I am collecting Firewall logs using OPSEC Lea app. This add on is setup on Heavyforwarder. App is setup correctly and logs are coming onto HF but I am unable to view them on Search head. HF has connectivity to indexers is sending internal logs and other application related to indexers. How do I check what is wrong with Checkpoint logs ?
Yes App is pulling logs and I did test is by enabling index and forward setting on HF. No errors or Warning in app logs and index is created correctly. I do see logs data transfer for this checkpoint on metrics.log also under _internal index. Unfortunately im unable to past
Did you check that the app on HF actually pulls the logs? Did you check the app's logs? Do you have proper index configured in your input?