What is an Event?

An event is a record of a security incident. It is based on one or more logs, and on rules that are defined in the Event Policy Set of rules that define the behavior of SmartEvent..

An example of an event Record of a security or network incident that is based on one or more logs, and on a customizable set of rules that are defined in the Event Policy. that is based on one log: A High Severity Anti-Bot Check Point Software Blade on a Security Gateway that blocks botnet behavior and communication to Command and Control (C&C) centers. Acronyms: AB, ABOT. event. One Anti-Bot log with a Severity of High causes the event to be recorded.

An example of an event that is based on more than one log: A Certificate Sharing event. Two login logs with the same certificate and a different user cause the event to be recorded.

How Are Logs Converted to Events?

SmartEvent automatically defines logs that are not Firewall, VPN, or HTTPS Inspection Feature on a Security Gateway that inspects traffic encrypted by the Secure Sockets Layer (SSL) protocol for malware or suspicious patterns. Synonym: SSL Inspection. Acronyms: HTTPSI, HTTPSi. logs, as events.

Events that are based on a suspicious pattern of one or more logs, are created by the SmartEvent Correlation Unit SmartEvent software component on a SmartEvent Server that analyzes logs and detects events.. These correlated events are defined in the SmartEvent client GUI, in the Policy tab.

Most logs are Firewall, VPN and HTTPS inspection logs. Therefore, SmartEvent does not define them as events by default to avoid a performance impact on the SmartEvent Server Dedicated Check Point server with the enabled SmartEvent Software Blade that hosts the events database..

For logs from Security Gateways R77.X and lower: To create events for Firewall, in the SmartEvent Policy tab, enable Consolidated Sessions > Firewall Session.