21

CHECK POINT

This section provides information on the following DSMs for IBM Security QRadar:

Check Point
FireWall-1

Check Point FireWall-1

Check Point Provider-1

You can configure QRadar to integrate with a Check Point FireWall-1 device using
one of the following methods:

Integrating Check Point FireWall-1 using OPSEC

Integrating Check Point FireWall-1 using syslog

Integrating Check Point Firewall events from external syslog forwarders

Note: Depending on your Operating System, the procedures for the Check Point
FireWall-1 device might vary. The following procedures are based on the Check
Point SecurePlatform Operating system.
Integrating Check
Point FireWall-1
using OPSEC

This section describes how to ensure that QRadar accepts Check Point FireWall-1
events using Open Platform for Security (OPSEC/LEA).
To integrate Check Point OPSEC/LEA with QRadar, you must create two Secure
Internal Communication (SIC) files and enter the information in to QRadar as a
Check Point Firewall-1 log source.

IBM Security QRadar DSM Configuration Guide

120

CHECK POINT

Check Point Firewall-1 configuration overview

To integrate Check Point Firewall-1 with QRadar, you must complete the following
procedures in sequence:
1 Add QRadar as a host for Check Point Firewall-1.
2 Add an OPSEC application to Check Point Firewall-1.
3 Locate the Log Source Secure Internal Communications DN.
4 In QRadar, configure the OPSEC LEA protocol.
5 Verify the OPSEC/LEA communications configuration.

Adding a Check Point Firewall-1 Host

To add QRadar as a host in Check Point Firewall-1 SmartCenter:
Step 1 Log in to the Check Point SmartDashboard user interface.
Step 2 Select Manage > Network Objects > New > Node > Host.
Step 3 Type parameters for your Check Point Firewall-1 host:

Name: QRadar
IP Address: <IP address of QRadar>
Comment: <Optional>
Step 4 Click OK.
Step 5 Select Close.

You are now ready to create an OPSEC Application Object for Check Point
Firewall-1.
Creating an OPSEC Application Object
To create the OPSEC Application Object:
Step 1 Open the Check Point SmartDashboard user interface.
Step 2 Select Manage > Servers and OPSEC applications > New > OPSEC

Application Properties.
Step 3 Assign a name to the OPSEC Application Object.

For example:
QRadar-OPSEC

The OPSEC Application Object name must be different than the host name you
typed when creating the node in Step 3.
a

From the Host list box, select QRadar.

From the Vendor list box, select User Defined.

In Client Entities, select the LEA check box.

To generate a Secure Internal Communication (SIC) DN, click

Communication.

Enter an activation key.

IBM Security QRadar DSM Configuration Guide

Check Point FireWall-1

121

Note: The activation key is a password used to generate the SIC DN. When you
configure your Check Point log source in QRadar, the activation key is typed into
the Pull Certificate Password parameter.
f

Click Initialize.
The window updates the Trust state from Uninitialized to Initilialized
but trust not established.

Click Close.
The OPSEC Application Properties window is displayed.

Write down or copy the displayed SIC DN to a text file.

Note: The displayed SIC value is required for the OPSEC Application Object SIC
Attribute parameter when you configure the Check Point log source in QRadar.
The OPSEC Application Object SIC resembles the following example:
CN=QRadar-OPSEC,O=cpmodule..tdfaaz.
You are now ready to locate the log source SIC for Check Point Firewall-1.
Locating the log source SIC
To locate the Log Source SIC from the Check Point SmartDashboard:
Step 1 Select Manage > Network Objects.
Step 2 Select your Check Point Log Host object.

Note: You must know if the Check Point Log Host is a separate object in your
configuration from the Check Point Management Server. In most cases, the Check
Point Log Host is the same object as the Check Point Management Server.
Step 3 Click Edit.

The Check Point Host General Properties window is displayed.

Step 4 Copy the Secure Internal Communication (SIC).

Note: Depending on your Check Point version, the Communication button might
not be available to display the SIC attribute. You can locate the SIC attribute from
the Check Point Management Server command-line interface. You must use the
cpca_client lscert command from the command-line interface of the
Management Server to display all certificates. The Log Source SIC Attribute
resembles the following example: cn=cp_mgmt,o=cpmoduletdfaaz. For more
information, see your Check Point Command Line Interface Guide.
You must now install the Security Policy from the Check Point SmartDashboard
user interface.
Step 5 Select Policy > Install > OK.

You are now ready to configure the OPSEC LEA protocol.

IBM Security QRadar DSM Configuration Guide

122

CHECK POINT

Configuring an OPSEC/LEA log source in QRadar

To configure the log source in QRadar:
Step 1 Log in to QRadar.
Step 2 Click the Admin tab.
Step 3 Click the Log Sources icon.
Step 4 Click Add.
Step 5 In the Log Source Name field, type a name for your log source.
Step 6 In the Log Source Description field, type a description for the log source.
Step 7 From the Log Source Type list box, select Check Point FireWall-1.
Step 8 Using the Protocol Configuration list box, select OPSEC/LEA.
Step 9 Configure the following values:

Table 21-6 OPSEC/LEA protocol parameters

Parameter

Description

Log Source
Identifier

Type the IP address for the log source. This value must match
the value configured in the Server IP parameter.
The log source identifier must be unique for the log source type.

Server IP

Type the IP address of the Check Point host or Check Point

Management Server IP.

Server Port

Type the port used for OPSEC communication.

Administrators must ensure the existing firewall policy permits
the LEA/OPSEC connection from your QRadar.

Use Server IP for

Log Source

Select this check box if you want to use the LEA servers IP
address instead of the managed devices IP address for a log
source. By default, the check box is selected.

Statistics Report
Interval

Type the interval, in seconds, during which the number of syslog

events are recorded in the qradar.log file. The valid range is 4 to
2,147,483,648 and the default is 600.

Authentication
Type

From the list, select the authentication type you want to use for
this LEA configuration.
The options include:

sslca (default)

sslca_clear

clear

This value must match the authentication method configured on

the Check Point Firewall or Check Point custom log management
server.

IBM Security QRadar DSM Configuration Guide

Check Point FireWall-1

123

Table 21-6 OPSEC/LEA protocol parameters (continued)

Parameter

Description

OPSEC
Type the Secure Internal Communications (SIC) name of the
Application Object OPSEC Application Object.
SIC Attribute (SIC The SIC name is the distinguished name (DN) of the application,
Name)
for example: CN=LEA, o=fwconsole..7psasx.
See Creating an OPSEC Application Object - step h.
Log Source SIC
Attribute (Entity
SIC Name)

Type the SIC name for the server generating log sources.
For example: cn=cp_mgmt,o=fwconsole..7psasx.
See Locating the log source SIC - Step 4.

Specify Certificate Select this check box to define a certificate for this LEA
configuration.
Certificate
Filename

Type the directory path of the certificate you want to use for this
configuration.

Certificate
Authority IP

Type the IP address of the SmartCenter server from which you

want to pull your certificate.

Pull Certificate
Password

Type the password you want to use when requesting a

certificate.
See Creating an OPSEC Application Object - step e.

OPSEC
Application

Type the name of the application you want to use when

requesting a certificate. This value can be up to 255 characters in
length.

Step 10 Click Save.

Step 11 On the Admin tab, click Deploy Changes.

You are now ready to verify your OPSEC/LEA communications for Check Point
Firewall-1.
Editing your OPSEC
communications
configuration

This section describes how to modify your Check Point FireWall-1 configuration to
allow OPSEC communications on non-standard ports, configure communications
in a clear text, un-authenticated stream, and verify the configuration in QRadar.
Changing your Check Point Custom Log Manager (CLM) IP address
If your Check Point configuration includes a Check Point Custom Log Manager
(CLM), you might eventually need to change the IP address for the CLM, which
impacts any of the automatically discovered Check Point log sources from that
CLM in QRadar. This is because when you manually add the log source for the
CLM using the OPSEC/LEA protocol, then all Check Point firewalls that forward
logs to the CLM are automatically discovered by QRadar. These automatically
discovered log sources cannot be edited. If the CLM IP address changes, you
must edit the original Check Point CLM log source that contains the OPSEC/LEA
protocol configuration and update the server IP address and log source identifier.

IBM Security QRadar DSM Configuration Guide

124

CHECK POINT

After you update the log source for the new Check Point CLM IP address, then any
new events reported from the automatically discovered Check Point log sources
are updated.
Note: Do not delete and recreate your Check Point CLM or automatically
discovered log sources in QRadar. Deleting a log source does not delete event
data, but can make finding previously recorded events more difficult to find.
To update your Check Point OPSEC log source:
Step 1 Log in to QRadar.
Step 2 Click the Admin tab.
Step 3 On the navigation menu, click Data Sources.
Step 4 Click the Log Sources icon.
Step 5 Select the original Check Point CLM log source containing the OPSEC/LEA

protocol configuration and click Edit.

Step 6 In the Log Source Identifier field, type a new identifying name of your Check

Point CLM.
Step 7 In the Server IP field, type the new IP address of your Check Point CLM.
Step 8 Click Save.

The IP address update for your Check Point CLM in QRadar is complete.
Changing the default port for OPSEC LEA communication
To change the default port on which OPSEC LEA communicates (that is, port
18184):
Step 1 At the command-line prompt of your Check Point SmartCenter Server, type the

following command to stop the firewall services:

cpstop
Step 2 Depending on your Check Point SmartCenter Server operating system, open the

following file:

Linux - $FWDIR\conf\fwopsec.conf

Windows - %FWDIR%\conf\fwopsec.conf

The default contents of this file are as follows:

# The VPN-1/FireWall-1 default settings are:
#
# sam_server auth_port 0
# sam_server
port
18183
#
# lea_server auth_port
18184
# lea_server
port
0
#
# ela_server auth_port
18187
# ela_server
port
0
#
IBM Security QRadar DSM Configuration Guide

Check Point FireWall-1

#
#
#
#
#

cpmi_server auth_port

18190

uaa_server
uaa_server

19191
0

auth_port
port

125

Step 3 Change the default lea_server auth_port from 18184 to another port number.
Step 4 Remove the hash (#) mark from that line.

For example:
lea_server auth_port
18888
# lea_server
port
0
Step 5 Save and close the file.
Step 6 Type the following command to start the firewall services:

cpstart

Configuring OPSEC LEA for un-encrypted communications

To configure the OPSEC LEA protocol for un-encrypted communications:
Step 1 At the command-line prompt of your Check Point SmartCenter Server, stop the

firewall services by typing the following command:

cpstop
Step 2 Depending on your Check Point SmartCenter Server operating system, open the

following file:

Linux - $FWDIR\conf\fwopsec.conf

Windows - %FWDIR%\conf\fwopsec.conf

Step 3 Change the default lea_server auth_port from 18184 to 0.

Step 4 Change the default lea_server port from 0 to 18184.
Step 5 Remove the hash (#) marks from both lines.

For example:
lea_server
lea_server

auth_port
port

0
18184

Step 6 Save and close the file.

Step 7 Type the following command to start the firewall services:

cpstart
Step 8 You are now ready to configure the log source in QRadar.

To configure QRadar to receive events from a Check Point Firewall-1 device:

Procedure
Step 1 Log in to QRadar.
Step 2 Click the Admin tab.
Step 3 On the navigation menu, click Data Sources.
IBM Security QRadar DSM Configuration Guide

126

CHECK POINT

Step 4 Click the Log Sources icon.

Step 5 Click Add.
Step 6 From the Log Source Type list box, select Check Point FireWall-1.
Step 7 Using the Protocol Configuration list box, select OPSEC/LEA.
Step 8 Configure the following parameters:

Table 21-7 OPSEC/LEA protocol parameters

Parameter

Description

Log Source
Identifier

Type the IP address for the log source. This value must match
the value configured in the Server IP parameter.
The log source identifier must be unique for the log source type.

Server IP

Type the IP address of the server.

Server Port

Type the port used for OPSEC communication. The valid range
is 0 to 65,536 and the default is 18184.

Use Server IP for

Log Source

Select this check box if you want to use the LEA servers IP
address instead of the managed devices IP address for a log
source. By default, the check box is selected.

Statistics Report
Interval

Type the interval, in seconds, during which the number of syslog

events are recorded in the qradar.log file. The valid range is 4 to
2,147,483,648 and the default is 600.

IBM Security QRadar DSM Configuration Guide

Check Point FireWall-1

127

Table 21-7 OPSEC/LEA protocol parameters (continued)

Parameter

Description

Authentication
Type

From the list box, select the authentication type you want to use
for this LEA configuration. The options are sslca (default),
sslca_clear, or clear. This value must match the authentication
method used by the server. The following parameters appear if
sslca or sslca_clear is selected as the authentication type.

OPSEC Application Object SIC Attribute (SIC Name) Type the Secure Internal Communications (SIC) name of the
OPSEC Application Object. The SIC name is the
distinguished name (DN) of the application, for example:
CN=LEA, o=fwconsole..7psasx. The name can be up
to 255 characters in length and is case sensitive.

Log Source SIC Attribute (Entity SIC Name) - Type the SIC
name of the server, for example:
cn=cp_mgmt,o=fwconsole..7psasx. The name can be
up to 255 characters in length and is case sensitive.

Specify Certificate - Select this check box if you want to

define a certificate for this LEA configuration. QRadar
attempts to retrieve the certificate using these parameters
when the certificate is required.
If you select the Specify Certificate check box, the Certificate
Filename parameter is displayed:

Certificate Filename - This option only appears if Specify

Certificate is selected. Type the directory path of the
certificate you want to use for this configuration.
If you clear the Specify Certificate check box, the following
parameters appear:

Certificate Authority IP - Type the IP address of the

SmartCenter server from which you want to pull your
certificate.

Pull Certificate Password - Type the password you want to

use when requesting a certificate. The password can be up to
255 characters in length.

OPSEC Application - Type the name of the application you

want to use when requesting a certificate. This value can be
up to 255 characters in length.

Step 9 Click Save.

Step 10 On the Admin tab, click Deploy Changes.

The configuration is complete.

IBM Security QRadar DSM Configuration Guide

128

CHECK POINT

Integrating Check
Point FireWall-1
using syslog

This section describes how to ensure that the QRadar Check Point FireWall-1
DSMs accepts FireWall-1 events using syslog.
Configuring Syslog for Check Point FireWall-1
Before you configure QRadar to integrate with a Check Point FireWall-1 device:
Note: If Check Point SmartCenter is installed on Microsoft Windows, you must
integrate Check Point with QRadar using OPSEC. For more information, see
Integrating Check Point FireWall-1 using OPSEC.

Step 1 Type the following command to access the Check Point console as an expert user:

expert

A password prompt is displayed.

Step 2 Type your expert console password. Press the Enter key.
Step 3 Open the following file:

/etc/rc.d/rc3.d/S99local
Step 4 Add the following lines:

$FWDIR/bin/fw log -ftn | /usr/bin/logger -p

<facility>.<priority> > /dev/null 2>&1 &

Where:
<facility> is a Syslog facility, for example, local3.
<priority> is a Syslog priority, for example, info.

For example:
$FWDIR/bin/fw log -ftn | /usr/bin/logger -p local3.info >
/dev/null 2>&1 &
Step 5 Save and close the file.
Step 6 Open the syslog.conf file.
Step 7 Add the following line:

<facility>.<priority> <TAB><TAB>@<host>
Where:
<facility> is the syslog facility, for example, local3. This value must match the
value you typed in Step 4.
<priority> is the syslog priority, for example, info or notice. This value must
match the value you typed in Step 4.
<TAB> indicates you must press the Tab key.
<host> indicates the QRadar Console or managed host.
Step 8 Save and close the file.
Step 9 Depending on your operating system, type the following command to restart

syslog:

IBM Security QRadar DSM Configuration Guide

Check Point FireWall-1

129

In Linux: service syslog restart

In Solaris: /etc/init.d/syslog start
Step 10 Type the following command:

nohup $FWDIR/bin/fw log -ftn | /usr/bin/logger -p

<facility>.<priority> > /dev/null 2>&1 &

Where:
<facility> is a Syslog facility, for example, local3. This value must match the
value you typed in Step 4.
<priority> is a Syslog priority, for example, info. This value must match the
value you typed in Step 4.

The configuration is complete. The log source is added to QRadar as Check Point
Firewall-1 syslog events are automatically discovered. Events forwarded to
QRadar are displayed on the Log Activity tab.
Configuring a log source
QRadar automatically discovers and creates a log source for syslog events from
Check Point FireWall-1. The following configuration steps are optional.
Procedure
Step 1 Log in to QRadar.
Step 2 Click the Admin tab.
Step 3 On the navigation menu, click Data Sources.
Step 4 Click the Log Sources icon.
Step 5 Click Add.
Step 6 In the Log Source Name field, type a name for your log source.
Step 7 In the Log Source Description field, type a description for the log source.
Step 8 From the Log Source Type list box, select Check Point FireWall-1.
Step 9 Using the Protocol Configuration list box, select Syslog.
Step 10 Configure the following values:

Table 21-1 Syslog Parameters

Parameter

Description

Log Source Identifier

Type the IP address or host name for the log source as an

identifier for events from your Check Point FireWall-1
appliance.

Step 11 Click Save.

Step 12 On the Admin tab, click Deploy Changes.

The configuration is complete.

IBM Security QRadar DSM Configuration Guide

130

CHECK POINT

Integrating Check
Point Firewall events
from external syslog
forwarders

Check Point Firewall events can be forwarded from external sources, such as
Splunk Forwarders or other third party syslog forwarders that send events to
QRadar.
When Check Point Firewall events are provided from external sources in syslog
format, the events identify with IP address in the syslog header. This causes
events to identify incorrectly when they are processed with the standard syslog
protocol. The syslog redirect protocol provides administrators a method to
substitute an IP address from the event payload into the syslog header to correctly
identify the event source.
To substitute an IP address, administrators must identify a common field from their
Check Point Firewall event payload that contains the proper IP address. For
example, events from Splunk Forwarders use orig= in the event payload to
identify the original IP address for the Check Point firewall. The protocol
substitutes in the proper IP address to ensure that the device is properly identified
in the log source. As Check Point Firewall events are forwarded, QRadar
automatically discovers and create new log sources for each unique IP address.
Substitutions are done with regular expressions and can support either TCP or
UDP syslog events. The protocol automatically configures iptables for the initial log
source and port configuration. If an administrator decides to change the port
assignment a Deploy Full Configuration is required to update the iptables
configuration and use the new port assignment.

Configuring a log
source for Check
Point forwarded
events

To collect raw events forwarded from an external source, you must configure a log
source before events are forwarded to QRadar.
Procedure

Step 1 Log in to QRadar.

Step 2 Click the Admin tab.
Step 3 In the navigation menu, click Data Sources.
Step 4 Click the Log Sources icon.
Step 5 Click Add.
Step 6 In the Log Source Name field, type a name for your log source.
Step 7 In the Log Source Description field, type a description for your log source.
Step 8 From the Log Source Type list box, select Check Point FireWall-1.
Step 9 From the Protocol Configuration list box, select Syslog Redirect.
Step 10 Configure the following values:

IBM Security QRadar DSM Configuration Guide

Check Point FireWall-1

131

Table 21-2 Syslog redirect protocol parameters

Parameter

Description

Log Source Identifier

Type the IP address or host name for the log source as an

identifier for the Check Point Firewall events.
The log source identifier must be unique value.

Log Source Identifier

RegEx

Type the regular expression (regex) required to identify the

Check Point Firewall IP address from the event payload.
For example, administrators can use the following regular
expression to parse Check Point Firewall events provided by
Splunk Forwarders.
orig=(\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3})

Listen Port

Type the port number used by QRadar to accept incoming

syslog redirect events.
The default listen port is 517.
The port number you configure must match the port that you
configured on the appliance that forwards the syslog events.
Administrators cannot specify port 514 in this field.

Protocol

From the list box, select either UDP or TCP.

The syslog redirect protocol supports any number of UDP
syslog connection, but restricts TCP connections to 2500. If
an administrator has more than 2500 log sources in the syslog
stream, a second Check Point log source and listen port
number is required.

Enabled

Select this check box to enable the log source. By default, the
check box is selected.

Credibility

From the list box, select the credibility of the log source. The
range is 0 - 10.
The credibility indicates the integrity of an event or offense as
determined by the credibility rating from the source devices.
Credibility increases if multiple sources report the same event.
The default is 5.

Target Event
Collector

From the list box, select the Event Collector to use as the
target for the log source.

Coalescing Events

Select this check box to enable the log source to coalesce

(bundle) events.
By default, automatically discovered log sources inherit the
value of the Coalescing Events list box from the System
Settings in QRadar. When you create a log source or edit an
existing configuration, you can override the default value by
configuring this option for each log source.

Incoming Event
Payload

From the list box, select the incoming payload encoder for
parsing and storing the logs.

IBM Security QRadar DSM Configuration Guide

132

CHECK POINT

Table 21-2 Syslog redirect protocol parameters (continued)

Parameter

Description

Store Event Payload

Select this check box to enable the log source to store event
payload information.
By default, automatically discovered log sources inherit the
value of the Store Event Payload list box from the System
Settings in QRadar. When you create a log source or edit an
existing configuration, you can override the default value by
configuring this option for each log source.

Step 11 Click Save.

Step 12 On the Admin tab, click Deploy Changes.

Check Point
Provider-1

You can configure QRadar to integrate with a Check Point Provider-1 device.
All events from Check Point Provider-1 are parsed using the Check Point
FireWall-1 DSM. You can integrate Check Point Provider-1 using one of the
following methods:

Integrating syslog for Check Point Provider-1

Configuring OPSEC for Check Point Provider-1

Note: Depending on your Operating System, the procedures for the Check Point
Provider-1 device can vary. The following procedures are based on the Check
Point SecurePlatform operating system.
Integrating syslog for
Check Point
Provider-1

This method ensures the Check Point FireWall-1 DSM for IBM Security QRadar
accepts Check Point Provider-1 events using syslog.
QRadar records all relevant Check Point Provider-1 events.
Configure syslog on Check Point Provider-1
To configure syslog on your Check Point Provider-1 device:

Step 1 Type the following command to access the console as an expert user:

expert

A password prompt is displayed.

Step 2 Type your expert console password. Press the Enter key.
Step 3 Type the following command:

csh
Step 4 Select the desired customer logs:

mdsenv <customer name>

Step 5 Type the following command:

IBM Security QRadar DSM Configuration Guide

Check Point Provider-1

133

# nohup $FWDIR/bin/fw log -ftn | /usr/bin/logger -p

<facility>.<priority> 2>&1 &

Where:
<facility> is a Syslog facility, for example, local3.
<priority> is a Syslog priority, for example, info.

You are now ready to configure the log source in QRadar.

The configuration is complete. The log source is added to QRadar as Check Point
Firewall-1 syslog events are automatically discovered. Events forwarded to
QRadar are displayed on the Log Activity tab.
Configure a log source
QRadar automatically discovers and creates a log source for syslog events from
Check Point Provider-1 as Check Point FireWall-1 events. The following
configuration steps are optional.
To manually configure a log source for Check Point Provider-1 syslog events:
Step 1 Log in to QRadar.
Step 2 Click the Admin tab.
Step 3 On the navigation menu, click Data Sources.

The Data Sources panel is displayed.

Step 4 Click the Log Sources icon.

The Log Sources window is displayed.

Step 5 Click Add.

The Add a log source window is displayed.

Step 6 In the Log Source Name field, type a name for your log source.
Step 7 In the Log Source Description field, type a description for the log source.
Step 8 From the Log Source Type list box, select Check Point Firewall-1.
Step 9 Using the Protocol Configuration list box, select Syslog.

The syslog protocol configuration is displayed.

Step 10 Configure the following values:

Table 21-3 Syslog Parameters

Parameter

Description

Log Source Identifier

Type the IP address or host name for the log source as an

identifier for events from your Check Point Provider-1
appliance.

Step 11 Click Save.

Step 12 On the Admin tab, click Deploy Changes.

The configuration is complete.

IBM Security QRadar DSM Configuration Guide

134

CHECK POINT

Configuring OPSEC
for Check Point
Provider-1

This method ensures the QRadar Check Point FireWall-1 DSM accepts Check
Point Provider-1 events using OPSEC.
Reconfigure Check Point Provider-1 SmartCenter
This section describes how to reconfigure the Check Point Provider-1
SmartCenter.
In the Check Point Provider-1 Management Domain GUI (MDG), create a host
object representing the QRadar. The leapipe is the connection between the Check
Point Provider-1 and QRadar.
To reconfigure the Check Point Provider-1 SmartCenter (MDG):

Step 1 To create a host object, open the Check Point SmartDashboard user interface and

select Manage > Network Objects > New > Node > Host.
Step 2 Type the Name, IP Address, and optional Comment for your host.
Step 3 Click OK.
Step 4 Select Close.
Step 5 To create the OPSEC connection, select Manage > Servers and OPSEC

Applications New > OPSEC Application Properties.

Step 6 Type a name and optional comment.

The name you type must be different than the name used in Step 2.
Step 7 From the Host drop-down menu, select the QRadar host object that you just

created.
Step 8 From Application Properties, select User Defined as the Vendor type.
Step 9 From Client Entries, select LEA.
Step 10 Configure the Secure Internal Communication (SIC) certificate, click

Communication and enter an activation key.

Step 11 Select OK and then Close.
Step 12 To install the Policy on your firewall, select Policy > Install > OK.

Configure an OPSEC log source

To configure the log source in QRadar:
Step 1 Log in to QRadar.
Step 2 Click the Admin tab.
Step 3 On the navigation menu, click Data Sources.

The Data Sources panel is displayed.

Step 4 Click the Log Sources icon.

The Log Sources window is displayed.

Step 5 Click Add.

The Add a log source window is displayed.

IBM Security QRadar DSM Configuration Guide

Check Point Provider-1

135

Step 6 From the Log Source Type list box, select Check Point FireWall-1.
Step 7 Using the Protocol Configuration list box, select OPSEC/LEA.

The OPSEC/LEA protocol parameters appear.

Step 8 Configure the following values:
a

Log Source Name - Type a name for the log source.

b Log Source Identifier - Type the IP address for the log source. This value must

match the value you typed in the Server IP parameter.

c

Server IP - Type the IP address of the Check Point Provider-1.

Server Port - Type the port used for OPSEC/LEA. The default is 18184.
You must ensure the existing firewall policy permits the LEA/OPSEC
connection from your QRadar.

OPSEC Application Object SIC Attribute - Type the SIC DN of the OPSEC
Application Object.

Log Source SIC Attribute - Type the SIC name for the server generating the
log source.
SIC attribute names can be up to 255 characters in length and are case
sensitive.

Specify Certificate - Ensure the Specify Certificate check box is clear.

Pull Certificate Password - Type the activation key password.

Certificate Authority IP - Type the Check Point Manager Server IP address.

OPSEC Application - Type the name of the application requesting a certificate.

For example:

If the value is CN=QRadar-OPSEC,O=cpmodule...tdfaaz, the OPSEC

Application value is QRadar-OPSEC.
Step 9 Click Save.
Step 10 On the Admin tab, click Deploy Changes.

The configuration is complete. For detailed information on the OPSEC/LEA

protocol, see the IBM Security QRadar Log Sources User Guide.

IBM Security QRadar DSM Configuration Guide