In my case, I have multiple and separate Checkpoint management consoles (production, staging, development). I tried to create a new connection to staging after having my production instance operate for about a year. Trouble is that the new connection I just tried for Staging is not yet trusted. From the docs for the opsec app (version 2.0.4, latest), it seems like if I import the certificate I would unintentionally replace the certificate I need to support production. I told the 'wizard' that I already have a certificate. Do I need to have the opsec app installed once again for each new console (not firewall but management console) on my indexer and how do I accomplish that OR have I just missed something in my assumptions? Ideally I want to log each environment to a unique index so forwarding logs to one environment would work but it would not give me the isolation I need. How do I get my three management consoles monitored and events into Splunk? Has anyone else had a similar situation?
... View more
