Check Point Firewall R75 Datasource (OPSEC) and finding specific LOG-Information

[martin_p]

Hello!

After configureing the Check Point SmartCenter-Server as a datasource (OPSEC-Connection) i can see a lot of log-information of the firewalls.

Till now i did not find out how to find Logs related to the IPS-System of the Firewall. All the IPS-Logs are stored on the SmartCenter and are transfered via the OPSEC-Connection to the SIEM-System but i am not able to find them (drilldown, etc.).

Best regards

Martin

[lichnt]

Can you capture config CP FW ?

[martin_p]

Hello!

What kind of information do you mean? I configured on the SmartCenter the OPSEC-Part.

Best regards

Martin P.

[lichnt]

Yes

[martin_p]

Hello!

It is straight forward:

Vendor: User defined

Server Entities: none

Client Entities: LEA

As I said, this connection works fine and i can see all the Rule-Descriptions, the traffic. And i can make drill-downs (for example) based on source-ips, Ports. But i have the problem that till now, i cannot drill down (find) possilbe IPS-Logs, which are generated by the IPS-Blade on the Firewall.

Best regards

Martin

[lichnt]

at communication you config as picture:

AT ESM : you config as datasource with one time password

[martin_p]

Hello!

Yes as i said, the OPSEC-Connection works fine, trust is established. How can you see IPS-Alerts in the MC-AFEE ESM?

Best regards

Martin

[martin_p]

Hello!

Now i maybe found something. With the drill-down-option i found out, that in the value-field "Threat_Name" the original Check Point Names of the IPS-Alarms are listened! Maybe i can use this to create reports/alarms.

Have you tried this in this way?

Martin

[japie · Accepted solution]

Hi Martin

If you are using the Smart Defence IPS from Check Point, you can build a custom view.

If you want to view all the Smart Defence IPS classifications use the application filter: Smart Defence ( you will see this as well from the Check Point management station feed or datasource)

The same goes for any other blade functionality you enable from the Check Point technology stack ( application control,anti-botnet etc)

From there you can go down further and break it up in signature etc.

One big issue we have currently is with the auto-learn rules which clash with the 7 custom ASP rules provided by McAfee.

Regards,

Japie

[martin_p]

Hi Japie!

Thank you very much for your answere. Now i found out how to proceed with this.

It works great!

Best regards

Martin