Security

Checkpoint firewall and db connect

nsa2019
New Member

i have checkpoint firewall logs on my splunk instance.
but now i want to create alerts for it.
i want it to alert when someone tries to connect to network components such as routers, switches, etc. from a non permitted segment.

now the problem is that there are components added to the fw all the time, and i need the list of components updated. so a list/lookup/xls is out of the question because its a one time thing. so i need a dynamic solution that will include the splunk being updated on the changes that happen on the fw.

i know about the db connect option, abut the Checkpoint firewall doesnt use sql db(of any kind) , and i saw that db connect requiers that. is my information wrong? is there another way of making db connect work in this matter with checkpoint firewall? or is there another solution for my problem other than db connect?

0 Karma
Get Updates on the Splunk Community!

Splunk Observability Cloud’s AI Assistant in Action Series: Analyzing and ...

This is the second post in our Splunk Observability Cloud’s AI Assistant in Action series, in which we look at ...

Elevate Your Organization with Splunk’s Next Platform Evolution

 Thursday, July 10, 2025  |  11AM PDT / 2PM EDT Whether you're managing complex deployments or looking to ...

Splunk Answers Content Calendar, June Edition

Get ready for this week’s post dedicated to Splunk Dashboards! We're celebrating the power of community by ...