Initial Configuration

SmartEvent and SmartReporter components require secure internal communication (SIC) with the Management server, either a Security Management Server or a Domain Management Server.

Once connectivity is established, install SmartEvent and SmartReporter and perform the initial configuration.

Check Point Licenses

Check Point software is activated with a License Key. You can obtain this License Key by registering the Certificate Key that appears on the back of the software media pack, in the Check Point User Center.

The Certificate Key is used in order to receive a License Key for products that you are evaluating.

In order to purchase the required Check Point products, contact your reseller.

Check Point software that has not yet been purchased will work for a period of 15 days. You are required to go through the User Center in order to register this software.

1. Activate the Certificate Key shown on the back of the media pack via Check Point User Center.

   The Certificate Key activation process consists of:

   • Adding the Certificate Key
   • Activating the products
   • Choosing the type of license
   • Entering the software details

   Once this process is complete, a License Key is created and made available to you.

2. Once you have a new License Key, you can start the installation and configuration process. During this process, you will be required to:
   • Read the End Users License Agreement and if you accept it, select Yes.
   • Import the license that you obtained from the User Center for the product that you are installing.

   Licenses are imported via the Check Point Configuration Tool.

   The License Keys tie the product license to the IP address of the SmartEvent server. This means that:

   • Only one IP address is needed for all licenses.
   • All licenses are installed on the SmartEvent server.

Initial Configuration of the SmartEvent Client

The final stage of getting started with SmartEvent is the initial configuration of the SmartEvent clients. The SmartEvent client is part of the Check Point SmartConsole.

• Define the Internal Network
• Install the Event Policy

Events will begin to appear in the SmartEvent client.

Enabling Connectivity with Multi-Domain Security Management

In a Multi-Domain Security Management environment, the SmartEvent server can be configured to analyze the log information for any or all of the Domain Management Servers on the Multi-Domain Server. In order to do this, the SmartEvent server database must contain all of the network objects from each of the Domain Management Servers and then be configured to gather logs from the selected log servers.

Installing the Network Objects in the SmartEvent Database

1. From the SmartDomain Manager, open the Global SmartDashboard.
2. In the Global SmartDashboard, create a Host object for the SmartEvent server.
3. Configure the object as a SmartEvent server and Log server.
4. Save the Global Policy.
5. Close the Global SmartDashboard.
6. In the Multi-Domain Security Management client, assign the Global Policy to the Domains with which you will use SmartEvent.

Configuring SmartEvent to work with Multi-Domain Security Management

1. In the SmartEvent client, select Policy > General Settings > Objects > Domains and add all of the Domains you will be working.

   Objects will be synchronized from the Domain Management Servers – this may take some time.

2. Select Policy > General Settings > Objects > Network Objects, and add networks and hosts that are not defined in the Domain Management Servers.
3. Select Policy > General Settings > Initial Settings > Internal Network, and add the networks and hosts that are part of the Internal Network.
4. Select Policy > General Settings > Initial Settings > Correlation Units, click Add and select the SmartEvent Correlation Unit and its Log servers. For traffic logs, select the relevant Domain Log Server or Multi-Domain Log Server. For audit logs, select the relevant Domain Management Server.
5. Install the Event Policy.