Archive
Highlighted

Which server to do data collection for Check Point OPSEC LEA app?

Communicator

Hi, we're going to deploy Check Point OPSEC LEA app in our clustered Splunk environment. It requires opening tcp port 18184 and 18210 in firewall from Splunk to Checkpoint log/management server, which not sure which Splunk server to do data collection.

We're using indexer cluster. Shall we do data collection on one of the indexers ?

Besides, although we hope to have resilience in case of the data collection server fails, can only use one data collection server to avoid duplicated data. Is that correct?

Thanks a lot.
Regards
/ST Wong

0 Karma
Highlighted

Re: Which server to do data collection for Check Point OPSEC LEA app?

Splunk Employee
Splunk Employee

Hi Wong,

Please install the Splunk Add-on for OPSEC LEA to collect data, which then feeds into the app. Follow the installation instructions here:

http://docs.splunk.com/Documentation/AddOns/released/OPSEC-LEA/Install

Hope this helps. Thanks!
Hunter

0 Karma
Highlighted

Re: Which server to do data collection for Check Point OPSEC LEA app?

Builder

Hello,
OPSEC LEA app consist of 2 parts, data collection part and knowledge objects part.
Data collection part is a scripted input, that contains wrapper python scripts that invokes the loggrabber binary that pulls logs from Checkpoint management server, then you can forward logs to any destination which is indexers in case of Splunk cluster.

So the best practices is to install the app on heavy forwarders (as python is required) for data collection.
And it should be installed on search heads to have knowledge objects (lookups, aliases, field extraction)

Have a look to this doc for more details:
http://docs.splunk.com/Documentation/AddOns/released/OPSEC-LEA/Install

Regards

View solution in original post

0 Karma
Highlighted

Re: Which server to do data collection for Check Point OPSEC LEA app?

Communicator

Hi all,

Thanks a lot for your advice.

Regards

0 Karma
Highlighted

Re: Which server to do data collection for Check Point OPSEC LEA app?

Builder

It is my pleasure ..

0 Karma