All Apps and Add-ons

Does the Splunk Add-on for Check Point OPSEC LEA support the CPLogToSyslog format?

georgen_splunk
Splunk Employee
Splunk Employee

per CP Solution ID, sk11539: How to export Check Point logs to a Syslog server using CPLogToSyslog. I've configured our management server to send FW logs to syslogd, but the current Add-on for Check Point OPSEC LEA v4.3.1 does not appear to support the new log format. This also prevents us from normalizing the syslog data to support the Common Information Model for Enterprise Security.

Does anyone happen to have an ETA to fully support this new log format?

Here is an example of the two formats.

sourcetype=opsec

time=1533315360|loc=1280|fileid=1533279600|action=accept|orig=192.168.1.201|i/f_dir=inbound|i/f_name=eth0|has_accounting=0|logId=0|log_type=connection|log_sequence_num=1|is_first_for_luuid=131072|log_version=5|origin_sic_name=cn=cp_mgmt,o=gw-e0c5cb..8ah3wt|uuid=<5b648920,00000000,c901a8c0,c0000002>|product=VPN-1 & FireWall-1|__policy_id_tag=product=VPN-1 & FireWall-1[db_tag={1866F03E-955A-2C4C-91BD-22FA52339AB9};mgmt=gw-e0c5cb;date=1532556482;policy_name=Standard]|inzone=Internal|outzone=Local|service_id=FW1_lea|src=192.168.1.250|s_port=46108|dst=192.168.1.201|service=18184|proto=tcp|match_id=2|match_table.match_id=2|layer_uuid=8a5e96fb-c793-457f-b78f-c667074223a5|match_table.layer_uuid=8a5e96fb-c793-457f-b78f-c667074223a5|layer_name=Network|match_table.layer_name=Network|rule_uid=88caafe8-df4c-4239-9087-75a612de2c9b|match_table.rule_uid=88caafe8-df4c-4239-9087-75a612de2c9b|rule_name=Splunk LEA|match_table.rule_name=Splunk LEA|rule_action=2|match_table.rule_action=2|parent_rule=0|match_table.parent_rule=0

sourcetype=syslog.opsec

Aug  3 10:00:21 192.168.1.201  Fri Aug  3 10:00:21  Log host CPLogToSyslog:  ContentVersion: 5; Uuid: {0x5b648a23,0x0,0xc901a8c0,0xc0000001}; SequenceNum: 1; Flags: 49152; Action: accept; Origin: 192.168.1.201; IfDir: <; InterfaceName: eth0; Alert: ; LogId: 0; OriginSicName: cn=cp_mgmt,o=gw-e0c5cb..8ah3wt; OriginSicName: cn=cp_mgmt,o=gw-e0c5cb..8ah3wt; log_type: connection; is_first_for_luuid: 131072; inzone: Local; outzone: Internal; service_id: cp_udp_85FA60B6_96D2_4AD7_ABCE_61C392C2F3F1; src: 192.168.1.201; dst: 192.168.1.250; proto: 17; match_id: 3; match_table.match_id: 3; layer_uuid: 8a5e96fb-c793-457f-b78f-c667074223a5; match_table.layer_uuid: 8a5e96fb-c793-457f-b78f-c667074223a5; layer_name: Network; match_table.layer_name: Network; rule_uid: 725d9a70-e3a2-4e3f-b313-737c6d53c754; match_table.rule_uid: 725d9a70-e3a2-4e3f-b313-737c6d53c754; rule_name: SIEM logging; match_table.rule_name: SIEM logging; rule_action: 2; match_table.rule_action: 2; parent_rule: 0; match_table.parent_rule: 0; aba_customer: SMC User; date: 3Aug2018; hour: 10:00:19; type: connection; Interface: > eth0; ProductName: VPN-1 & FireWall-1; svc: 9514; sport_svc: 53164;

Using simple field extractions, we've been able to identify all the notable fields, but I'm sure there's a bit more that's required here.

Sample current props + transforms
props.conf

[syslog.opsec]
REPORT-extractfields = extract_opsec_fields

transforms.conf

[extract_opsec_fields]
DELIMS = ";", ":"
0 Karma

tkopchak
Path Finder

There is an app that supports using Check Point log exporter (sk122323, sending logs via syslog): https://splunkbase.splunk.com/app/4180

This should allow you to collect logs via syslog and have them normalized to the CIM.

0 Karma

georgen_splunk
Splunk Employee
Splunk Employee

an Enhancement request has been filed with our Products team to support this new format in the future, please open a Support case and reference ADDON-18988 for current status.

0 Karma
Get Updates on the Splunk Community!

Observability Highlights | January 2023 Newsletter

 January 2023New Product Releases Splunk Network Explorer for Infrastructure MonitoringSplunk unveils Network ...

Security Highlights | January 2023 Newsletter

January 2023 Splunk Security Essentials (SSE) 3.7.0 ReleaseThe free Splunk Security Essentials (SSE) 3.7.0 app ...

Platform Highlights | January 2023 Newsletter

 January 2023Peace on Earth and Peace of Mind With Business ResilienceAll organizations can start the new year ...