Getting Data In

OPSEC LEA log collection

Engager

Hi,

Query over the OPSEC LEA log collection. Does the OPSEC add-on leave a copy of the logs on the CheckPoint provider-1 mgmt solution? All I can see is a reference to exporting logs, so have a slight concern it actually removes the logs altogether every time it connects/polls. I can't see reference in the configuration instructions to any options around this.

Thanks,

Charles

Tags (1)
1 Solution

Splunk Employee
Splunk Employee

I can speak for version 2.0.0+. It does not remove the logs, just pulls a copy.

View solution in original post

Splunk Employee
Splunk Employee

I can speak for version 2.0.0+. It does not remove the logs, just pulls a copy.

View solution in original post

Splunk Employee
Splunk Employee

We are using the standard OPSEC LEA collection method for Checkpoint logs, essentially pulling a copy; other subscribers (such as Tracker) would not be affected.

0 Karma