Splunk add-on for Check Point OPSEC LEA: Change HOST field to be firewall IP not the management station ip

[gstefancyk]

We have been ingesting our Check Point logs via the Check Point OPSEC LEA add-on and finally realized that the HOST being reported is always our management station IP where we are pulling logs from... Is there a way to change this in the OPSEC Lea add on or would we be better off doing this in transforms.conf and props.conf on the heavy forwarder?

[mathieuamos]

What field was your fw coming into Splunk as? And did you have to change logging on mgmt server to get the fw info to be sent to Splunk?

[FrankVl · Accepted solution]

You can use props and transforms to overwrite it (e.g. based on the orig= field).
See this recent discussion: https://answers.splunk.com/answers/615561/how-to-overwrite-the-host-field-value-with-dvc-fie.html

[gstefancyk]

Thanks FrankVI, exactly what I expected but nice to get some re-assurance.