0xc0000001}; SequenceNum: 1; Flags: 49152; Action: accept; Origin: 192.168.1.201; IfDir: <; InterfaceName: eth0; Alert: ; LogId: 0; OriginSicName: cn=cp_mgmt,o=gw-e0c5cb..8ah3wt; OriginSicName: cn=cp_mgmt,o=gw-e0c5cb..8ah3wt; log_type: connection; is_first_for_luuid: 131072; inzone: Local; outzone: Internal; service_id: cp_udp_85FA60B6_96D2_4AD7_ABCE_61C392C2F3F1; src: 192.168.1.201; dst: 192.168.1.250; proto: 17; match_id: 3; match_table.match_id: 3; layer_uuid: 8a5e96fb-c793-457f-b78f-c667074223a5; match_table.layer_uuid: 8a5e96fb-c793-457f-b78f-c667074223a5; layer_name: Network; match_table.layer_name: Network; rule_uid: 725d9a70-e3a2-4e3f-b313-737c6d53c754; match_table.rule_uid: 725d9a70-e3a2-4e3f-b313-737c6d53c754; rule_name: SIEM logging; match_table.rule_name: SIEM logging; rule_action: 2; match_table.rule_action: 2; parent_rule: 0; match_table.parent_rule: 0; aba_customer: SMC User; date: 3Aug2018; hour: 10:00:19; type: connection; Interface: > eth0; ProductName: VPN-1 & FireWall-1; svc: 9514; sport_svc: 53164;

Using simple field extractions, we've been able to identify all the notable fields, but I'm sure there's a bit more that's required here.

Sample current props + transforms
props.conf

[syslog.opsec]
REPORT-extractfields = extract_opsec_fields

transforms.conf

[extract_opsec_fields]
DELIMS = ";", ":"
0 Karma

tkopchak
SplunkTrust
SplunkTrust

There is an app that supports using Check Point log exporter (sk122323, sending logs via syslog): https://splunkbase.splunk.com/app/4180

This should allow you to collect logs via syslog and have them normalized to the CIM.

0 Karma

georgen_splunk
Splunk Employee
Splunk Employee

an Enhancement request has been filed with our Products team to support this new format in the future, please open a Support case and reference ADDON-18988 for current status.

0 Karma
Get Updates on the Splunk Community!

Introducing the 2024 SplunkTrust!

Hello, Splunk Community! We are beyond thrilled to announce our newest group of SplunkTrust members!  The ...

Introducing the 2024 Splunk MVPs!

We are excited to announce the 2024 cohort of the Splunk MVP program. Splunk MVPs are passionate members of ...

Splunk Custom Visualizations App End of Life

The Splunk Custom Visualizations apps End of Life for SimpleXML will reach end of support on Dec 21, 2024, ...