Enosys Add-on for Check Point OPSEC LEA
Overview
- Enosys Solutions is a technology security specialist with a highly skilled professional services team and 24x7 on-shore security operations centre (SOC) servicing corporate and public sector organisations across Australia, specialising in Security Operations services leveraging Splunk.
Description:
- Enosys created this Technical Add-On to enable CIM-compliant ingestion of logging data from a forwarded Check Point logs.
Features:
- This is intended to support field extraction for Splunk Cloud and Enterprise deployments.
- As this is intended for use on Search Heads no binaries are included.
- Efforts to ensure CIM compliance are met.
- The Enosys Add-on for Check Point OPSEC LEA works with expected Check Point type logs opsec,opsec:smartdefense(ips),opsec:vpn,opsec:audit,opsec:threat_emulation,opsec:anti_malware(anti_bot) and opsec:anti_virus
Attribution:
- Full credit to the Splunk team for their work and maintenance of the foundation and componente 'https://splunkbase.splunk.com/app/3197/'
** Please contribute here https://github.com/enosysau/Splunk_TA_checkpoint-opseclea_Enosys **
Release Notes
Version 1.3.1
Requirements:
- This Add-on requires additional 'Splunk Add-on for Check Point OPSEC LEA' version 4.3.1 (https://splunkbase.splunk.com/app/3197/) installed on a Heavy Forwarder to retrieve the logs from OPSEC LEA Server.
Installation:
- The Add-on Enosys Add-on for Check Point OPSEC LEA should be installed on Search Heads and Indexers.
- Splunk Add-on for Check Point OPSEC LEA version 4.3.1 (https://splunkbase.splunk.com/app/3197/) installed on a Heavy Forwarder
Known issues:
- (none)
Addressed Issues:
- Additional 'opsec' vendor action with CIM expected action values
- Re-mapped 'eventtypes' linked to tags authentication, network and malware
Version 1.3
Enosys Add-on for Check Point OPSEC LEA version 1.3
This Application is published and maintained by Enosys and all the transformation codes
The Enosys Add-on for Check Point OPSEC LEA works only when Check Point logs are forwarded to Splunk Enterprise or Splunk Cloud via Splunk Heavy Forwarder with an installed Splunk Add-on for Check Point OPSEC LEA version 4.3.1.
Version 1.3 of the Enosys Add-on for Check Point OPSEC LEA is compatible with:
| Splunk Enterprise versions | 7.2, 7.1, 7.0, 6.6 |
|---|---|
| CIM | 4.10, 4.11, 4.12 |
| Platforms | Platform independent |
| Vendor Products | CheckPoint |
The new Add-on version 1.3 addresses the following issues detected on Splunk Add-on for Check Point OPSEC LEA version 4.3.1
- Contemplates CheckPoint products logs
- New field alias applied and adjustments made for compliance(CIM)
- New tag Authentication and logs with expected CIM fields
- Lookups updated
The new Add-on version 1.3 addresses the following
Version 1.2
Removed application components, purely a field extraction TA now to allow for easier certification.
Designed for use on Search Heads only with the 'official' version with LEA binary to be used locally for connectivity to Checkpoint servers.
Version 1.1
Altered the formal version number (to show that this is a fork) however preserved the original base version in the name to allow people to see at what point we started modifying the project.