Checkpoint Firewall (Splunk)

Realm Security integrates with Checkpoint Firewall logs in the Log Exporter Splunk format. Checkpoint Log Exporter sends the logs to a Realm Collector.

Use this format if you already send Checkpoint logs to Splunk with the Check Point App for Splunk (sourcetype cp_log), or if you must keep that format.

For the CEF and Syslog formats, see Checkpoint Firewall.

Prerequisites

• Ensure you have access to your Checkpoint firewall SmartConsole.
• Realm Collector is set up and running. See Realm Collector install guide for setting up a collector.
• Realm Security Collector IP address or FQDN.

Requirements

• Realm Collector version v0.137.0-rlm2 or later. Older collectors do not open a port for this format.
• Log Exporter must send over TCP. The Realm stream does not accept UDP. SmartConsole uses UDP by default, so it must be changed.
• Log Exporter must send in clear text. The Realm stream does not support TLS.
• Do not enable the Log Exporter time-in-milli option. Realm reads the time field in seconds.

These steps cover Log Exporter on an on-premises Management Server or Log Server. They do not cover Smart-1 Cloud.

Set Up the Checkpoint Firewall (Splunk) Source in Realm

1. Log in to the Realm console.
2. Go to Sources > Add and add a new source.

   Name: Checkpoint Firewall (Splunk)
   Description: Checkpoint Firewall logs in Splunk format
   Format: Checkpoint Firewall (Splunk)

3. If a collector is already set up, go to Collectors and select your collector. If not, go to Collectors > Add and give it a name and description.
4. Click Add Stream.

   Product Format: Checkpoint Firewall (Splunk)
   Port: Select a unique port for this collector
   Timezone: Select the timezone of your Checkpoint log server
   Source: Checkpoint Firewall (Splunk)

5. Click Add Stream.
6. Record the port of the stream. You need it to configure Log Exporter.

Note: Realm sets the protocol (TCP) and the framing (one log per line) for this stream. You do not select them.

Configure Log Exporter in SmartConsole

For CLI instructions, see the Checkpoint CLI Log Exporter guide. Use the same settings as the SmartConsole steps below: protocol tcp, format splunk, and read mode semi-unified.

1. Go to Objects > Server > New Log Exporter/SIEM to create a new Log Exporter/SIEM object.

2. On the General page, set the server configuration.

   Export Configuration: Enabled
   Target Server: <Realm Collector IP address or FQDN>
   Target Port: <port of the Checkpoint Firewall (Splunk) stream>
   Protocol: TCP

   

3. On the Data Manipulation page, set the format.

   Format: Splunk

4. On the same page, select Aggregate log updates before export. If your version shows Aggregation Mode, select Semi unified. Without this setting, each update log contains only the changed fields.

5. Click OK.

6. Go to Gateways & Servers and open the Management Server or Dedicated Log Server/SmartEvent Server object.

7. Go to Logs > Export, click [+], and select the Log Exporter/SIEM object from step 1.

8. Click OK.

9. Go to Menu > Install database, select all objects, and click Install.

Important: The default protocol in SmartConsole is UDP. Select TCP. If you keep UDP, Realm does not receive the logs.

Verify the Setup

1. In the Realm console, open the Checkpoint Firewall (Splunk) source and confirm that new events arrive.
2. If no events arrive, follow the collector troubleshooting steps.

Support

For more information, see these Checkpoint documents:

• Log Exporter overview and supported versions
• Log Exporter troubleshooting

If you encounter any issues or require assistance, contact Realm Security support.