Which server to do data collection for Check Point OPSEC LEA app?

[stwong]

Hi, we're going to deploy Check Point OPSEC LEA app in our clustered Splunk environment. It requires opening tcp port 18184 and 18210 in firewall from Splunk to Checkpoint log/management server, which not sure which Splunk server to do data collection.

We're using indexer cluster. Shall we do data collection on one of the indexers ?

Besides, although we hope to have resilience in case of the data collection server fails, can only use one data collection server to avoid duplicated data. Is that correct?

Thanks a lot.
Regards
/ST Wong

[stwong]

Hi all,

Thanks a lot for your advice.

Regards

[aakwah]

It is my pleasure ..

[aakwah · Accepted solution]

Hello,
OPSEC LEA app consist of 2 parts, data collection part and knowledge objects part.
Data collection part is a scripted input, that contains wrapper python scripts that invokes the loggrabber binary that pulls logs from Checkpoint management server, then you can forward logs to any destination which is indexers in case of Splunk cluster.

So the best practices is to install the app on heavy forwarders (as python is required) for data collection.
And it should be installed on search heads to have knowledge objects (lookups, aliases, field extraction)

Have a look to this doc for more details:
http://docs.splunk.com/Documentation/AddOns/released/OPSEC-LEA/Install

Regards

[hunters_splunk]

Hi Wong,

Please install the Splunk Add-on for OPSEC LEA to collect data, which then feeds into the app. Follow the installation instructions here:

http://docs.splunk.com/Documentation/AddOns/released/OPSEC-LEA/Install

Hope this helps. Thanks!
Hunter