Event Forwarding
Introduction
Event Forwarding is an easy and secure procedure to export Infinity Portal data over the Syslog protocol. You can forward logs, events, and saved application data from your Check Point Infinity Portal account to a SIEM (Security Information and Event Management) provider, such as Splunk, QRadar, or ArcSight. The SIEM server processes large amounts of data and shows it in dashboards or notifications. To set up Event Forwarding, you must use certificates to establish secure communication between the Infinity Portal and your SIEM server.
Use Case
A typical use case is an organization that uses a number of security vendors, along with Check Point, to protect itself from cyber attacks. The organization uses an external analytics platform to see all data from every vendor in a single pane of glass.
Prerequisite
The SIEM server must support TLS 1.2.
The OpenSSL CLI must be installed on your computer.
Glossary
File |
Description |
---|---|
|
Private key |
|
Public key |
|
Certificate Sign Request. |
|
File you create when you sign the |
|
If you use an existing Domain Certificate, this file contains the |
Configuration
If you already have a <CA>.key
file and a <CA>.pem
file, then skip this step.
If you do not have a <CA>.key
file and a <CA>.pem
file, follow one of these procedures to prepare your organization's Domain Certificate:
-
On your computer, in OpenSSL CLI, generate a Client CA:
-
Create the
<CA>.key
file:openssl genrsa -out <CA>.key 2048
-
Create
<CA>.pem
file:openssl req -x509 -new -nodes -key <CA>.key -sha256 -days 825 -out <CA>.pem
-
-
On your computer, in the OpenSSL CLI, create a certificate for the SIEM server:
-
Create a key for the SIEM server:
openssl genrsa -out <SERVER>.key 2048
-
Generate a
.csr
file for the SIEM server:openssl req -new -key <SERVER>.key -out <SERVER>.csr
-
Generate a Client Certificate (
.crt
) file for the SIEM server. To do this, sign the.csr
file with the<CA>.pem
file and the<SERVER>.key
file:openssl x509 -req -in <SERVER>.csr -CA <CA>.pem -CAkey <CA>.key -CAcreateserial -out <SERVER>.crt -days 825 -sha256
-
-
Install your SIEM server certificate, SIEM server key, and the CA on your SIEM server (examples: Splunk, Syslog, QRadar).
-
In the configuration of the SIEM server, define the
<CA>.pem
file as a trusted certificate.
If you already have a .pfx
file, then use this method.
Prerequisites:
-
The
.pfx
file that contains the<CA>.key
file and the<CA>.pem
file. -
The passphrase of the
.pfx
file.
Procedure
Do these steps in OpenSSL CLI on your computer:
-
Extract the
<CA>.pem
file from the.pfx
file:openssl pkcs12 -in <CERTIFICATE>.pfx -out <CA>.pem –nodes
-
Extract the
<CA>.key
file from the.pfx
file:openssl pkcs12 -in <CERTIFICATE>.pfx -nocerts -out <CA>.key
-
Remove the passphrase from the
<CA>.key
file:openssl rsa -in <CA>.key -out <my-key-nopass>.key
On your SIEM server, open a dedicated port to receive logs from Event Forwarding.
Region |
IP Addresses |
Port |
---|---|---|
EU |
|
No specific port required |
AUS |
|
No specific port required |
US |
|
No specific port required |
UAE |
|
514 |
A Destination object in the Infinity Portal defines a connection between the Infinity Portal and a SIEM server.
After you configure a Destination for your SIEM server, you can review, edit, search, and delete the destination(s) in the Manage Destinations window. For more information, see Managing Destinations.
-
In the Infinity Portal, click > Event Forwarding.
-
Click Create Destination /Manage Destinations.
The Create Destination / Manage Destinations window opens.
-
Click + ADD DESTINATION.
The New Destination window opens.
-
In the field at the top of the New Destination window, enter a name for the destination.
The General tab opens.
-
In the Host field, enter the address of the SIEM server as an IP address or FQDN.
-
In the Port field, enter the port to use for the SIEM server.
Note - Below the Port field, default configurations appear. You cannot change these configurations:
-
Type - The type of logs that your external analytics platform receives. Currently, only Syslog is supported.
-
Protocol - The communication protocol. Currently, only TCP is supported.
-
Encryption - The encryption protocol. Currently, only mutual TLS is supported.
-
-
Click Next.
The Certificates tab opens.
For this step, keep the Certificates tab of the Infinity Portal open and keep the SIEM server active. Follow the numbered workflow in the Certificates tab in the Infinity Portal.
-
Client Certification Sign Request (
.csr
file)-
In the Infinity Portal, click Certificate Sign Request.
Your web browser downloads the Infinity Portal's
.csr
file to your computer. -
On your computer, use the OpenSSL command line to open the
.csr
file. -
On your computer, use the
openssl x509
command to sign the downloaded Client Certificate. To do this, it is necessary to enter your private and public keys.Note - Make sure you are in the same working folder as the
<CA>.key
and<CA>.pem
files.openssl x509 -req -in <CERTIFICATE>.csr -CA <CA>.pem -CAkey <CA>.key -CAcreateserial -out <YOUR-CERTIFICATE>.crt -days 825 -sha256
-
-
Client Certificate (
.crt
file)-
In the Infinity Portal, click Browse and upload the signed Client Certificate (
.crt
file).
Best Practice - For a more secure connection, Check Point recommends to also upload the signed Client Certificate (
.crt
file) to your SIEM server. -
-
Certificate Authority (CA) certificate (
.pem
file)-
Click Browse and upload the CA certificate (
<CA>.pem
).
-
-
Test Connectivity
This is to confirm that the server communicates with
Event Forwarding
and thatEvent Forwarding
is not impersonated by an attacker.Important - In a first-time configuration, you must do a successful test before you can continue configuring
Event Forwarding.
-
Click Test Connectivity.
If the connection is successful, then Connect successfully appears.
If the connection is not successful, then one ore more of these error messages appears:
Error MessagesError Message
Resolution
TLS certificates mismatch
-
Download the
.csr
file again. -
Re-sign the
.csr
file. -
Upload the
.crt
file. -
Upload the
<CA>.pem
file.
Connection Time Out
Make sure that:
-
In the SIEM server settings, the relevant port and IP address are open.
-
You server has the maximum number of TCP connections allowed.
-
If there is a firewall, make sure the firewall does not block the relevant port and IP address.
Destination self-signed certificates validation failed
Make sure the CA certificate you used to sign the .
csr
file is installed on your SIEM serverCould not connect to destination
-
Make sure your firewall does not block the connection.
-
Make sure your SIEM server settings are correct and that the relevant ports and IP address are open.
-
-
-
Click Finish.
A Forwarding rule is a set of conditions for data forwarding from the Infinity Portal to a SIEM server.
To create a forwarding rule:
-
Click the [+] icon or the + Add button.
The New Forwarding Rule window opens.
-
Fill the relevant fields.
-
Click Create.
Managing Destinations
After you configure destination(s) for an external-analytics platform, you can review, edit, delete, and search them in the Manage Destinations window.
In the Manage Destinations window, on the left pane, select the name of the destination. The right pane shows the settings for the destination and the rules that use the destination.
-
In the Destinations window, on the left pane, select the destination's name.
-
Click the edit icon .
The Edit Destination window opens.
-
Change the settings as necessary.
-
Click Apply.
-
Click Close.
-
In the Manage Destinations window, on the left pane, select the destination's name.
-
Make sure that no rule uses this destination. A destination cannot be deleted if it corresponds to a rule.
If there is no destination configured with the Used by Rule, then the right pane is empty. If some rules use the destination, replace the destination or delete the rules.
-
Click the delete icon.
-
In the Manage Destinations window, in the search field, start to enter the destination's name.
A list of destinations opens.
-
Click the destination to see more details about the configuration.
-
To exit, click Close.
Managing Forwarding Rules
On the Events page, Forwarding Rules show with the rule name, the services you forward data from, and the name of the destination to which you forward the data.
To add a new Forwarding Rule:
Click the [+] icon or the + Add.
To edit a Forwarding Rule
Put the cursor on the rule and click , then select Edit. Change the rule settings as necessary.
To delete a Forwarding Rule
Put the cursor on the rule and click , then select Delete.