Does the Splunk Add-on for Check Point OPSEC LEA support the CPLogToSyslog format?

[georgen_splunk]

per CP Solution ID, sk11539: How to export Check Point logs to a Syslog server using CPLogToSyslog. I've configured our management server to send FW logs to syslogd, but the current Add-on for Check Point OPSEC LEA v4.3.1 does not appear to support the new log format. This also prevents us from normalizing the syslog data to support the Common Information Model for Enterprise Security.

Does anyone happen to have an ETA to fully support this new log format?

Here is an example of the two formats.

sourcetype=opsec

time=1533315360|loc=1280|fileid=1533279600|action=accept|orig=192.168.1.201|i/f_dir=inbound|i/f_name=eth0|has_accounting=0|logId=0|log_type=connection|log_sequence_num=1|is_first_for_luuid=131072|log_version=5|origin_sic_name=cn=cp_mgmt,o=gw-e0c5cb..8ah3wt|uuid=<5b648920,00000000,c901a8c0,c0000002>|product=VPN-1 & FireWall-1|__policy_id_tag=product=VPN-1 & FireWall-1[db_tag={1866F03E-955A-2C4C-91BD-22FA52339AB9};mgmt=gw-e0c5cb;date=1532556482;policy_name=Standard]|inzone=Internal|outzone=Local|service_id=FW1_lea|src=192.168.1.250|s_port=46108|dst=192.168.1.201|service=18184|proto=tcp|match_id=2|match_table.match_id=2|layer_uuid=8a5e96fb-c793-457f-b78f-c667074223a5|match_table.layer_uuid=8a5e96fb-c793-457f-b78f-c667074223a5|layer_name=Network|match_table.layer_name=Network|rule_uid=88caafe8-df4c-4239-9087-75a612de2c9b|match_table.rule_uid=88caafe8-df4c-4239-9087-75a612de2c9b|rule_name=Splunk LEA|match_table.rule_name=Splunk LEA|rule_action=2|match_table.rule_action=2|parent_rule=0|match_table.parent_rule=0

sourcetype=syslog.opsec

Aug  3 10:00:21 192.168.1.201  Fri Aug  3 10:00:21  Log host CPLogToSyslog:  ContentVersion: 5; Uuid: {0x5b648a23,0x0,0xc901a8c0,0xc0000001}; SequenceNum: 1; Flags: 49152; Action: accept; Origin: 192.168.1.201; IfDir: <; InterfaceName: eth0; Alert: ; LogId: 0; OriginSicName: cn=cp_mgmt,o=gw-e0c5cb..8ah3wt; OriginSicName: cn=cp_mgmt,o=gw-e0c5cb..8ah3wt; log_type: connection; is_first_for_luuid: 131072; inzone: Local; outzone: Internal; service_id: cp_udp_85FA60B6_96D2_4AD7_ABCE_61C392C2F3F1; src: 192.168.1.201; dst: 192.168.1.250; proto: 17; match_id: 3; match_table.match_id: 3; layer_uuid: 8a5e96fb-c793-457f-b78f-c667074223a5; match_table.layer_uuid: 8a5e96fb-c793-457f-b78f-c667074223a5; layer_name: Network; match_table.layer_name: Network; rule_uid: 725d9a70-e3a2-4e3f-b313-737c6d53c754; match_table.rule_uid: 725d9a70-e3a2-4e3f-b313-737c6d53c754; rule_name: SIEM logging; match_table.rule_name: SIEM logging; rule_action: 2; match_table.rule_action: 2; parent_rule: 0; match_table.parent_rule: 0; aba_customer: SMC User; date: 3Aug2018; hour: 10:00:19; type: connection; Interface: > eth0; ProductName: VPN-1 & FireWall-1; svc: 9514; sport_svc: 53164;

Using simple field extractions, we've been able to identify all the notable fields, but I'm sure there's a bit more that's required here.

Sample current props + transforms
props.conf

[syslog.opsec]
REPORT-extractfields = extract_opsec_fields

transforms.conf

[extract_opsec_fields]
DELIMS = ";", ":"

[tkopchak]

There is an app that supports using Check Point log exporter (sk122323, sending logs via syslog): https://splunkbase.splunk.com/app/4180

This should allow you to collect logs via syslog and have them normalized to the CIM.

[georgen_splunk]

an Enhancement request has been filed with our Products team to support this new format in the future, please open a Support case and reference ADDON-18988 for current status.