About suryavicky21

suryavicky21 · ‎03-26-2019

@okayal thanks for the comments, though after that the leading zero is stripped off on the visualization while it is present in the search results.

suryavicky21 · ‎03-26-2019

i have a query which result in a 6 digit number for a fieldname that might include leading "0" like 001234, 012345, 123456 my query returns a single fieldname, something like fieldname=001234, and i want to show this number on a single value dashboard. but i go to the visualization the leading zero is removed by splunk and show just the number 1234 please help me achieve this and show the number in a single value dashboard with the leading "0"

suryavicky21 · ‎07-10-2018

So finally after so much troubleshooting i figured out the issue was with configurations on the Checkpoint device there are stanzas in the fwopsec.conf on Checkpoint at $FWDIR/conf/fwopsec.conf lea_server port 12345 --> when a port is assigned here opsec works on clear connections lea_server auth_port 23456 --> this is what accepts ssl connections (opsec sslca) So per my troubleshooting Splunk connects to Opsec only on SSL and wont work with CLEAR, therefore the lea_server auth_port 23456 stanza should exist in fwopsec.conf, Now when the auth_port is mentioned the type shall be mentioned in the fwopsec.conf which is lea_server auth_type sslca so for clear connections the fwopsec.conf should have lea_server port 12345 For sslca the fwopsec.conf should have stanzas lea_server auth_port 23456 lea_server auth_type sslca If the port is 0(Zero) that means that type is disabled (Ex: lea_server auth_port 0 means sslca is disabled) Another thing, i guess Opsec can only listen either on clear or SSL but not both at same time, so make sure lea_server auth_port 23456 and lea_server auth_type sslca exists in fwopsec.conf on checkpoint and it works like pro ;

suryavicky21 · ‎07-02-2018

Thanks for the comment @milesbrennan there wasn't an issue pulling the cert. Add-on did fetch the cert, i've created the connection.conf and inputs.conf as well post which i see the SIC 147 error. Also i followed the procedure mentioned at Splunk docs to configure the inputs and cert Thanks

suryavicky21 · ‎05-20-2018

tried these, but no luck. I did not find any error related to time though. I've installed the same on a single instance setup where there is only one manager handling multiple gateways, and the OPSEC LEA TA works like pro any more inputs please 😐

suryavicky21 · ‎05-19-2018

Hello I am trying to integrate Checkpoint logs into Splunk using the OPSEC LEA modular input/TA. I notice the below error post configuring the connections and inputs 2018-05-20 05:53:33,998 +0000 log_level=ERROR, pid=xxxx, tid=Thread-61667, file=ta_opseclea_data_collector.py, func_name=get_logs, code_line_no=75 | [input_name="name" connection="connecitonname" data="xxx"]log_level=0 file:lea_loggrabber.cpp func_name:check_session_end_reason code_line_no:1056 :ERROR: Session end reason: SIC ERROR 147 - SIC Error for lea: Authentication error I see this error for each of the inputs that is configured. the setup is -- 1 Primary checkpoint Manager -- 1 Secondary checkpoint Manager -- 1 reporter manager server -- multiple gateways So i presume the certificate shall be pulled from the primary manager and the logs as well, as manager deals with all the gateways. I did pull the certificate from primary manager and configured the connections.conf for manager, but above is the error i see. Couldn't figure out yet the issue to fix. 😞 Did anyone test the Checkpoint OPSEC LEA for splunk over distributed architecture that has a manager handling gateways and a reporter server. I would be glad if anyone can help me on this. Thanks Surya Teja

Posts	6
Solutions	1
Karma Given	0
Karma Received	0
Member Since	‎05-19-2018

Online Status	Offline
Date Last Visited	‎06-05-2020 02:04 AM

how can show leading zeros in single value dashboa...

Checkpoint OPSEC log collection Error

Re: how can show leading zeros in single value das...

how can show leading zeros in single value dashboa...

Re: Checkpoint OPSEC log collection Error

Re: Checkpoint OPSEC log collection Error

Re: Checkpoint OPSEC log collection Error

Checkpoint OPSEC log collection Error