Checkpoint

[Anastasia Bataeva]

Hello. I want to configure event collection in Checkpoint so that events are displayed in the Wazuh web version. What needs to be done for this, and how to properly configure data collection and processing?

Movavi everywhere, every day

[Md. Nazmur Sakib]

Hi Anastasia,

I believe you are talking about network devices like Checkpoint firewall. You have two options to capture syslog forwarded from network devices.

One, the Wazuh server can collect logs via syslog from endpoints.

https://documentation.wazuh.com/current/user-manual/capabilities/log-data-collection/syslog.html

Another option is to forward the logs to an agent and ingest the logs by using Rsyslog for Linux endpoints and Logstash for Windows endpoints.

When integrating network devices, the better approach is to use a collector (for example, rsyslog) to receive the logs first, then forward them to the Wazuh manager. This helps with scalability, gives you a central place to manage all device logs, and lets you filter or tune them before they reach Wazuh.

This means having a central collection point for logs and then configuring the agent to monitor the log output and forward it to the Wazuh manager.
This is a more robust and scalable way of log collection.

Please see the link here for configuration reference. https://documentation.wazuh.com/current/cloud-service/your-environment/send-syslog-data.html

Once rsyslog is set up, you can configure the agent to read from the output file by editing the /var/ossec/etc/ossec.conf file.

<localfile>
   <log_format>syslog</log_format>
   <location>/var/log/<FILE_NAME.log></location>
</localfile>

You can also make use of the syslog option, which means forwarding the logs directly from the checkpoint to Wazuh. You can refer to the documentation below on configuring the CheckPoint side:
https://support.checkpoint.com/results/sk/sk122323
https://community.checkpoint.com/t5/Firewall-Security-Management/Sending-syslog-from-CheckPoint-R81-to-SIEM/td-p/144268



Worth mentioning that Wazuh already has decoders and rules for the CheckPoint firewall, so your logs should be decoded accordingly once the integration is complete.
https://github.com/wazuh/wazuh-ruleset/blob/master/decoders/0050-checkpoint_decoders.xml

Please let me know if you require further help with this.