---
url: https://docs.realmsec.info/integration/checkpoint_firewall_splunk.md
---

# Checkpoint Firewall (Splunk)

Realm Security integrates with Checkpoint Firewall logs in the Log Exporter **Splunk** format. Checkpoint Log Exporter sends the logs to a Realm Collector.

Use this format if you already send Checkpoint logs to Splunk with the Check Point App for Splunk (sourcetype `cp_log`), or if you must keep that format.

For the CEF and Syslog formats, see [Checkpoint Firewall](/integration/checkpoint_firewall).

## Prerequisites

* Ensure you have access to your Checkpoint firewall SmartConsole.
* Realm Collector is set up and running. See [Realm Collector install guide](/integration/collector) for setting up a collector.
* Realm Security Collector IP address or FQDN.

## Requirements

* Realm Collector version `v0.137.0-rlm2` or later. Older collectors do not open a port for this format.
* Log Exporter must send over **TCP**. The Realm stream does not accept UDP. SmartConsole uses UDP by default, so it must be changed.
* Log Exporter must send in clear text. The Realm stream does not support TLS.
* Do not enable the Log Exporter `time-in-milli` option. Realm reads the `time` field in seconds.

These steps cover Log Exporter on an on-premises Management Server or Log Server. They do not cover Smart-1 Cloud.

## Set Up the Checkpoint Firewall (Splunk) Source in Realm

1. Log in to the Realm console.
2. Go to **Sources > Add** and add a new source.
   > **Name:** `Checkpoint Firewall (Splunk)`\
   > **Description:** `Checkpoint Firewall logs in Splunk format`\
   > **Format:** `Checkpoint Firewall (Splunk)`
3. If a collector is already set up, go to **Collectors** and select your collector. If not, go to **Collectors > Add** and give it a name and description.
4. Click **Add Stream**.
   > **Product Format:** `Checkpoint Firewall (Splunk)`\
   > **Port:** Select a unique port for this collector\
   > **Timezone:** Select the timezone of your Checkpoint log server\
   > **Source:** `Checkpoint Firewall (Splunk)`
5. Click **Add Stream**.
6. Record the port of the stream. You need it to configure Log Exporter.

> **Note:** Realm sets the protocol (TCP) and the framing (one log per line) for this stream. You do not select them.

## Configure Log Exporter in SmartConsole

For CLI instructions, see the [Checkpoint CLI Log Exporter guide](https://sc1.checkpoint.com/documents/Log_Exporter/EN/Content/Topics/Appendix_A_Deployment-CLI.htm). Use the same settings as the SmartConsole steps below: protocol `tcp`, format `splunk`, and read mode `semi-unified`.

1. Go to **Objects > Server > New Log Exporter/SIEM** to create a new Log Exporter/SIEM object.
   ![ObjectsMenu](../images/checkpoint_objects_menu.png)
2. On the **General** page, set the server configuration.

   > **Export Configuration:** `Enabled`\
   > **Target Server:** `<Realm Collector IP address or FQDN>`\
   > **Target Port:** `<port of the Checkpoint Firewall (Splunk) stream>`\
   > **Protocol:** `TCP`

   ![LogExporter](../images/checkpoint_log_exporter.png)
3. On the **Data Manipulation** page, set the format.
   > **Format:** `Splunk`
4. On the same page, select **Aggregate log updates before export**. If your version shows **Aggregation Mode**, select **Semi unified**. Without this setting, each update log contains only the changed fields.
5. Click **OK**.
6. Go to **Gateways & Servers** and open the Management Server or Dedicated Log Server/SmartEvent Server object.
7. Go to **Logs > Export**, click **\[+]**, and select the Log Exporter/SIEM object from step 1.
8. Click **OK**.
9. Go to **Menu > Install database**, select all objects, and click **Install**.
   ![InstallDataBase](../images/checkpoint_install_database.png)

> **Important:** The default protocol in SmartConsole is `UDP`. Select `TCP`. If you keep `UDP`, Realm does not receive the logs.

## Verify the Setup

1. In the Realm console, open the `Checkpoint Firewall (Splunk)` source and confirm that new events arrive.
2. If no events arrive, follow the [collector troubleshooting steps](/integration/collector#troubleshooting).

## Support

For more information, see these Checkpoint documents:

* [Log Exporter overview and supported versions](https://support.checkpoint.com/results/sk/sk122323)
* [Log Exporter troubleshooting](https://sc1.checkpoint.com/documents/Log_Exporter/EN/Content/Topics/Troubleshooting.htm)

If you encounter any issues or require assistance, contact Realm Security support.