Overview

Check Point Log Exporter is a method to export Check Point logs over syslog in R80.20 and higher management. For information on deployment in R77.30 and R80.10 servers, see sk122323.

The Check Point App for Splunk uses the Log Exporter to seamlessly send logs from your Check Point Log Server to your Splunk server. This enables you to collect and analyze millions of logs from all Check Point technologies and platforms. For more information, see the App for Splunk User Guide.

Log Exporter supports:

• SIEM applications: Splunk\Arcsight\RSA\LogRhythm\QRadar\McAfee\rsyslog\ng-syslog and any other SIEM application that can run a syslog agent.
• Protocols: Syslog over TCP or UDP.
• Formats: Syslog, CEF, LEEF, Generic, Splunk.
• Read-Mode: Raw, Semi-Unified
• Security: Mutual authentication TLS.
• Types: Security logs, Audit logs.
• Filtering: Log Exporter currently enables you to filter for (not export) firewall connections logs only.