How can I validate the logging of successful connections to Edge Firewall

New Member

Our firewall team has told us that they have turned on logging for successful connection for edge firewall. How can you validate this is true in Splunk?

The edge firewalls are a combination of Cisco ASA's and Checkpoints

Thank You

0 Karma


I would just keep it simple. Look for your own username in the raw log.

index=firewalls "AJeepDude"

Once you find the right event, look at it in verbose mode and make sure the user=AJeepDude. If you care about CIM, then check the tags.

0 Karma

Splunk Employee
Splunk Employee

here's a nice search to validate your Check Point FW event data is successfully indexing FW event logs:

index=_internal host= source="splunk_ta_checkpoint-opseclea_modinput.log" "Successfully indexed events:" |rex field=_raw "Successfully indexed events:\s(?.*)" |timechart span=600s sum(EVENT_COUNT) by connection

0 Karma
Get Updates on the Splunk Community!

New Splunk Observability innovations: Deeper visibility and smarter alerting to ...

You asked, we delivered. Splunk Observability Cloud has several new innovations giving you deeper visibility ...

Synthetic Monitoring: Not your Grandma’s Polyester! Tech Talk: DevOps Edition

Register today and join TekStream on Tuesday, February 28 at 11am PT/2pm ET for a demonstration of Splunk ...

Instrumenting Java Websocket Messaging

Instrumenting Java Websocket MessagingThis article is a code-based discussion of passing OpenTelemetry trace ...