How should configure my splunk CheckPoint application to retrieve all customer logs with MDS???

[jbsplunk]

My environment consists of CheckPoint Provider1 MDS/CMA/CLM: I'm running a MDS (MultiDomainServer) with multiple customer environments (CMA). However, all log traffic is sent back to our central log repository (CLM). Question is: How should configure my splunk CheckPoint application to retrieve all customer logs???

[Chubbybunny · Accepted solution]

To retrieve CheckPoint logs from our CLM we did this:

1. create the OPSEC application on the MDS
2. push the OPSEC application to the CMA and CLM
3. run the opsec_pull_cert using SSLCA against the MDS
4. retrieve the SIC of the OPSEC application and CLM
5. configure lea.conf using the OPSEC application and CLM SIC name
6. configure lea.conf to pull logs from the CLM
7. configure lea.conf to use auth_type SSLCA

[Chubbybunny]

In step 2. "push the OPSEC application to the CMA and CLM" should be revised to: "Install the database to the CMA"

*thanks for the correction Mahesh!!!

[Chubbybunny]

you Betcha!!!

[jbsplunk]

Thanks, these were exactly the steps I needed!