Is anyone parsing Checkpoint Audit Logs succesfully?

[david_waugh]

Hi is anyone successfully collecting Checkpoint Audit logs in Netwitness 10.6.5 or higher?

I have a case open with Support at the moment. Security logs are captured fine but Audit logs dont seem to be being collected.

If I run the NwCheckpointProcess with the --odebug flag i can see the logs phyiscally arriving at the log collector. However, from there they never make it into the GUI, even though the Security Logs do make it through.

The internal case refrence is 01116330 if anyone want to see.

[ThomasFedorchuk]

Hi David,

I'm collecting CP Audit logs in my lab... (SA 10.6.5 / CP R76).

The Audit logs are parsing and showing as msg.id "checkpoint_event" and Event Category Name "other.default".

[david_waugh · Accepted solution]

Thanks Thomas.

I found out the problem on my side.

I had set up the collection of Audit logs using a persistent connection (polling interval -1). This tends to batch events before forwarding them, so for a low level of audit logs it delayed them being sent through.

The next problem when they did come through was that they were not being parsed with the out of the box Check Point parser. For example the CheckPoint logs contains Administrator=myadminstrator.

With the out of the box parser this is being put into the Administrator meta key which may not be defined. I redefined it so that it put it into the username field. Then the name of the administrators showed up.

There is quite a lot of customisation needed in table-map-custom.xml to get parsed entries to actually show in the GUI.