Splunk SOAR

Newbie on Phantom on Check Point

poctalk
Engager

I'm working on building a POC to test gateways with Phantom and I can't seem to get this working. I've created an asset and a Check Point Management, but I keep getting this error message. I must be skipping a step and there isn't much documentation to work with.

App 'Check Point Firewall' started successfully (id: 1544619295625) on asset: 'chkpfw'(id: 7)
Loaded action execution configuration
Using base URL 'https://10.1.1.101:443/web_api/'
Connecting to https://10.1.1.101:443/web_api/...
Could not connect to Check Point. Connectivity test failed. No action executions found.

Tags (1)

cblumer_splunk
Splunk Employee
Splunk Employee

It's recommended to check the logs on the Phantom host whenever there are issues with connectivity for an integration:
/var/log/phantom/spawn.log
/var/log/phantom/wsgi.log

A netcat test can also be executed from the Phantom host to confirm network connectivity:
sudo nc -vz 192.168.28.121 443

cblumer_splunk
Splunk Employee
Splunk Employee

It looks like the Management API feature was introduced in the R80 Check Point Release:
https://sc1.checkpoint.com/documents/latest/APIs/index.html#api_versions~v1.5%20

Here are the Checkpoint API Docs:
https://sc1.checkpoint.com/documents/latest/APIs/index.html#cli/introduction~v1.5%20

Checkpoint App for Phantom:
https://my.phantom.us/4.5/docs/app_reference/phantom_checkpoint

0 Karma

manrodriguez
Engager

Hello poctalk!!!

Any answer for this issue? how can you resolved this issue? in this moment i have the same problem with a checkpoint version R77.30, i tried differents ways to connect but nothing.

I appreciate your feedback.

Regards!

0 Karma
Got questions? Get answers!

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Meet up IRL or virtually!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

Get Updates on the Splunk Community!

Why Splunk Customers Should Attend Cisco Live 2026 Las Vegas

Why Splunk Customers Should Attend Cisco Live 2026 Las Vegas     Cisco Live 2026 is almost here, and this ...

What Is the Name of the USB Key Inserted by Bob Smith? (BOTS Hint, Not the Answer)

Hello Splunkers,   So you searched, “what is the name of the usb key inserted by bob smith?”  Not gonna lie… ...

Automating Threat Operations and Threat Hunting with Recorded Future

    Automating Threat Operations and Threat Hunting with Recorded Future June 29, 2026 | Register   Is your ...