Splunk SOAR

Newbie on Phantom on Check Point

poctalk
Engager

I'm working on building a POC to test gateways with Phantom and I can't seem to get this working. I've created an asset and a Check Point Management, but I keep getting this error message. I must be skipping a step and there isn't much documentation to work with.

App 'Check Point Firewall' started successfully (id: 1544619295625) on asset: 'chkpfw'(id: 7)
Loaded action execution configuration
Using base URL 'https://10.1.1.101:443/web_api/'
Connecting to https://10.1.1.101:443/web_api/...
Could not connect to Check Point. Connectivity test failed. No action executions found.

Tags (1)

cblumer_splunk
Splunk Employee
Splunk Employee

It's recommended to check the logs on the Phantom host whenever there are issues with connectivity for an integration:
/var/log/phantom/spawn.log
/var/log/phantom/wsgi.log

A netcat test can also be executed from the Phantom host to confirm network connectivity:
sudo nc -vz 192.168.28.121 443

cblumer_splunk
Splunk Employee
Splunk Employee

It looks like the Management API feature was introduced in the R80 Check Point Release:
https://sc1.checkpoint.com/documents/latest/APIs/index.html#api_versions~v1.5%20

Here are the Checkpoint API Docs:
https://sc1.checkpoint.com/documents/latest/APIs/index.html#cli/introduction~v1.5%20

Checkpoint App for Phantom:
https://my.phantom.us/4.5/docs/app_reference/phantom_checkpoint

0 Karma

manrodriguez
Engager

Hello poctalk!!!

Any answer for this issue? how can you resolved this issue? in this moment i have the same problem with a checkpoint version R77.30, i tried differents ways to connect but nothing.

I appreciate your feedback.

Regards!

0 Karma
Get Updates on the Splunk Community!

Observe and Secure All Apps with Splunk

  Join Us for Our Next Tech Talk: Observe and Secure All Apps with SplunkAs organizations continue to innovate ...

Splunk Decoded: Business Transactions vs Business IQ

It’s the morning of Black Friday, and your e-commerce site is handling 10x normal traffic. Orders are flowing, ...

Fastest way to demo Observability

I’ve been having a lot of fun learning about Kubernetes and Observability. I set myself an interesting ...