Security

How can I validate the logging of successful connections to Edge Firewall

AJeepDude
New Member

Our firewall team has told us that they have turned on logging for successful connection for edge firewall. How can you validate this is true in Splunk?

The edge firewalls are a combination of Cisco ASA's and Checkpoints

Thank You

0 Karma

xavierashe
Contributor

I would just keep it simple. Look for your own username in the raw log.

index=firewalls "AJeepDude"

Once you find the right event, look at it in verbose mode and make sure the user=AJeepDude. If you care about CIM, then check the tags.

0 Karma

georgen_splunk
Splunk Employee
Splunk Employee

here's a nice search to validate your Check Point FW event data is successfully indexing FW event logs:

index=_internal host= source="splunk_ta_checkpoint-opseclea_modinput.log" "Successfully indexed events:" |rex field=_raw "Successfully indexed events:\s(?.*)" |timechart span=600s sum(EVENT_COUNT) by connection

0 Karma
Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...