Which firewall logs are supported in Splunk?

[Sagar0511]

May I know which firewalls logs are supported and which format it should be. In my organization there is Checkpoint firewall. The logs of it will get upload or not and in which format.

[gcusello · Accepted solution]

Hi Sagar0511,

You can ingest all logs in text format, there isn't a supported format!

For the most used logs there already are also technical Addons (TAs) for ingesting and parsing logs, you can find them in apps.splunk.com.
Otherwise you can build your own parsing with just a little effort.

Anyway for Check Point, as you can see, there's a TA for OPSEC ( https://splunkbase.splunk.com/app/3197 ) and one for syslogs ( https://splunkbase.splunk.com/app/2996 ), in addition there are some Apps for monitoring ( https://splunkbase.splunk.com/app/2670 https://splunkbase.splunk.com/app/3054 https://splunkbase.splunk.com/app/2844 ).

Bye.
Giuseppe

[Sagar0511]

Thanks. The Information and Links were really helpful.