I have checkpoint logs going back which we have exported of our checkpoint FW, and i would like to import them into splunk. I have installed the opsec-lea module, but i would rather not setup the connectivity to our fw and just analyse the logs, is this possible?
Many thanks in advance.
I can speak to the importing portion of the question.
There's several different ways you can import the logs:
I'd go with option #2, as this will probably be the quickest way to achieve what you want. When you're done, you can either nuke the input settings or leave them there in case you want to do this again.
On your Checkpoint side I recommend that you use the 'fw log' command to dump each logfile to text. (Checkpoint natively stores its logs in a binary format.) Use a little shell globbing and a for loop and you should be able to easily get these into text format. Scp to your Splunk server and go with Brian's option #2.
Thanks Brian and Trey. I tried importing from a file and it fails with an object error (not much help i know), however i presume this is because the logs i have are all in binary format as you say Trey. Is the easiest way to convert them to load them back onto the checkpoint, convert and back again into splunk (either by solitary file or into a temp directory). The problem i suppose is all my logs are in binary format.