Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

[Filebeat] Add module for Checkpoint Firewall #16041

Closed
leehinman opened this issue Feb 3, 2020 · 6 comments · Fixed by #16907 or #17682
Closed

[Filebeat] Add module for Checkpoint Firewall #16041

leehinman opened this issue Feb 3, 2020 · 6 comments · Fixed by #16907 or #17682
Assignees
@andrewkroh
Labels
enhancement Filebeat Filebeat

Comments

@leehinman
Copy link
Contributor

leehinman commented Feb 3, 2020 •
edited by andrewkroh
Loading

Most likely using Checkpoint Log Exporter and CEF format

Checkpoint can export logs via CEF using their "Log Exporter". I found a list of mappings:
https://community.checkpoint.com/t5/Logging-and-Reporting/Log-Exporter-CEF-Field-Mappings/td-p/41060

Info on Log Exporter:
https://community.checkpoint.com/t5/Logging-and-Reporting/Log-Exporter-guide/td-p/9035

https://sc1.checkpoint.com/documents/R80.20.M2/WebAdminGuides/EN/CP_R80.20_M2_LoggingAndMonitoring_AdminGuide/html_frameset.htm?topic=documents/R80.20.M2/WebAdminGuides/EN/CP_R80.20_M2_LoggingAndMonitoring_AdminGuide/203039
@leehinman leehinman self-assigned this Feb 3, 2020
@elasticmachine
Copy link
Collaborator

Pinging @elastic/siem (Team:SIEM)

@andrewkroh andrewkroh changed the title [Filebeat] add module for Checkpoint FW [Filebeat] Add module for Checkpoint Firewall Feb 11, 2020
@andrewkroh andrewkroh assigned andrewkroh and unassigned leehinman Feb 11, 2020
@hazcod
Copy link
Contributor

hazcod commented Mar 2, 2020

@leehinman Since not yet supported by beats, how are you currently shipping SIEM events?

@adriansr adriansr mentioned this issue Mar 9, 2020
Merged
adriansr added a commit to adriansr/beats that referenced this issue Mar 18, 2020
@adriansr
CEF module: Support Check Point devices
b2210e7 
This adds a new ingest pipeline and fields to populate from Check Point
CEF logs.

Closes elastic#16041
adriansr added a commit that referenced this issue Mar 18, 2020
@adriansr
[SIEM][CEF] Add support for Check Point devices (#16907)
f6fde2e 
* Make CEF key name mapping case-insensitive

There's some case inconsistency in CEF docs (i.e. C6a4Label). Better to
ignore case when mapping keys to full names.

* Add missing custom CEF extensions

This adds:
 - `deviceCustomIPv6Address2(Label)`: Only 1, 3 and 4 were expected.
 - `flexNumber[12](Label)`: These two alternative custom numbers were
   dropped after V23 of the spec, but still used by some vendors.

[Maybe unnecessary] changes:

 - Changed the case of `DeviceCustomNumber2` from uppercase as
   documented) to lowercase to align with the other fields.

* CEF module: Support Check Point devices

This adds a new ingest pipeline and fields to populate from Check Point
CEF logs.

Closes #16041
@hazcod
Copy link
Contributor

hazcod commented Mar 18, 2020

Thank you @adriansr !

@adriansr adriansr mentioned this issue Mar 19, 2020
Merged
adriansr added a commit to adriansr/beats that referenced this issue Mar 19, 2020
@adriansr
[SIEM][CEF] Add support for Check Point devices (elastic#16907)
c77551d 
* Make CEF key name mapping case-insensitive

There's some case inconsistency in CEF docs (i.e. C6a4Label). Better to
ignore case when mapping keys to full names.

* Add missing custom CEF extensions

This adds:
 - `deviceCustomIPv6Address2(Label)`: Only 1, 3 and 4 were expected.
 - `flexNumber[12](Label)`: These two alternative custom numbers were
   dropped after V23 of the spec, but still used by some vendors.

[Maybe unnecessary] changes:

 - Changed the case of `DeviceCustomNumber2` from uppercase as
   documented) to lowercase to align with the other fields.

* CEF module: Support Check Point devices

This adds a new ingest pipeline and fields to populate from Check Point
CEF logs.

Closes elastic#16041

(cherry picked from commit f6fde2e)
adriansr added a commit that referenced this issue Mar 20, 2020
@adriansr
Cherry-pick #16907 to 7.x: [SIEM][CEF] Add support for Check Point de…
a4b5c4a 
…vices (#17111)

* Make CEF key name mapping case-insensitive

There's some case inconsistency in CEF docs (i.e. C6a4Label). Better to
ignore case when mapping keys to full names.

* Add missing custom CEF extensions

This adds:
 - `deviceCustomIPv6Address2(Label)`: Only 1, 3 and 4 were expected.
 - `flexNumber[12](Label)`: These two alternative custom numbers were
   dropped after V23 of the spec, but still used by some vendors.

[Maybe unnecessary] changes:

 - Changed the case of `DeviceCustomNumber2` from uppercase as
   documented) to lowercase to align with the other fields.

* CEF module: Support Check Point devices

This adds a new ingest pipeline and fields to populate from Check Point
CEF logs.

Closes #16041

(cherry picked from commit f6fde2e)
@adriansr
Copy link
Contributor

This was closed after merging CEF support for Check Point but shouldn't have been closed as this is just support for the CEF output but not for Check Point logs in general.

@adriansr adriansr reopened this Mar 30, 2020
@hazcod
Copy link
Contributor

hazcod commented Mar 30, 2020

@adriansr: what’s the difference here?

@adriansr
Copy link
Contributor

Check Point can generate logs in CEF format, so we updated the cef module to understand the custom fields it adds. But also has it's own log format which is the default and provides more information than CEF. We'll add a new module to support those logs.

@P1llus P1llus mentioned this issue Apr 13, 2020
Merged
6 tasks
@andrewkroh andrewkroh mentioned this issue Apr 20, 2020
Merged
6 tasks
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Assignees

@andrewkroh andrewkroh

Labels
enhancement Filebeat Filebeat
Projects
None yet
Milestone
No milestone
5 participants
@andrewkroh @hazcod @adriansr @elasticmachine @leehinman