All Apps and Add-ons

Which server to do data collection for Check Point OPSEC LEA app?

stwong
Communicator

Hi, we're going to deploy Check Point OPSEC LEA app in our clustered Splunk environment. It requires opening tcp port 18184 and 18210 in firewall from Splunk to Checkpoint log/management server, which not sure which Splunk server to do data collection.

We're using indexer cluster. Shall we do data collection on one of the indexers ?

Besides, although we hope to have resilience in case of the data collection server fails, can only use one data collection server to avoid duplicated data. Is that correct?

Thanks a lot.
Regards
/ST Wong

0 Karma
1 Solution

aakwah
Builder

Hello,
OPSEC LEA app consist of 2 parts, data collection part and knowledge objects part.
Data collection part is a scripted input, that contains wrapper python scripts that invokes the loggrabber binary that pulls logs from Checkpoint management server, then you can forward logs to any destination which is indexers in case of Splunk cluster.

So the best practices is to install the app on heavy forwarders (as python is required) for data collection.
And it should be installed on search heads to have knowledge objects (lookups, aliases, field extraction)

Have a look to this doc for more details:
http://docs.splunk.com/Documentation/AddOns/released/OPSEC-LEA/Install

Regards

View solution in original post

0 Karma

stwong
Communicator

Hi all,

Thanks a lot for your advice.

Regards

0 Karma

aakwah
Builder

It is my pleasure ..

0 Karma

aakwah
Builder

Hello,
OPSEC LEA app consist of 2 parts, data collection part and knowledge objects part.
Data collection part is a scripted input, that contains wrapper python scripts that invokes the loggrabber binary that pulls logs from Checkpoint management server, then you can forward logs to any destination which is indexers in case of Splunk cluster.

So the best practices is to install the app on heavy forwarders (as python is required) for data collection.
And it should be installed on search heads to have knowledge objects (lookups, aliases, field extraction)

Have a look to this doc for more details:
http://docs.splunk.com/Documentation/AddOns/released/OPSEC-LEA/Install

Regards

0 Karma

hunters_splunk
Splunk Employee
Splunk Employee

Hi Wong,

Please install the Splunk Add-on for OPSEC LEA to collect data, which then feeds into the app. Follow the installation instructions here:

http://docs.splunk.com/Documentation/AddOns/released/OPSEC-LEA/Install

Hope this helps. Thanks!
Hunter

0 Karma
Get Updates on the Splunk Community!

Optimize Cloud Monitoring

  TECH TALKS Optimize Cloud Monitoring Tuesday, August 13, 2024  |  11:00AM–12:00PM PST   Register to ...

What's New in Splunk Cloud Platform 9.2.2403?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.2.2403! Analysts can ...

Stay Connected: Your Guide to July and August Tech Talks, Office Hours, and Webinars!

Dive into our sizzling summer lineup for July and August Community Office Hours and Tech Talks. Scroll down to ...