---
url: https://docs.realmsec.info/integration/checkpoint_firewall.md
---

# Checkpoint Firewall (CEF)

Realm Security integrates with Checkpoint Firewall for monitoring of firewall data.

## Prerequisites

* Ensure you have access to your Checkpoint firewall SmartConsole.
* Realm Collector is set up and running. See [Realm Collector install guide](/integration/collector) for setting up a collector.
* Realm Security Collector IP address or FQDN.

## Choosing a Source Format

Realm supports two source formats for Checkpoint Firewall logs. Choose the format that matches how you configure log export in SmartConsole:

> **Note:** Use **`Checkpoint Firewall (CEF)`** if you configure the Log Exporter to export in **Common Event Format (CEF)**. CEF provides structured key-value fields and is the recommended format for richer field mapping and parsing.
>
> Use **`Checkpoint Firewall (Syslog)`** if you configure the Log Exporter to export in **Syslog** format. Select this format when your environment requires plain syslog output or when CEF is not supported by your gateway version.

The format you choose in Realm must match the **Data Manipulation > Format** setting in your Checkpoint Log Exporter configuration. Mismatched formats will result in unparsed or incorrectly parsed log data.

## Setup Checkpoint Firewall Source in Realm

1. Login to Realm console.
2. Go to **Sources > Add** and add a new Source, choosing the format that matches your Checkpoint export configuration (see [Choosing a Source Format](#choosing-a-source-format) above).
   > **Name:** `Checkpoint Firewall`\
   > **Description:** `Checkpoint Firewall logs`\
   > **Format:** `Checkpoint Firewall` *(for CEF)* or `Checkpoint Firewall Syslog` *(for Syslog)*
3. If a collector is already set up, go to **Collectors** and select your collector. If not, go to **Collectors > Add** and give it a name and description.
4. Add a Checkpoint Firewall stream to the Collector. Click **Add Stream**.
   > **Product Format:** `Checkpoint Firewall` *(for CEF)* or `Checkpoint Firewall Syslog` *(for Syslog)*\
   > **Port:** Select a unique port for this collector\
   > **Source:** `Checkpoint Firewall`
5. Click **Add Stream**.
6. Take note of the port assigned to the Checkpoint Firewall stream. You will need it when configuring Checkpoint Firewall to forward log messages to Realm.

## Setup Checkpoint Firewall Log Export in SmartConsole

For CLI instructions, see the [Checkpoint CLI Log Exporter guide](https://sc1.checkpoint.com/documents/R81/WebAdminGuides/EN/CP_R81_LoggingAndMonitoring_AdminGuide/Topics-LMG/Log-Exporter-Configuration-in-CLI-Basic.htm).

Otherwise, follow the [Log Exporter - Check Point Log Export](https://sc1.checkpoint.com/documents/R81/WebAdminGuides/EN/CP_R81_LoggingAndMonitoring_AdminGuide/Topics-LMG/Log-Exporter-Configuration-in-SmartConsole.htm) guide. Details and screenshots are provided below.

1. Create a new Log Exporter/SIEM object via **Objects > Server > New Log Exporter/SIEM**.
   * For **General > Target Server**, provide the IP address or FQDN of the Realm Security Collector.
   * For **General > Target Port**, provide the port number assigned to the Checkpoint Firewall stream.
     ![ObjectsMenu](../images/checkpoint_objects_menu.png)
     ![LogExporter](../images/checkpoint_log_exporter.png)
   * For **Data Manipulation > Format**, select the format that matches your Realm source configuration:
     * `Common Event Format (CEF)` — if you selected the **`Checkpoint Firewall`** source format in Realm
     * `Syslog` — if you selected the **`Checkpoint Firewall Syslog`** source format in Realm
       ![CEFDataFormat](../images/checkpoint_data_format_cef.png)
   * Click **OK**.

2. Configure the Management Server or Dedicated Log Server / SmartEvent Server object via **Gateways & Servers > Management Server or Dedicated Log Server/SmartEvent Server > Logs > Export**.
   * Click **\[+]** and select the Log Exporter / SIEM object you configured earlier.
   * Click **OK**.

3. Install the Database via **Menu > Install database**.
   ![InstallDataBase](../images/checkpoint_install_database.png)
   * Select all objects.
   * Click **Install**.

> **Important:** The format selected in **Data Manipulation > Format** on the Checkpoint side must match the source format configured in Realm. Selecting `Common Event Format (CEF)` in Checkpoint requires the **`Checkpoint Firewall`** source format in Realm; selecting `Syslog` requires the **`Checkpoint Firewall Syslog`** source format. Use the port assigned to the Checkpoint stream in the Collector regardless of format.

For more in-depth documentation, see the [Log Exporter Administration Guide](https://sc1.checkpoint.com/documents/Log_Exporter/EN/Default.htm).

## Support

For additional details, refer to the official [Checkpoint Firewall documentation](https://support.checkpoint.com/results/sk/sk122323).

If you encounter any issues or require assistance, contact Realm Security support.