Within Kibana, browse to Integrations and locate the Check Point integration, and 'Add Check Point'.

Install the database within SmartConsole (steps included in the Checkpoint docs linked above).Configure the Management Server or Dedicated Log Server object in SmartConsole.Set the protocol to UDP or TCP, the Check Point integration supports both. Set the target server and target port to the Elastic Agent IP address and port number. For each firewall device you wish to monitor, create a new Log Exporter/SIEM object in Check Point SmartConsole.The agent will be used to receive syslog data from your Check Point firewalls and ship the events to Elasticsearch. Install Elastic Agent on a host between your Check Point Log Exporter instance and Elastic Cluster.This integration has been tested against Check Point Log Exporter on R80.X and R81.X. You will need one or more Check Point Firewall appliances to monitor. You can use our hosted Elasticsearch Service on Elastic Cloud, which is recommended, or self-manage the Elastic Stack on your own hardware. You need Elasticsearch for storing and searching your data and Kibana for visualizing and managing it. Logs collected by the Check Point integration include all logged network events specified by the firewall's rules. Logs help you keep a record of events logged by your firewall device. The Check Point integration collects one type of data: logs. You can do this by looking at additional context in the logs, such as the source of the requests, and more. You could also use the data to review or troubleshoot the rules that have been set up to block these activities. Then visualize that data in Kibana, create alerts to notify you if something goes wrong, and reference the firewall data stream when troubleshooting an issue.įor example, you could use the data from this integration to spot unusual network activity and malicious traffic on your network. Use the Check Point integration to collect and parse firewall event logs. The Check Point integration allows you to monitor Check Point Firewall logs from appliances running Check Point Management. Quick start: Get application traces into the Elastic Stack.

Quick start: Get logs, metrics, and uptime data into the Elastic Stack.

See the integrations quick start guides to get started:

Check point for vpn cleaner