Export Checkpoint logs to Rsyslog then read them with wazuh

[Wazuh user]

Hi there,

I would like to know if it's possible to do that, and how to do that ?

I read some documentations to do it, and I created a Rsyslog on my Wazuh server, thinking it would be easier to read logs, but I don't think that's the good way to di it.

Then, I have configured the rsyslog as indicated in tutorials, like : 
- Log Exporter Instructions for Specific SIEM (checkpoint.com)

- https://documentation.wazuh.com/current/cloud-service/your-environment/send-syslog-data.html

Do you have some recommandations to make it work correctly if it's possible ?

Thank you,

Regards

[Obinna Uchubilo]

Hello,

To use rsyslog, You will need to configure an endpoint that has the Wazuh agent installed. Checkpoint sends it logs to the endpoint with rsyslog and Wazuh agent installed. The rsyslog forwards the received logs to a file on the endpoint. Then, the Wazuh agent is configured to collect the logs from the file. 

You could also use syslog to collect the log from your checkpoint. 

• First, configure the Wazuh server to receive syslog messages. 
• Secondly, configure the network devices to send syslog messages to the Wazuh server. We recommend that you read the documentation of the vendor you are using to figure out how to do this.

You can check our blog post on Monitoring network devices with Wazuh

Regards

[Wazuh user]

Hi, 
Thanks for your answer ! 
So, i read your docs, and I configured syslog listener on wazuh server and the rsyslog on a virtual machine. But, about the /etc/rsyslog.conf :

if $fromhost-ip startswith '<YOUR_MIKROTIK_IP_ADDRESS>' then /var/log/mikrotik.log

& ~

If I understood well, I must replace 'Your Mirotik IP Address" by my checkpoint address, but my checkpoint is on cloud. How can I do to do it so ?

I'm begining in IT and Wazuh, sorry for having questions wich can be stupids....

Thanks in advance !

[Obinna Uchubilo]

Hi,

Yes, replace the  'Your Mirotik IP Address" with your checkpoint IP address. On how to get the IP address you can reference this document 

Regards