OPSEC LEA log collection

[cmacey]

Hi,

Query over the OPSEC LEA log collection. Does the OPSEC add-on leave a copy of the logs on the CheckPoint provider-1 mgmt solution? All I can see is a reference to exporting logs, so have a slight concern it actually removes the logs altogether every time it connects/polls. I can't see reference in the configuration instructions to any options around this.

Thanks,

Charles

[araitz · Accepted solution]

I can speak for version 2.0.0+. It does not remove the logs, just pulls a copy.

[dart]

We are using the standard OPSEC LEA collection method for Checkpoint logs, essentially pulling a copy; other subscribers (such as Tracker) would not be affected.