Hi splunkers, I need to enrich the Checkpoint Firewall logs with the username in my corporate VPN logs. On a first sourcetype, I have the name of the user with his DHCP IP address in the VPN (field name : office_mode_ip). On a second sourcetype, I have the firewall traffic log with this same DHCP IP (field name : src). The DHCP has a 10h lease. I do not find how to get the associated user for each Firewall log. How can i make a join over the same time range to avoid error on DHCP lease change? The first log with login details ==> user=Alain DUBOIS 123 (Alain.dubois@mydomain.com), office_mode_ip=10.245.131.237 time=1570087243|loc=1589977|fileid=1570053600|action=authcrypt|orig=0.0.0.0|i/f_dir=inbound|has_accounting=0|logId=-1|log_type=log|log_sequence_num=119|is_first_for_luuid=0|log_version=5|origin_sic_name=CN=FW_VPN01,O=vu.jmsp.prod.sq5ad5|uuid=<5d95a14b,00000000,0140a30a,0000116d>|product=xxxxxxxx|cvpn_category=Session|event_type=Login|client_name=Check Point Mobile|client_version=xxxxx|client_build=xxxxxxx|user=Alain DUBOIS 123 (Alain.dubois@mydomain.com)|auth_method=Password|login_option=Authentification IPSEC|failed_login_factor_num=0|user_dn=CN=Dominique ROBERT 841,OU=Administrateurs,OU=W7,OU=841-Utilisateurs,DC=mydomain,DC=com|user_group=GrpLDAP_VPNSSL, ad_group_VPNSSL_238285|host_type=PC|os_name=Windows|os_version=10|os_build=17763|os_bits=64bit|device_identification={xxxxxxxxxxxxxxxxxxxxxxxxxxx}|session_timeout=10:00:00|login_timestamp= 3Oct2019 9:20:43|src=aa.bb.cc.dd|host_ip=192.168.1.212|office_mode_ip=10.245.131.237|s_port=0|proto=tcp|service=443|tunnel_protocol=IPSec|methods:=3DES + SHA1|status=Success|Suppressed_Logs=0|mac_address=50:76:af:3a:eb:57|Hostname=p0006841|domain_name=mydomain.com|auth_encryption_methods=AES-256 + SHA1 + Group 2 then, the second sourcetype with src=10.245.131.237 time=1570087396|loc=1622048|fileid=1570053600|action=decrypt|orig=aa.bb.cc.dd|i/f_dir=inbound|i/f_name=wrp193|has_accounting=0|logId=0|log_type=connection|log_sequence_num=52|is_first_for_luuid=131072|log_version=5|origin_sic_name=CN=FW_VPN01,O=vu.jmsp.jmsp.prod.sq5ad5|uuid=<5d95a1e4,00000009,0140a30a,c0001800>|product=VPN-1 & FireWall-1|__policy_id_tag=product=VPN-1 & FireWall-1[db_tag={xxxxxxxxxxxxxxxxxxxxxxxxx};mgmt=xxxxxxx;date=1570034884;policy_name=Regles_VS_VPN01]|inzone=External|outzone=Internal|service_id=cp_tcp_xxxxxxxxxx|src=10.245.131.237|s_port=49438|dst=10.160.16.247|service=10123|proto=tcp|scheme:=IKE|methods:=ESP: 3DES + SHA1|peer gateway=10.245.131.237|community=RemoteAccess|fw_subproduct=VPN-1|vpn_feature_name=VPN|LastUpdateTime= 3Oct2019 9:23:16|match_id=19|match_table.match_id=19|layer_uuid=129b5909-9ae6-48d5-8ee6-0dfb64ca827f|match_table.layer_uuid=129b5909-9ae6-48d5-8ee6-0dfb64ca827f|layer_name=Regles_VS_VPN01 Network|match_table.layer_name=Regles_VS_VPN01 Network|rule_uid=fbe622a8-fa24-4fe1-b372-bc63f23eb6f9|match_table.rule_uid=fbe622a8-fa24-4fe1-b372-bc63f23eb6f9|rule_name=Flux nomades|match_table.rule_name=Flux |rule_action=2|match_table.rule_action=2|parent_rule=0 I can get a real time list of DHCP adress affected with index="checkpoint_vpnssl" event_type=Login | stats latest(user_dn) by office_mode_ip , but how to link each fw log and this result in a way to have updated couple of user / IP? Any idees ? Thanks ... View more

Hi splunkers, I got problem to get logs from a Smart Event server. The infrastructure I try to connect is : FW1 and FW2 sends logs to SmartEvent directly. They are managed with a Smart Console. Smart Event and Smart Console are different server. This infrastructure is single domain. When I connect directly to the smart console, Everything is OK, I get the console logs. When connecting to the SmartEvent, no connexion! This is the config file (splunk/etc/apps/Splunk_TA_checkpoint-opseclea/local/opseclea_connection.conf) of the LEA connector is : [Connector_SSL_SmartEvent] cert_name = Connector_SSL_SmartEvent_1874929942.p12 fw_version = R80 lea_app_name = Splunk_LEA2 lea_object_name = SmartEvent lea_server_auth_port = 18184 lea_server_auth_type = sslca lea_server_ip = 192.168.130.6 lea_server_type = dedicated management_server_ip = 192.168.130.4 opsec_entity_sic_name = CN=SmartEvent,O=SmartConsole.jmsp.prod.sq5ad5 opsec_sic_name = CN=Splunk_LEA2,O=SmartConsole.jmsp.prod.sq5ad5 When I try to connect to the smart event, I got the folowing opsec logs (index=_internal source=ta_checkpoint-opseclea😞 2019-07-25 08:55:15,080 +0000 log_level=INFO, pid=25947, tid=Thread-9, file=ta_opseclea_data_collector.py, func_name=get_logs, code_line_no=75 | [input_name="VPN-SSL_SmartEvent" connection="Connector_SSL_SmartEvent" data="non_audit"][ 173840512][25 Jul 10:55:15] get_pkxld_path: cpshared_filename failed 2019-07-25 08:55:13,821 +0000 log_level=INFO, pid=25947, tid=Thread-9, file=ta_opseclea_data_collector.py, func_name=get_logs, code_line_no=75 | [input_name="VPN-SSL_SmartEvent" connection="Connector_SSL_SmartEvent" data="non_audit"]log_level=2 file:lea_loggrabber.cpp func_name:get_fw1_logfiles code_line_no:2553 :INFO: Successfully create session 2019-07-25 08:55:13,821 +0000 log_level=INFO, pid=25947, tid=Thread-9, file=ta_opseclea_data_collector.py, func_name=get_logs, code_line_no=75 | [input_name="VPN-SSL_SmartEvent" connection="Connector_SSL_SmartEvent" data="non_audit"]log_level=2 file:lea_loggrabber.cpp func_name:get_fw1_logfiles code_line_no:2535 :INFO: Successfully initialize client/server-pair 2019-07-25 08:55:13,820 +0000 log_level=INFO, pid=25947, tid=Thread-9, file=ta_opseclea_data_collector.py, func_name=get_logs, code_line_no=75 | [input_name="VPN-SSL_SmartEvent" connection="Connector_SSL_SmartEvent" data="non_audit"]log_level=2 file:lea_loggrabber.cpp func_name:get_fw1_logfiles code_line_no:2506 :INFO: Successfully create opsec environment 2019-07-25 08:55:13,808 +0000 log_level=INFO, pid=25947, tid=Thread-5, file=ta_opseclea_data_collector.py, func_name=start_lea_loggrabber, code_line_no=337 | [input_name="VPN-SSL_SmartEvent" connection="Connector_SSL_SmartEvent" data="non_audit"] Starting /data/splunk/etc/apps/Splunk_TA_checkpoint-opseclea/bin/../bin/lea_loggrabber --data non_audit --debug_level 2 --appname Splunk_TA_checkpoint-opseclea --lea_server_ip 10.251.130.6 --lea_server_auth_port 18184 --lea_server_auth_type sslca --opsec_sslca_file /data/splunk/etc/apps/Splunk_TA_checkpoint-opseclea/certs/Connector_SSL_SmartEvent_1874929942.p12 --opsec_sic_name CN=Splunk_LEA2,O=SmartConsole.jmsp.prod.sq5ad5 --opsec_entity_sic_name CN=SmartEvent,O=SmartConsole.jmsp.prod.sq5ad5 --online --no_resolve Does somebody successfully get logs from smart event ? Thank's a lot. Olivier. ... View more

Hi, I parsed a lot of post on splunk answers, but I still have a problem to filter a specific sourcetype. Here the log line I want to trash Sep 11 16:16:08 192.168.24.35 ROOT_FW_2: NetScreen device_id=ROOT_FW_2 [Root]system-notification-00257(traffic): start_time="2017-09-11 16:15:51" duration=16 policy_id=86 service=smtp (tcp) proto=6 src zone=zone_in dst zone=zone_out action=Permit sent=22056 rcvd=1284 src=192.168.1.1 dst=192.168.10.10 src_port=40049 dst_port=80 src-xlated ip=192.168.100.5 port=40049 dst-xlated ip=10.25.23.55 port=80 session_id=1015055 reason=Close - TCP FIN On my Formwarder: $SPLUNK_HOME/etc/system/local/props.conf # Filtrage de tout sauf les accept [JuniperFW] TRANSFORMS-Juniper-null = remove_juniper_permit $SPLUNK_HOME/etc/system/local/transform.conf # Accepter tout sauf les Permit [remove_juniper_permit] REGEX = action=Permit DEST_KEY = queue FORMAT = nullQueue Splunkd was restarted with no stanza errors My Splunk version is 6.6.3. Does anyone should have de clue or a way to debug this ? Thank's a lot. ... View more