Firewall checkpoint for windows 8

[christinmb]

Is it possible to index Check Point firewall logs in Splunk for windows?

[ashokqos]

If you are looking for a simplified solution I suggest you try the follow Add-ON.

https://splunkbase.splunk.com/app/2996/

This add-on collect firewall logs in syslog format and extracts all the necessary fields. You can use any other Check Point App on top of this Add-on.

[pajohnston · Accepted solution]

I don't think you can using the Splunk-supplied OPSEC LEA for CheckPoint app as it only works under Linux or Solaris. You'd need a separate Linux or Solaris Splunk instance running the Checkpoint app and forward the logs to your Windows Splunk instance. I use this setup and it works ok.

If you can't run an instance on anything but Windows for some reason, then the solution outlined in this post might help. I've not tried this method, though, so I can't comment on how well it works.