Splunk SOAR

Newbie on Phantom on Check Point

poctalk
Engager

I'm working on building a POC to test gateways with Phantom and I can't seem to get this working. I've created an asset and a Check Point Management, but I keep getting this error message. I must be skipping a step and there isn't much documentation to work with.

App 'Check Point Firewall' started successfully (id: 1544619295625) on asset: 'chkpfw'(id: 7)
Loaded action execution configuration
Using base URL 'https://10.1.1.101:443/web_api/'
Connecting to https://10.1.1.101:443/web_api/...
Could not connect to Check Point. Connectivity test failed. No action executions found.

Tags (1)

cblumer_splunk
Splunk Employee
Splunk Employee

It's recommended to check the logs on the Phantom host whenever there are issues with connectivity for an integration:
/var/log/phantom/spawn.log
/var/log/phantom/wsgi.log

A netcat test can also be executed from the Phantom host to confirm network connectivity:
sudo nc -vz 192.168.28.121 443

cblumer_splunk
Splunk Employee
Splunk Employee

It looks like the Management API feature was introduced in the R80 Check Point Release:
https://sc1.checkpoint.com/documents/latest/APIs/index.html#api_versions~v1.5%20

Here are the Checkpoint API Docs:
https://sc1.checkpoint.com/documents/latest/APIs/index.html#cli/introduction~v1.5%20

Checkpoint App for Phantom:
https://my.phantom.us/4.5/docs/app_reference/phantom_checkpoint

0 Karma

manrodriguez
Engager

Hello poctalk!!!

Any answer for this issue? how can you resolved this issue? in this moment i have the same problem with a checkpoint version R77.30, i tried differents ways to connect but nothing.

I appreciate your feedback.

Regards!

0 Karma
Got questions? Get answers!

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Meet up IRL or virtually!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

Get Updates on the Splunk Community!

[Puzzles] Solve, Learn, Repeat: Character substitutions with Regular Expressions

This challenge was first posted on Slack #puzzles channelFor BORE at .conf23, we had a puzzle question which ...

Splunk Community Badges!

  Hey everyone! Ready to earn some serious bragging rights in the community? Along with our existing badges ...

[Puzzles] Solve, Learn, Repeat: Matching cron expressions

This puzzle (first published here) is based on matching timestamps to cron expressions.All the timestamps ...