Checkpoint NGFW builds on the capabilities of a traditional firewall by incorporating additional features. For example, an NGFW operates at the application layer of the TCP/IP stack to apply intrusion prevention system (IPS), antimalware, sandboxing and other protections. These functions allow an NGFW to identify and block advanced threats before they pose a risk to corporate systems.
For more information on Checkpoint Next Generation Firewall, click here.
Integration Method: Data Collector (syslog)
Tables: Network Activity (4001), Detection Finding (2004)
This integration supports the following events.
Event | Description |
|---|---|
URL Filtering Activity | Provides details about the URL filtering operations. |
IPS Activity | Provides details about the Intrusion Prevention System activities. |
Antivirus Activity | Provides details about the Antivirus operations. |
Malware Activity | Provides details about the anti-malware operations. |
This integration supports the following versions.
Checkpoint Version Tested | R81.20 |
Prerequisites
Access to login into Checkpoint backend environment as an administrator.
The user should have a compatible version of the system in which we can configure the data collector.
The user should have access to the DataBee console.
Configuration Overview
Configure syslog on Checkpoint Machine.
Configure Checkpoint New Generation Firewall feed in DataBee Console.
Data Collector Configuration
To install Data Collector, please follow the steps mentioned here.
Verify that the required port (for example, port 514) is open and configured to accept incoming data from the Checkpoint server.
Checkpoint Configuration
Login to the Checkpoint backend as an administrator.
ex: ssh admin@1.2.3.4Login to the expert mode.
expertModify the below command and execute in the shell,
cp_log_export add name {Jobname} target-server {IP} target-port {Port} protocol tcp format json
Jobname - Can be name of your choice.
IP - The IP of the machine where the Data Collector is installed.
Port - The Port which was opened during Data Collector Configuration.
sample command - cp_log_export add name comcast1 target-server 1.2.5.8 target-port 514 protocol tcp format json
Execute the below command to check the configuration.
cp_log_export show
DataBee Configuration
Login to the DataBee UI, navigate to Data > Data Feeds and click the Add New Data Feed button.
Search for the Checkpoint Next Generation Firewall and click it as shown below.
Click on the Data Collector for collection method.
Click on the Syslog option.
Enter feed contact information then select the data collector created earlier and scroll down.
In the configuration page, confirm the following:
Select the ‘format’ as json from the dropdown.
Select the ‘Mode’ as TCP from the dropdown.
Fill the ‘Port’ with the port configured during the syslog configuration in the host machine.
Click Submit.
Troubleshooting Tips
If you encounter any issues regarding log forwarding, refer to the DataBee troubleshooting article for detailed guidance.