Import Checkpoint Archive Logs

[keithosullivan]

I have checkpoint logs going back which we have exported of our checkpoint FW, and i would like to import them into splunk. I have installed the opsec-lea module, but i would rather not setup the connectivity to our fw and just analyse the logs, is this possible?

Many thanks in advance.

[keithosullivan]

Thanks Brian and Trey. I tried importing from a file and it fails with an object error (not much help i know), however i presume this is because the logs i have are all in binary format as you say Trey. Is the easiest way to convert them to load them back onto the checkpoint, convert and back again into splunk (either by solitary file or into a temp directory). The problem i suppose is all my logs are in binary format.

Many thanks

[treyka]

fw log -p -n -l -o [logfile] should give you what you want - but refer to Checkpoint's documentation to be sure.

[treyka]

On your Checkpoint side I recommend that you use the 'fw log' command to dump each logfile to text. (Checkpoint natively stores its logs in a binary format.) Use a little shell globbing and a for loop and you should be able to easily get these into text format. Scp to your Splunk server and go with Brian's option #2.

Cheers, --Trey

[Brian_Osburn]

I can speak to the importing portion of the question.

There's several different ways you can import the logs:

1. You can pull the logs down from the Firewall and do a manual import into Splunk
2. You can pull the logs over to a temp directory on the Splunk server itself and set up an input to feed those files into Splunk.

I'd go with option #2, as this will probably be the quickest way to achieve what you want. When you're done, you can either nuke the input settings or leave them there in case you want to do this again.

Brian