search

elastic / integrations

Elastic Integrations
https://www.elastic.co/integrations
Other
200 stars 431 forks source link

[Check Point] Improved Documentation #5113

Closed jamiehynds closed 1 year ago

jamiehynds commented 1 year ago

Our Check Point integration does not follow our documentation guidelines and needs to be updated to ensure users can successfully configure the integration. Our documentation can be based on the steps to configure Checkpoint's current R81 OS - no need to focus on steps for EOL OS such as R80 and R77.

I'll can get a marketing blurb from Check Point, but the biggest gap in our docs is the configuration steps on the Log Exporter side. We need to make clear, the steps involved on the Log Exporter side to syslog out to an Elastic Agent. We need to make it clear which syslog formats we support, and how to configure Secure Syslog (over TLS).

High level steps (needs refinement):

  1. Install Elastic Agent on a host between your Check Point Log Exporter instance and Elastic Cluster. The agent will be used to receive syslog from Check Point firewalls and ship to Elastic.
  2. Create a new Log Exporter/SIEM object in Check Point SmartConsole. Set the target server and target port to the Elastic Agent IP address and port number. Set the protocol to UDP or TCP, Elastic's integration supports both. Set the format to syslog, JSON??
  3. Configure the Management Server or Dedicated Log Server object in SmartConsole.
  4. Install the database within SmartConsole (steps included in the Checkpoint docs linked above)
  5. Within Kibana, browse to Integrations and locate the Check Point integration, and 'Add Check Point'
  6. Configure the TCP or UDP input, depending on the protocol you configured Check Point to use.
  7. Add certificate if using Secure Syslog over TCP with TLS (optional)
  8. Add integration to a New/Existing policy.
  9. Browse to dashboard/discover to validate data is flowing from Check Point.

We also list 'firewall' as the supported dataset - do we support all events from Check Point firewalls, if so this should be clearly stated. If not, we need to list the broad categories of events we support.

elasticmachine commented 1 year ago

Pinging @elastic/security-external-integrations (Team:Security-External Integrations)