OPSEC LEA - *** Confidential ***

[PunchMonkey]

I have just gotten a Splunk instance running and am working on including logs from our Check Point Smart-1 management server. I've followed the docs for the Splunk OPSEC LEA add on without any significant problems and am receiving data from the management server.

However, many of the fields are coming across as "*** Confidential ***". Is there any way to get the real values?

Fields affected include (but not limited to): user, src_user_name, src_machine_name, dst_user_name, dst_machine_name, appi_name, app_desc, app_risk, app_rule_id

Here's a sample record:

loc=33292 filename=fw.log fileid=1337354883 time=18May2012 12:31:28 action=reject orig=UTM1 i/f_dir=inbound i/f_name=Internal has_accounting=0 product=VPN-1 & FireWall-1 __policy_id_tag=product=VPN-1 & FireWall-1[db_tag={9E77F78D-A0EE-12E1-97FE-000000001819};mgmt=fwmgmt;date=1337355553;policy_name=Standard] user=*** Confidential *** src_user_name=*** Confidential *** src_machine_name=*** Confidential *** dst_user_name=*** Confidential *** dst_machine_name=*** Confidential *** snid=7f006812 rule=74 rule_uid={3CEEDB7D-72AE-469C-862B-A329CE4F2E2C} src=userpc1 s_port=17500 dst=255.255.255.255 service=17500 proto=udp

[ashokqos]

To fix such issues please follow the steps below.

1. Open Smart Dashboard. Go to OPEC Splunk object. Then click on LEA Permissions.
   Here you need to Change "Permission to read logs" to Show all log fields. By default this is set to "Hide all confidential log fields".

2. Install Database and then Push policy

3. reboot Check Point management server.

I tried cpstop/cpstart on management server and also re-setting LEA connection from OPSEC LEA's state settings (disable/enable) but I could still see many fileds as confidential in Check Point logs. After reboot of Check Point Management server this issue was resolved.

Thanks
Ashok

[Yunagi]

Upvoted. Rebooting the Check Point managent server helped.

[ashokqos]

If the issue still persists please refer Checkpoint's sk103758 and sk101570

[worshamn]

Looks like now in R77 there is no need for the hot fix but if you see "Confidential" in the logs it is because the OPSEC application object in SmartDashboard is not set to the "Show all log fields" option in the "LEA Permissions" tab. See sk101570

[PunchMonkey · Accepted solution]

After speaking with our Check Point support team, it seems this is an issue introduced in R75.20 as a "feature". To get the expected behaviour, you need to apply a hot fix to the management server.

I've applied the fix in our environment and it's working well.

[Chubbybunny]

just curious ... which hot fix id or version did you happen to apply to the mgmt server?