Mengumpulkan log firewall Check Point

Didukung di:

Dokumen ini menjelaskan cara menyerap log firewall Check Point ke Google Security Operations menggunakan agen Bindplane.

Firewall Check Point membuat log untuk koneksi jaringan, peristiwa keamanan, aktivitas VPN, pencegahan ancaman, dan operasi administratif. Parser mengekstrak kolom nilai kunci dan CEF, lalu memetakannya ke Model Data Terpadu (UDM).

Sebelum memulai

Pastikan Anda memiliki prasyarat berikut:

  • Instance Google SecOps
  • Windows Server 2016 atau yang lebih baru, atau host Linux dengan systemd
  • Konektivitas jaringan antara agen Bindplane dan firewall Check Point
  • Jika beroperasi dari balik proxy, pastikan port firewall terbuka sesuai dengan persyaratan agen Bindplane
  • Akses istimewa ke UI firewall Check Point

Mendapatkan file autentikasi penyerapan Google SecOps

  1. Login ke konsol Google SecOps.
  2. Buka Setelan SIEM > Agen Pengumpulan.
  3. Download File Autentikasi Penyerapan

  4. Simpan file dengan aman di sistem tempat agen BindPlane akan diinstal.

Mendapatkan ID pelanggan Google SecOps

  1. Login ke konsol Google SecOps.
  2. Buka Setelan SIEM > Profil.

  3. Salin dan simpan ID Pelanggan dari bagian Detail Organisasi.

Menginstal agen Bindplane

Instal agen Bindplane di sistem operasi Windows atau Linux Anda sesuai dengan petunjuk berikut.

Penginstalan Windows

  1. Buka Command Prompt atau PowerShell sebagai administrator.

  2. Jalankan perintah berikut:

    msiexec /i "https://github.com/observIQ/bindplane-agent/releases/latest/download/observiq-otel-collector.msi" /quiet

  3. Tunggu hingga penginstalan selesai.

  4. Verifikasi penginstalan dengan menjalankan:

    sc query observiq-otel-collector

    Layanan akan ditampilkan sebagai RUNNING.

Penginstalan Linux

  1. Buka terminal dengan hak istimewa root atau sudo.

  2. Jalankan perintah berikut:

    sudo sh -c "$(curl -fsSlL https://github.com/observiq/bindplane-agent/releases/latest/download/install_unix.sh)" install_unix.sh

  3. Tunggu hingga penginstalan selesai.

  4. Verifikasi penginstalan dengan menjalankan:

    sudo systemctl status observiq-otel-collector

    Layanan akan ditampilkan sebagai aktif (berjalan).

Referensi penginstalan tambahan

Untuk opsi penginstalan dan pemecahan masalah tambahan, lihat Panduan penginstalan agen BindPlane.

Mengonfigurasi agen Bindplane untuk menyerap syslog dan mengirimkannya ke Google SecOps

Cari file konfigurasi

  • Linux:

    sudo nano /etc/bindplane-agent/config.yaml

  • Windows:

    notepad "C:\Program Files\observIQ OpenTelemetry Collector\config.yaml"

Edit file konfigurasi

  • Ganti seluruh konten config.yaml dengan konfigurasi berikut:

    receivers:
    udplog:
        listen_address: "0.0.0.0:514"

exporters:
    chronicle/checkpoint_firewall:
        compression: gzip
        creds_file_path: '/etc/bindplane-agent/ingestion-auth.json'
        customer_id: '<customer_id>'
        endpoint: malachiteingestion-pa.googleapis.com
        log_type: CHECKPOINT_FIREWALL
        raw_log_field: body

service:
    pipelines:
        logs/checkpoint_firewall_to_chronicle:
            receivers:
                - udplog
            exporters:
                - chronicle/checkpoint_firewall

Parameter konfigurasi

Ganti placeholder berikut:

  • Konfigurasi penerima:

    • listen_address: Alamat IP dan port yang akan diproses:
      • 0.0.0.0 untuk mendengarkan di semua antarmuka (direkomendasikan)
      • Port 514 adalah port syslog standar (memerlukan root di Linux; gunakan 1514 untuk non-root)

  • Konfigurasi eksportir:

    • creds_file_path: Jalur lengkap ke file autentikasi penyerapan:
      • Linux: /etc/bindplane-agent/ingestion-auth.json
      • Windows: C:\Program Files\observIQ OpenTelemetry Collector\ingestion-auth.json
    • customer_id: ID Pelanggan yang disalin dari konsol Google SecOps
    • endpoint: URL endpoint regional:
      • Amerika Serikat: malachiteingestion-pa.googleapis.com
      • Eropa: europe-malachiteingestion-pa.googleapis.com
      • Asia: asia-southeast1-malachiteingestion-pa.googleapis.com
      • Lihat Endpoint Regional untuk mengetahui daftar lengkapnya

Simpan file konfigurasi

  • Setelah mengedit, simpan file:
    • Linux: Tekan Ctrl+O, lalu Enter, lalu Ctrl+X
    • Windows: Klik File > Save

Mulai ulang agen Bindplane untuk menerapkan perubahan

  • Untuk memulai ulang agen Bindplane di Linux, jalankan perintah berikut:

    sudo systemctl restart observiq-otel-collector

    1. Pastikan layanan sedang berjalan:

      ```bash
sudo systemctl status observiq-otel-collector
```

    2. Periksa log untuk mengetahui error:

      ```bash
sudo journalctl -u observiq-otel-collector -f
```

  • Untuk memulai ulang agen Bindplane di Windows, pilih salah satu opsi berikut:

    • Command Prompt atau PowerShell sebagai administrator:

      net stop observiq-otel-collector && net start observiq-otel-collector

    • Konsol layanan:

      1. Tekan Win+R, ketik services.msc, lalu tekan Enter.
      2. Temukan observIQ OpenTelemetry Collector.
      3. Klik kanan, lalu pilih Mulai Ulang.

      4. Pastikan layanan sedang berjalan:

        sc query observiq-otel-collector

      5. Periksa log untuk mengetahui error:

        type "C:\Program Files\observIQ OpenTelemetry Collector\log\collector.log"

Mengonfigurasi ekspor syslog di firewall Check Point

  1. Login ke UI firewall Check Point menggunakan akun istimewa.
  2. Buka Logs & Monitoring > Log Servers.
  3. Buka Syslog Servers.
  4. Klik Konfigurasi, lalu tetapkan nilai berikut:
    • Protocol: Pilih UDP untuk mengirim log keamanan dan/atau log sistem.
    • Name: Berikan nama unik (misalnya, Bindplane_Server).
    • Alamat IP: Berikan alamat IP server syslog Anda (IP Bindplane).
    • Port: Berikan port server syslog Anda (port Bindplane).
  5. Pilih Aktifkan server log.
  6. Pilih log yang akan diteruskan: Log sistem dan keamanan.
  7. Klik Terapkan.

Tabel pemetaan UDM

| proto | event.idm.read_only_udm.network.application_protocol | Dipetakan dari log perubahan | | helo | event.idm.read_only_udm.additional.fields | Dipetakan dari log perubahan | | inner_syslog_priority | event.idm.read_only_udm.additional.fields | Dipetakan dari log perubahan | | principal_ip | event.idm.read_only_udm.principal.ip dan event.idm.read_only_udm.principal.asset.ip | Dipetakan dari log perubahan | | syslog_priority | event.idm.read_only_udm.additional.fields | Dipetakan dari log perubahan | | creation_time | event.idm.read_only_udm.metadata.event_timestamp | Dipetakan dari log perubahan | | last_hit_time | event.idm.read_only_udm.security_result.last_discovered_time | Dipetakan dari log perubahan | | update_count | event.idm.read_only_udm.additional.fields | Dipetakan dari log perubahan | | devTime | event.idm.read_only_udm.additional.fields | Dipetakan dari log perubahan | | queue_id | event.idm.read_only_udm.additional.fields | Dipetakan dari log perubahan | | process | event.idm.read_only_udm.additional.fields | Dipetakan dari log perubahan | | from_host | event.idm.read_only_udm.principal.hostname | Dipetakan dari log perubahan | | from_host | event.idm.read_only_udm.principal.asset.hostname | Dipetakan dari log perubahan | | from_ip | event.idm.read_only_udm.principal.ip | Dipetakan dari log perubahan | | from_ip | event.idm.read_only_udm.principal.asset.ip | Dipetakan dari log perubahan | | email_from | event.idm.read_only_udm.network.email.from | Dipetakan dari log perubahan | | email_to | event.idm.read_only_udm.network.email.to | Dipetakan dari log perubahan | | protocol | event.idm.read_only_udm.network.application_protocol | Dipetakan dari log perubahan | | program | event.idm.read_only_udm.target.application | Dipetakan dari log perubahan | | syslog_host | event.idm.read_only_udm.intermediary.ip | Dipetakan dari log perubahan | | icmp_type | event.idm.read_only_udm.additional.fields | Dipetakan dari log perubahan | | icmp_code | event.idm.read_only_udm.additional.fields | Dipetakan dari log perubahan | | precise_error | event.idm.read_only_udm.security_result.description | Dipetakan dari log perubahan | | action_reason | event.idm.read_only_udm.security_result.detection_fields | Dipetakan dari log perubahan | | alert | event.idm.read_only_udm.security_result.detection_fields | Dipetakan dari log perubahan | | message_type | event.idm.read_only_udm.security_result.detection_fields | Dipetakan dari log perubahan | | UP_match_table | event.idm.read_only_udm.security_result.detection_fields | Dipetakan dari log perubahan | | UP_match_table_2 | event.idm.read_only_udm.security_result.detection_fields | Dipetakan dari log perubahan | | ROW_START | event.idm.read_only_udm.security_result.detection_fields | Dipetakan dari log perubahan | | ROW_START_2 | event.idm.read_only_udm.security_result.detection_fields | Dipetakan dari log perubahan | | match_id_2 | event.idm.read_only_udm.security_result.detection_fields | Dipetakan dari log perubahan | | ROW_END | event.idm.read_only_udm.security_result.detection_fields | Dipetakan dari log perubahan | | ROW_END_2 | event.idm.read_only_udm.security_result.detection_fields | Dipetakan dari log perubahan | | layer_uuid_2 | event.idm.read_only_udm.security_result.detection_fields | Dipetakan dari log perubahan | | layer_name_2 | event.idm.read_only_udm.security_result.detection_fields | Dipetakan dari log perubahan | | rule_uid_2 | event.idm.read_only_udm.security_result.detection_fields | Dipetakan dari log perubahan | | rule_name_2 | event.idm.read_only_udm.security_result.detection_fields | Dipetakan dari log perubahan | | dst_dynobj_name | event.idm.read_only_udm.target.resource.name | Dipetakan dari log perubahan | | dst_object_type | event.idm.read_only_udm.target.resource.attribute.labels | Dipetakan dari log perubahan | | version | event.idm.read_only_udm.intermediary.platform_version | Dipetakan dari log perubahan | | referrer | event.idm.read_only_udm.network.http.referral_url | Dipetakan dari log perubahan | | mac_address | event.idm.read_only_udm.principal.mac | Dipetakan dari log perubahan | | mgmt_value | event.idm.read_only_udm.additional.fields | Dipetakan dari log perubahan | | date_value | event.idm.read_only_udm.additional.fields | Dipetakan dari log perubahan | | origin | event.idm.read_only_udm.intermediary1.ip | Dipetakan dari log perubahan | | logid | event.idm.read_only_udm.security_result.detection_fields | Dipetakan dari log perubahan | | db_tag | event.idm.read_only_udm.security_result.detection_fields | Dipetakan dari log perubahan | | web_client_type | event.idm.read_only_udm.additional.fields | Dipetakan dari log perubahan | | acks_total", "attachments_num", "arrival_time","attack_status", "attack_traffic_bps", "attack_traffic_pps", "audit_status", "auth_method", "bandwidth", "best_practice_id", "blade_name", "cb_rate", "cb_recommendation", "cb_relevantobjectname", "cb_relevantobjectstatus", "file_count", "cb_scan_id", "from", "to", "cb_status", "cb_bp_blade", "controller", "delivery_time", "device_identification", "direction", "discard_traffic_bps", "discard_traffic_pps", "dlp_data_type_name", "dlp_relevant_data_types", "dlp_rule_name", "dlp_transport", "dns_query_type", "failure_reason", "file_size", "file_type" and "file_direction | event.idm.read_only_udm.additional.fields | Dipetakan dari log perubahan | | destination_dns_hostname | target.hostname | Dipetakan dari log perubahan | | email_content | security_result.description | Dipetakan dari log perubahan | | email_subject | network.email.subject | Dipetakan dari log perubahan | | event_name | metadata.description | Dipetakan dari log perubahan | | web_client_type | network.http.user_agent | Dipetakan dari log perubahan | | file_size | target.file_size | Dipetakan dari log perubahan | | from | network.email.from | Dipetakan dari log perubahan | | to | network.email.to | Dipetakan dari log perubahan | | verdict | security_result.verdict_response | Dipetakan dari log perubahan | | file_name | target.file.names | Dipetakan dari log perubahan | | file_md5 | target.file.md5 | Dipetakan dari log perubahan | | file_sha1 | target.file.sha1 | Dipetakan dari log perubahan | | file_sha256 | target.file.sha256 | Dipetakan dari log perubahan | | description | security_result.description | Dipetakan dari log perubahan | | Name | security_result.detection_fields | Dipetakan dari log perubahan | | Level | security_result.confidence_details | Dipetakan dari log perubahan | | Impact | additional.fields | Dipetakan dari log perubahan | | security_result.action | BLOCK | Dipetakan dari log perubahan | | machine | target.hostname | Dipetakan dari log perubahan | | user | principal.user.user_display_name | Dipetakan dari log perubahan | | src | principal.hostname | Dipetakan dari log perubahan | | security_result.action | ALLOW | Dipetakan dari log perubahan | | operation_number | security_result.detection_fields | Dipetakan dari log perubahan | | client_ip | principal.ip | Dipetakan dari log perubahan | | log_sys_message | metadata.description | Dipetakan dari log perubahan | | layer_name | security_result.detection_fields | Dipetakan dari log perubahan | | feature_name" and "securexl_message | additional.fields | Dipetakan dari log perubahan | | emailSubject | network.email.subject | Dipetakan dari log perubahan | | cat | security_result.detection_fields | Dipetakan dari log perubahan | | url | principal.url | Dipetakan dari log perubahan | | srcPostNAT | principal.nat_ip | Dipetakan dari log perubahan | | dstPostNAT | target.nat_ip | Dipetakan dari log perubahan | | srcPostNATPort | principal.nat_port | Dipetakan dari log perubahan | | dstPostNATPort | target.nat_port | Dipetakan dari log perubahan | | dns_query | network.dns.questions | Dipetakan dari log perubahan | | layer_uuid_rule_uuid | security_result.rule_id | Dipetakan dari log perubahan | | domain | principal.administrative_domain | Dipetakan dari log perubahan | | fservice", "appi_name", "app_risk", and "policy_name | security_result.detection_fields | Dipetakan dari log perubahan | | packets", "__id", "dedup_time", "browse_time", "bytes", "product_family", "hll_key", and "calc_service | additional.fields | Dipetakan dari log perubahan | | id | metadata.product_log_id | Dipetakan dari log perubahan | | orig_log_server | principal.resource.product_object_id | Dipetakan dari log perubahan | | environment_id | target.resource.product_object_id | Dipetakan dari log perubahan | | client_outbound_packets" and "client_inbound_packets | principal.resource.attribute.labels | Dipetakan dari log perubahan | | server_outbound_bytes" and "server_inbound_bytes | target.resource.attribute.labels | Dipetakan dari log perubahan | | orig | principal.hostname | Dipetakan dari log perubahan | | orig_log_server_ip | principal.ip | Dipetakan dari log perubahan | | proto | network.ip_protocol | Dipetakan dari log perubahan | | inter_host | intermediary.hostname | Dipetakan dari log perubahan | | origin | target.ip | Dipetakan dari log perubahan | | smartdefense_profile", "malware_rule_id", and "malware_rule_name | security_result.detection_fields | Dipetakan dari log perubahan | | sequencenum", "description_url", "industry_reference", "mitre_execution", "packet_capture_name", "packet_capture_unique_id", "packet_capture_time", and "performance_impact | additional.fields | Dipetakan dari log perubahan | | version | metadata.product_version | Dipetakan dari log perubahan | | http_host | target.resource.attribute.labels | Dipetakan dari log perubahan | | log_id | metadata.product_log_id | Dipetakan dari log perubahan | | user_agent | network.http.user_agent | Dipetakan dari log perubahan | | hostname", "dvc", and "principal_hostname | target.hostname | Dipetakan dari log perubahan | | protection_id", "malware_action", "malware_family,protection_name", "protection_type | security_result.detection_fields | Dipetakan dari log perubahan | | confidence_level | security_result.confidence | Dipetakan dari log perubahan | | method | network.http.method | Dipetakan dari log perubahan | | duration | network.session_duration.seconds | Dipetakan dari log perubahan | | additional_info | security_result.description | Dipetakan dari log perubahan | | operation | security_result.summary | Dipetakan dari log perubahan | | subject | metadata.description | Dipetakan dari log perubahan | | principal_hostname | intermediary.hostname | Dipetakan dari log perubahan | | flags | security_result.detection_fields | Dipetakan dari log perubahan | | tcp_flags | security_result.detection_fields | Dipetakan dari log perubahan | | tcp_packet_out_of_state | security_result.detection_fields | Dipetakan dari log perubahan | | sport_svc | principal.port | Dipetakan dari log perubahan | | ProductFamily | additional.fields | Dipetakan dari log perubahan | | mitre_initial_access | security_result.detection_fields | Dipetakan dari log perubahan | | policy_time | security_result.detection_fields | Dipetakan dari log perubahan | | profile | security_result.detection_fields | Dipetakan dari log perubahan | | reject_id_kid | security_result.detection_fields | Dipetakan dari log perubahan | | ser_agent_kid | security_result.detection_fields | Dipetakan dari log perubahan | | app_category | security_result.category_details | Dipetakan dari log perubahan | | matched_category | security_result.detection_fields | Dipetakan dari log perubahan | | app_properties | security_result.detection_fields | Dipetakan dari log perubahan | | conn_direction | additional.fields | Dipetakan dari log perubahan | | rule_name | security_result.rule_name | Dipetakan dari log perubahan | | rule","sub_policy_name","sub_policy_uid","smartdefense_profile","tags","flexString2 | security_result.detection_fields | Dipetakan dari log perubahan | | dvc | intermediary.hostname | Dipetakan dari log perubahan | | hostname | intermediary.hostname | Dipetakan dari log perubahan | | origin_sic_name | intermediary.asset_id | Dipetakan dari log perubahan | | conn_direction | network.ip_protocol | Dipetakan dari log perubahan | | ifname | security_result.detection_fields | Dipetakan dari log perubahan | | security_inzone | security_result.detection_fields | Dipetakan dari log perubahan | | match_id | security_result.detection_fields | Dipetakan dari log perubahan | | parent_rule | security_result.detection_fields | Dipetakan dari log perubahan | | security_outzone | security_result.detection_fields | Dipetakan dari log perubahan | | sub_policy_name | security_result.detection_fields | Dipetakan dari log perubahan | | sub_policy_uid | security_result.detection_fields | Dipetakan dari log perubahan | | drop_reason | security_result.summary | Dipetakan dari log perubahan | | reason | security_result.summary | Dipetakan dari log perubahan | | xlatesport | principal.nat_port | Dipetakan dari log perubahan | | xlatedport | target.nat_port | Dipetakan dari log perubahan | | ipv6_dst | target.ip | Dipetakan dari log perubahan | | ipv6_src | principal.ip | Dipetakan dari log perubahan | | portal_message | security_result.description | Dipetakan dari log perubahan | | URL | security_result.about.url | Dipetakan dari log perubahan | | Activity | security_result.summary | Dipetakan dari log perubahan | | Reference | security_result.about.resource.attribute.labels | Dipetakan dari log perubahan | | malware_action", "malware_family,protection_name", "protection_type | security_result.about.resource.attribute.labels | Dipetakan dari log perubahan | | src_machine_name | security_result.detection_fields | Dipetakan dari log perubahan | | message_info | metadata.description | Dipetakan dari log perubahanadditional.fields

Kolom log Pemetaan UDM
@timestamp metadata.event_timestamp
__id additional.fields
__nsons additional.fields
__p_dport additional.fields
__pos additional.fields
_action security_result.action_id
access_method metadata.product_event_type
acks_total additional.fields
act security_result.action_details
Action additional.fields
action_details additional.fields
action_reason security_result.detection_fields
Activity security_result.summary
additional_info security_result.description,
security_result.detection_fields
administrator target.user.userid
aggregated_log_count security_result.detection_fields
alert security_result.detection_fields
answer_rdata additional.fields
app principal.application
app_activity security_result.description
app_category security_result.category_details
app_desc additional.fields
app_id additional.fields
app_properties additional.fields,
security_result.detection_fields
app_risk security_result.detection_fields
app_session_id network.session_id
app_sig_id additional.fields
appcategory additional.fields
appi_name security_result.detection_fields
application principal.application
application_version additional.fields
arrival_time additional.fields
attachment_link additional.fields
attachments_num additional.fields
attack security_result.threat_name
attack_info security_result.description
attack_status additional.fields
attack_traffic_bps additional.fields
attackStatus security_result.detection_fields
audit_status additional.fields
auth_method additional.fields
auth_status security_result.summary
authentication_trial additional.fields
authority_rdata principal.resource.attribute.labels
authorization security_result.detection_fields
bandwidth security_result.detection_fields
best_practice_id security_result.detection_fields
blade_name security_result.detection_fields
browse_time additional.fields
browser network.http.user_agent
bytes additional.fields
c_bytes additional.fields
calc_desc security_result.description
calc_service additional.fields
cat security_result.detection_fields
category security_result.category_details
cb_bp_blade additional.fields
cb_rate additional.fields
cb_recommendation additional.fields
cb_relevantobjectname additional.fields
cb_relevantobjectstatus additional.fields
cb_scan_id security_result.detection_fields
cb_status additional.fields
certificate_validity additional.fields
client_inbound_bytes principal.network.received_bytes
client_inbound_interface additional.fields
client_inbound_packets principal.network.received_packets
client_ip principal.ip,
principal.asset.ip
client_name security_result.detection_fields
client_outbound_bytes principal.network.sent_bytes
client_outbound_interface additional.fields
client_outbound_packets principal.network.sent_packets
client_to_gateway_ciphers additional.fields
client_type_os principal.platform
client_version.0 intermediary.platform_version
cloud_hourly_quota additional.fields
cloud_hourly_quota_exceeded additional.fields
cloud_hourly_quota_usage_for_quota_id additional.fields
cloud_hourly_quota_usage_for_this_gw additional.fields
cloud_hourly_remaining_quota additional.fields
cloud_last_quota_update_gmt_time additional.fields
cloud_monthly_quota additional.fields
cloud_monthly_quota_exceeded additional.fields
cloud_monthly_quota_period_end additional.fields
cloud_monthly_quota_period_start additional.fields
cloud_monthly_quota_usage_for_quota_id additional.fields
cloud_monthly_quota_usage_for_this_gw additional.fields
cloud_quota_description additional.fields
cloud_quota_identifier additional.fields
cloud_quota_status additional.fields
cloud_remaining_quota additional.fields
cluster_info additional.fields
cn2 additional.fields
cn3 additional.fields
comment security_result.description
community additional.fields
condition additional.fields
confidence_level security_result.confidence
conn_direction network.direction,
additional.fields
connection_count security_result.detection_fields
connection_luuid additional.fields
connection_uid additional.fields
consent_flag_status additional.fields
consent_flag_value additional.fields
content_disposition target.file.names
content_length target.file.size
content_risk additional.fields
content_type target.file.mime_type
context_num additional.fields
contextnum additional.fields
contract_name security_result.detection_fields
control_log_type additional.fields
controller additional.fields
cookiei additional.fields
cookier additional.fields
cp_component_name additional.fields
cp_component_version additional.fields
creation_time principal.asset.attribute.creation_time
cs2_second intermediary.ip,
intermediary.asset.ip
cu_detected_by additional.fields
cu_detection_time additional.fields
cu_log_count additional.fields
cu_rule_category security_result.rule_name
cu_rule_id security_result.rule_id
current_value additional.fields
d_name security_result.detection_fields
data_type_name security_result.detection_fields
date_value additional.fields
datetime metadata.event_timestamp
db_tag security_result.detection_fields
db_ver additional.fields
DCE_RPC_Interface_UID additional.fields
dce-rpc_interface_uuid additional.fields
dce-rpc_interface_uuid-1 additional.fields
dce-rpc_interface_uuid-2 additional.fields
dce-rpc_interface_uuid-3 additional.fields
dedup_time additional.fields
default_device_message additional.fields
delivery_time additional.fields
desc security_result.summary
description security_result.detection_fields
description_url additional.fields
Destination additional.fields
destination_dns_hostname target.hostname,
target.asset.hostname
destinationAddress target.ip,
target.asset.ip
destinationDnsDomain target.url
destinationPort target.port
destinationTranslatedAddress target.ip,
target.asset.ip,
target.nat_ip
destinationTranslatedPort target.port,
target.nat_port
detected_by security_result.detection_fields
device intermediary.ip,
intermediary.asset.ip
device_identification additional.fields
device_message security_result.description
device_name target.hostname,
target.asset.hostname
device_type target.resource.resource_subtype
deviceCustomNumber2 additional.fields
deviceCustomString2 security_result.rule_name
deviceDirection network.direction
devTime metadata.event_timestamp
direction additional.fields
discard_traffic_bps additional.fields
discard_traffic_pps additional.fields
dlp_data_type_name additional.fields
dlp_relevant_data_types additional.fields
dlp_rule_name additional.fields
dlp_transport additional.fields
dn additional.fields
dns_domain_name target.hostname,
target.asset.hostname
dns_message_type security_result.detection_fields
dns_query_type additional.fields
dns_query.queries network.dns.questions.name
dns_type additional.fields
domain principal.administrative_domain
domain_name principal.administrative_domain
dpt target.port
drop_reason security_result.summary
dst target.ip,
target.asset.ip
dst_country target.location.country_or_region
dst_domain_name target.hostname,
target.asset.hostname
dst_ip target.ip,
target.asset.ip
dst_machine_name target.user.email_addresses
dst_phone_number target.user.phone_numbers
dst_port target.port
dst_uo_icon additional.fields
dst_uo_name target.location.country_or_region
dst_user_dn target.resource.attribute.labels
dst_user_name target.user.user_display_name
dstBytes additional.fields
dstkeyid additional.fields
dstPostNAT target.nat_ip
dstPostNATPort target.nat_port
duration network.session_duration.seconds
during_sec additional.fields
dvc target.ip,
intermediary.ip
elapsed additional.fields
email_content security_result.description
email_control additional.fields
email_queue_id security_result.detection_fields
email_queue_name security_result.detection_fields
email_session_id additional.fields
email_status security_result.detection_fields
email_subject network.email.subject
emailSubject network.email.subject
emulated_on additional.fields
encryption_fail_reason additional.fields
encryption_failure security_result.description
environment_id target.resource.product_object_id
Errors security_result.description
euid additional.fields
event_kind additional.fields
event_name metadata.description
event_start_time additional.fields
extraction_download_time additional.fields
extraction_time additional.fields
extraction_total_time additional.fields
failure_impact additional.fields
failure_reason additional.fields
feature_name additional.fields
fg-1_client_in_rule_name additional.fields
fg-1_client_out_rule_name additional.fields
fieldschanges security_result.detection_fields
file_count additional.fields
file_direction additional.fields
file_md5 target.file.md5
file_name target.file.names
file_sha1 target.file.sha1
file_sha256 target.file.sha256
file_size target.file.size
file_status target.resource.attribute.labels
file_type additional.fields
Firewall management node security_result.detection_fields
firstname principal.user.first_name
flags additional.fields
flexString2 security_result.detection_fields
FollowUp security_result.detection_fields
fragments_dropped additional.fields
from network.email.from,
additional.fields
from_user principal.user.userid
fservice security_result.detection_fields
fw_message additional.fields
fw_subproduct metadata.product_name
gateway_to_server_ciphers additional.fields
geoip_dst.country_name target.location.country_or_region
h_version security_result.detection_fields
has_accounting additional.fields
header_ip_ intermediary.ip,
intermediary.asset.ip
hll_key additional.fields
host target.hostname,
target.asset.hostname
hostname target.hostname,
target.asset.hostname
http_host target.ip,
target.asset.ip (jika berupa alamat IP),
target.hostname (jika berupa nama host)
http_server target.application
http_status network.http.response_code
https_inspection_action additional.fields
https_inspection_rule_id security_result.detection_fields
https_inspection_rule_name security_result.detection_fields
https_validation security_result.detection_fields
i_ip intermediary.ip,
intermediary.asset.ip
icmp additional.fields
ICMP additional.fields
icmp_code additional.fields
ICMP_Code additional.fields
icmp_type additional.fields
ICMP_Type additional.fields
id metadata.product_log_id
identity_src target.application
identity_type additional.fields,
extensions.auth.type
if_direction network.direction
if_name additional.fields
ifdir network.direction
ifname security_result.detection_fields
ike security_result.description
ike_ids additional.fields
Impact additional.fields
indicator_name security_result.detection_fields
indicator_uuid security_result.detection_fields
industry_reference additional.fields
Info security_result.description
information metadata.description
inspection_category additional.fields
inspection_information additional.fields
inspection_item additional.fields
inspection_profile additional.fields
install_policy_acceleration additional.fields
instance_id principal.hostname,
principal.asset.hostname
instruction additional.fields
inter_host intermediary.ip
inter_host1 intermediary.hostname
inter_hostname_ intermediary.hostname
intermediary_application intermediary.application
intermediary_hostname_ intermediary.ip,
_intermediary.hostname
intermediary_ip intermediary.ip
inzone security_result.detection_fields
ip_address target.resource.attribute.labels
ip_address (berasal dari paket) principal.ip
ip_address2 (berasal dari paket) principal.ip,
principal.asset.ip
ip_host intermediary.ip,
intermediary.asset.ip (jika berupa alamat IP),
intermediary.hostname (jika berupa nama host)
ip_id additional.fields
ip_len additional.fields
ip_offset additional.fields
ipv6_dst target.ip,
target.asset.ip
ipv6_src principal.ip,
principal.asset.ip
is_correlated additional.fields
is_last additional.fields
last_hit_time security_result.last_discovered_time
last_rematch_time additional.fields
lastchg additional.fields
lastname principal.user.last_name
lastupdatetime security_result.last_updated_time
layer_name security_result.rule_set_display_name,
security_result.detection_fields
layer_name_match_table additional.fields (daftar)
layer_name_TP_match_table additional.fields (daftar)
layer_names additional.fields.list
layer_uuid security_result.rule_set,
security_result.detection_fields
layer_uuid_match_table additional.fields (daftar)
layer_uuid_rule_uuid.0 security_result.rule_id
layer_uuids additional.fields.list
level security_result.detection_fields
Level security_result.confidence_details
local_value additional.fields
localhost target.hostname,
target.asset.hostname
log_attachment_uid additional.fields
log_delay additional.fields
log_id metadata.product_log_id
log_link additional.fields
log_sys_message metadata.description
log_uid additional.fields
log_version metadata.product_version
logic_changes security_result.detection_fields
logicchanges.FollowUp security_result.detection_fields
logicchanges.Protection security_result.detection_fields
logicchanges.Srcs_srcs target.resource.product_object_id
logid security_result.detection_fields
loguid metadata.product_log_id
mac_address principal.mac
machine target.ip
maestro_gw additional.fields
malware security_result.detection_fields
malware_action security_result.detection_fields
malware_family security_result.detection_fields,
security_result.about.resource.attribute.labels
malware_rule_id security_result.detection_fields
malware_rule_id_TP_match_table additional.fields (daftar)
malware_rule_name security_result.detection_fields
match_id additional.fields (daftar)
match_id_match_table additional.fields (daftar)
match_ids security_result.detection_fields
matched_category security_result.detection_fields
max_num_count_detected additional.fields
max_vms_num additional.fields
media_type additional.fields
member_id additional.fields
message_info metadata.description
metadata.product_log_id_insertion_epoch_timestamp metadata.collected_timestamp
method network.http.method
methods additional.fields
mgmt_value additional.fields
mitre_collection additional.fields
mitre_command_and_control additional.fields
mitre_credential_access additional.fields
mitre_defense_evasion additional.fields
mitre_discovery additional.fields
mitre_execution additional.fields
mitre_exfiltration additional.fields
mitre_impact additional.fields
mitre_initial_access security_result.detection_fields
mitre_lateral_movement additional.fields
mitre_persistence additional.fields
mitre_privilege_escalation additional.fields
more_sources principal.ip
msg security_result.description
msgid additional.fields
Name security_result.detection_fields,
security_result.about.resource.attribute.labels
nat_addtnl_rulenum additional.fields
NAT_addtnl_rulenum security_result.detection_fields
nat_rule_uid additional.fields
nat_rulenum security_result.detection_fields
NAT_rulenum security_result.detection_fields
needs_browse_time additional.fields
next_update_desc additional.fields
num_of_updates additional.fields
object target.ip
objectname additional.fields
objecttype security_result.detection_fields
observable_comment security_result.detection_fields
observable_id security_result.detection_fields
observable_name security_result.detection_fields
oid_prefix additional.fields
operation additional.fields
operation_number security_result.detection_fields
operation_results additional.fields
orig principal.hostname,
principal.asset.hostname
orig_log_server principal.resource.product_object_id
orig_log_server_ip principal.ip,
principal.asset.ip
origin intermediary.ip,
target.ip,
target.asset.ip (jika detail mesin utama dan target bernilai null.)
origin_repetitions additional.fields
origin_sic_name intermediary.asset_id
originsicname security_result.detection_fields
os principal.platform
os_name principal.asset.platform_software.platform
os_version principal.asset.platform_software.platform_patch_level
outzone security_result.detection_fields
p_hostname principal.hostname
p_ip principal.ip,
principal.asset.ip
p_userid principal.user.userid
p_username principal.user.user_display_name
package_action additional.fields
packet_amount additional.fields
packet_capture_name additional.fields
packet_capture_time additional.fields
packet_capture_unique_id additional.fields
packets additional.fields
parameter additional.fields
parent_rule additional.fields (daftar)
parent_rule_match_table additional.fields (daftar)
parent_rules additional.fields.list
password_field additional.fields
path target.file.full_path
peer_gateway target.ip,
target.asset.ip
performance_impact additional.fields
performanceImpAction security_result.detection_fields
pid principal.process.pid
platform_patch_level principal.asset.platform_software.platform_patch_level
policy additional.fields
policy_name security_result.detection_fields
policy_time security_result.detection_fields
policyNames security_result.rule_set_display_name
port additional.fields
port (berasal dari paket) principal.port
port2 (berasal dari paket) target.port
portal_message security_result.description
ppid principal.process.parent_pid
precise_error security_result.detection_fields
principal_hostname principal.ip dan principal.asset.ip (jika principal_hostname adalah IP yang valid),
principal.hostname,
principal.asset.hostname, dan intermediary.hostname (semua kasus lainnya)
principal_ip principal.ip,
principal.asset.ip
product metadata.product_name
product_event_type metadata.product_event_type
product_family additional.fields
product_log_id metadata.product_log_id
ProductFamily additional.fields
profile security_result.detection_fields
Protection security_result.detection_fields
protection_id security_result.detection_fields
protection_name security_result.detection_fields,
security_result.about.resource.attribute.labels
protection_type security_result.detection_fields,
security_result.about.resource.attribute.labels
proto additional.fields
protocol network.application_protocol
proxy security_resultc_ipprincipal.nat_ip
query additional.fields
question_rdata security_result.detection_fields
reason security_result.summary
received_bytes network.received_bytes
Reference security_result.detection_fields,
security_result.about.resource.attribute.labels
registered_ip_phones additional.fields
reject_category security_result.summary
reject_id_kid security_result.detection_fields
resource additional.fields.list_value
resource_name target.resource.name
resource1 target.url
result security_result.summary
roles additional.fields
ROW_END additional.fields
ROW_START additional.fields
rt metadata.event_timestamp
rule security_result.rule_name,
security_result.detection_fields
rule_action security_result.action,
security_result.detection_fields
rule_action_match_table additional.fields (daftar)
rule_actions security_result.detection_fields
rule_id security_result.rule_id
rule_name security_result.rule_name
rule_name_match_table additional.fields (daftar)
rule_names additional.fields
`rule_uid" security_result.rule_id
rule_uid_match_table additional.fields (daftar)
rule_uids security_result.detection_fields,
additional.fields
s_port additional.fields
scheme additional.fields
scope principal.ip (jika berupa alamat IP),
additional.fields (jika bukan alamat IP)
scrub_activity additional.fields
securexl_message additional.fields
security_inzone security_result.detection_fields
security_outzone security_result.detection_fields
segment_time additional.fields
sendtotrackerasadvancedauditlog security_result.detection_fields
sensor_alert_blade additional.fields
sensor_alert_category additional.fields
sensor_alert_duration additional.fields
sensor_alert_id additional.fields
sensor_alert_message additional.fields
sensor_alert_module additional.fields
sensor_alert_solution additional.fields
sensor_alert_solution_sk additional.fields
sensor_alert_title additional.fields
sensor_alert_type additional.fields
sensor_test_name additional.fields
sent_bytes network.sent_bytes
sequencenum additional.fields
ser_agent_kid security_result.detection_fields
server_inbound_bytes network.sent_bytes
server_inbound_interface additional.fields
server_inbound_packets network.sent_bytes
server_kid additional.fields
server_outbound_bytes network.received_bytes
server_outbound_interface target.resource.attribute.labels
server_outbound_packets network.received_bytes
service target.port
service_id additional.fields
session_description security_result.detection_fields
session_id network.session_id
session_name security_result.detection_fields
session_uid network.session_id
sev security_result.severity
severity security_result.detection_fields
Severity security_result.severity
sig_id additional.fields
signature security_result.threat_name
site network.http.user_agent
smartdefense_profile security_result.detection_fields
smartdefense_profile_TP_match_table additional.fields (daftar)
sni additional.fields
snid network.session_id
Source target.resource.attribute.labels
source_os additional.fields
sourceAddress principal.ip,
principal.asset.ip
sourcePort principal.port
sourceTranslatedAddress principal.ip,
principal.asset.ip,
principal.nat_ip
sourceTranslatedPort principal.port,
principal.nat_port
sourceUserName match => { "sourceUserName" => [ "%{DATA:firstname}( %{DATA:lastname})? \\\(%{DATA:userid}\\\)"]}
special_attack additional.fields
spt principal.port
sr_url security_result.about.url
src principal.ip,
principal.hostname,
principal.asset.ip,
principal.asset.hostname
src_domain_name principal.hostname,
principal.asset.hostname
src_ip principal.ip,
principal.asset.ip
src_localhost principal.hostname,
principal.asset.hostname
src_machine_group principal.resource.attribute.labels
src_machine_name principal.user.email_addresses
src_port principal.port
src_uo_icon additional.fields
src_uo_name principal.location.country_or_region
src_user principal.user.userid
src_user_dn principal.resource.attribute.labels
src_user_group principal.resource.attribute.labels
src_user_name principal.user.userid
srcBytes additional.fields
srcip additional.fields
srcPort principal.port
srcPostNAT principal.nat_ip
srcPostNATPort principal.nat_port
Srcs security_resultcstarget.resource.attribute.labels
srv_ip target.ip
ssh_connection_stage additional.fields
sshd_function additional.fields
start_time metadata.collected_timestamp
status security_result.action_details,
security_result.detection_fields,
security_result.action
stormagentaction additional.fields
stormagentname additional.fields
sub_policy_name security_result.detection_fields
sub_policy_uid security_result.detection_fields
subject metadata.description
subscription_description additional.fields
subscription_stat security_result.detection_fields
subscription_stat_desc security_result.summary
subscription_status security_result.detection_fields
suppressed_logs security_result.detection_fields
svc target.port
sys_message additional.fields
syslog_date additional.fields
syslog_facility_code additional.fields
syslog_pri additional.fields
system_alert_message additional.fields
system_application additional.fields
tags security_result.detection_fields
tar_user target.user.userid
tar_userid target.user.userid
tar_username target.user.user_display_name
target_port target.port
tcp_flags additional.fields
tcp_packet_out_of_state security_result.detection_fields
te_verdict_determined_by additional.fields
temp_duser target.user.email_addresses
tid security_result.detection_fields
time metadata.event_timestamp
time_interval additional.fields
tls_server_host_name additional.fields
to network.email.to,
additional.fields
TP_match_table additional.fields
Track additional.fields
two-factor_authentication security_result.detection_fields
type security_result.rule_type
uid additional.fields
UP_match_table additional.fields
update_count additional.fields
update_service additional.fields
update_status security_result.action,
security_result.action_details
url principal.url
url_count additional.fields
user principal.user.user_display_name
user_agent network.http.user_agent,
network.http.parsed_user_agent
usercheck_interaction_name security_result.rule_name
userid principal.user.userid
userip principal.ip,
principal.asset.ip
UUid metadata.product_log_id
validation_log additional.fields
vendor_list security_result.detection_fields
vendor_name metadata.vendor_name
verdict security_result.verdict_info.verdict_response
version metadata.product_version
version_ additional.fields
via additional.fields
voip_call_dir additional.fields
voip_call_id network.session_id
voip_call_state additional.fields
voip_duration additional.fields
voip_log_type additional.fields
voip_media_ipp additional.fields
voip_media_port additional.fields
voip_method additional.fields
voip_reason_info additional.fields
voip_reg_ip additional.fields
voip_reg_ipp additional.fields
voip_reg_period additional.fields
voip_reg_port additional.fields
voip_reg_server additional.fields
voip_reject_reason additional.fields
VPN additional.fields
vpn_feature_name additional.fields
watermark additional.fields
web_client_type network.useragent
web_client_type.0 network.http.user_agent,
network.http.parsed_user_agent
xlatedport target.nat_port
xlatedst target.nat_ip
xlatesport principal.nat_port
xlatesrc principal.nat_ip

Delta rilis

Pada 1 Maret 2026, Google SecOps merilis versi baru parser firewall Check Point, yang mencakup perubahan signifikan pada pemetaan kolom log Parser_Name ke kolom UDM dan perubahan pada pemetaan jenis peristiwa.

Delta pemetaan kolom log

Tabel berikut mencantumkan delta pemetaan untuk kolom log firewall Check Point ke UDM yang diekspos sebelum 1 Maret 2026 dan setelahnya (masing-masing tercantum dalam kolom Pemetaan lama dan Pemetaan saat ini):

Kolom log Pemetaan lama Pemetaan saat ini
client_inbound_bytes princiapal.resource.attribute_labels principal.network.received_bytes
client_outbound_bytes princiapal.resource.attribute_labels principal.network.sent_bytes
lastupdatetime additional.fields security_result.last_updated_time
layer_names security_result.detection_fields additional.fields.list
layer_uuids security_result.detection_fields, additional.fields additional.fields.list
operation security_result.detection_fields additional.fields
originsicname intermediary.labels security_resul.detection_fields
parent_rules additional.fields additional.fields.list
pid additional.fields principal.process.pid
scope additional.fields principal.ip (jika berupa alamat IP),
additional.fields (jika bukan alamat IP)
server_inbound_bytes target.resource.attribute.labels, network.sent_bytes network.sent_bytes
server_inbound_packets target.resource.attribute.labels, network.sent_packets network.sent_packets
server_outbound_bytes target.resource.attribute.labels, network.received_bytes network.received_bytes
server_outbound_packets target.resource.attribute.labels, network.received_packets network.received_packets
src_machine_name additional.fields principal.user.email_addresses
src_user_dn sr.detection_fields principal.resource.attribute.labels
suppressed_logs additional.fields security_result.detection_fields
web_client_type additional.fields network.useragent

Delta pemetaan jenis peristiwa

Beberapa peristiwa yang diklasifikasikan secara umum kini diklasifikasikan dengan benar menggunakan jenis peristiwa yang bermakna.

Tabel berikut mencantumkan perbedaan penanganan jenis peristiwa firewall Check Point sebelum 1 Maret 2026 dan setelahnya (masing-masing tercantum dalam kolom Old event_type dan Current event_type):

Format ID peristiwa dari log event_type lama event_type saat ini
SYSLOG+KV Log memiliki sourceAddress dan host GENERIC_EVENT NETWORK_CONNECTION
SYSLOG+JSON Log memiliki sourceAddress dan host NETWORK_HTTP NETWORK_CONNECTION
SYSLOG+JSON Log memiliki sourceAddress dan host NETWORK_HTTP NETWORK_CONNECTION

Log Perubahan

Melihat Log Perubahan untuk parser ini

Perlu bantuan lain? Dapatkan jawaban dari anggota Komunitas dan profesional Google SecOps.