Check point integration

[Anastasia Bataeva]

Hello. I want to configure event collection in Checkpoint so that events are displayed in the Wazuh web version. What needs to be done for this, and how to properly configure data collection and processing?

Movavi everywhere, every day

[Olamilekan Abdullateef Ajani]

Hello,

When integrating network devices like a FortiGate firewall, the better approach is to use a collector (for example, rsyslog) to receive the logs first, then forward them to the Wazuh manager. This helps with scalability, gives you a central place to manage all device logs, and lets you filter or tune them before they reach Wazuh.

This means having a central collection point for logs and then configuring the agent to monitor the log output and forward it to wazuh manager.
This is a more robust and scalable way of log collection.

Please see the link here for configuration reference. https://documentation.wazuh.com/current/cloud-service/your-environment/send-syslog-data.html

Once the rsyslog is setup, you can configure the agent to read from the output file by editing the /var/ossec/etc/ossec.conf file.

<localfile>
   <log_format>syslog</log_format>
   <location>/var/log/<FILE_NAME.log></location>
</localfile>

You can also make use of the syslog option, which means forwarding the logs directly from checkpoint to Wazuh. You can refer to the documentation below on configuring the checkpoint side:
https://support.checkpoint.com/results/sk/sk122323
https://community.checkpoint.com/t5/Firewall-Security-Management/Sending-syslog-from-CheckPoint-R81-to-SIEM/td-p/144268

While referring to the documentation below to configure the Wazuh server for syslog:
https://documentation.wazuh.com/current/user-manual/capabilities/log-data-collection/syslog.html

Worth mentioning that Wazuh already has decoders and rules for the checkpoint firewall, so your logs should be decoded accordingly once the integration is complete.
https://github.com/wazuh/wazuh-ruleset/blob/master/decoders/0050-checkpoint_decoders.xml

Please let me know if you require further clarification on this.