{"id":33772,"date":"2019-10-31T21:54:36","date_gmt":"2019-10-31T18:54:36","guid":{"rendered":"https:\/\/prohoster.info\/blog\/12-check-point-getting-started-r80-20-logs-reports\/"},"modified":"2019-10-31T21:54:36","modified_gmt":"2019-10-31T18:54:36","slug":"12-check-point-getting-started-r80-20-logs-reports","status":"publish","type":"post","link":"https:\/\/prohoster.info\/cs\/blog\/administrirovanie\/12-check-point-getting-started-r80-20-logs-reports","title":{"rendered":"12. Check Point \u00davod R80.20. Logy & Reporty","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

\"12.
\n
\nV\u00edtejte na 12. lekci. Dnes budeme hovo\u0159it o dal\u0161\u00ed velmi d\u016fle\u017eit\u00e9 t\u00e9matice, a to o pr\u00e1ci s protokoly a zpr\u00e1vami<\/b>. N\u011bkdy se tato funk\u010dnost uk\u00e1\u017ee jako rozhoduj\u00edc\u00ed p\u0159i v\u00fdb\u011bru ochrann\u00e9ho prost\u0159edku. Ochrann\u00e9 syst\u00e9my si opravdu obl\u00edbily pohodln\u00fd syst\u00e9m reportov\u00e1n\u00ed a funk\u010dn\u00ed vyhled\u00e1v\u00e1n\u00ed podle r\u016fzn\u00fdch ud\u00e1lost\u00ed. Nen\u00ed se \u010demu divit. V podstat\u011b jsou protokoly a reporty kl\u00ed\u010dov\u00fdm prvkem hodnocen\u00ed \u00farovn\u011b zabezpe\u010den\u00ed. Jak pochop\u00edte aktu\u00e1ln\u00ed \u00farove\u0148 bezpe\u010dnosti, kdy\u017e nevid\u00edte, co se d\u011bje? Na\u0161t\u011bst\u00ed m\u00e1 Check Point v tomto ohledu v\u0161e v naprost\u00e9m po\u0159\u00e1dku a dokonce i v\u00edce. Check Point m\u00e1 jeden z nejlep\u0161\u00edch syst\u00e9m\u016f reportov\u00e1n\u00ed, kter\u00fd funguje ihned \u201ez krabi\u010dky\u201c. Z\u00e1rove\u0148 je zde mo\u017enost p\u0159izp\u016fsoben\u00ed a vytv\u00e1\u0159en\u00ed vlastn\u00edch report\u016f! To v\u0161e je dopln\u011bno pohodln\u00fdm a intuitivn\u00edm procesem pr\u00e1ce s protokoly. Ale poj\u010fme na to postupn\u011b.<\/a><\/noindex><\/p>\n

\u00dapln\u011b nov\u00e9 rozhran\u00ed<\/h3>\n

\nPokud jste s Check Pointem pracovali d\u0159\u00edve, ur\u010dit\u011b v\u00e1s p\u0159ekvapilo zcela nov\u00e9 rozhran\u00ed pro pr\u00e1ci s protokoly a zpr\u00e1vami v R80. Na obr\u00e1zku je vid\u011bt, kolik r\u016fzn\u00fdch n\u00e1stroj\u016f bylo slou\u010deno do jedn\u00e9 nov\u00e9 z\u00e1lo\u017eky Logs & Monitor<\/b>:<\/p>\n

\"12.
\n<\/p>\n

Sekce Logs & Monitor<\/h3>\n

\nPokud p\u0159ejdete do Logs & Monitor a otev\u0159ete novou z\u00e1lo\u017eku, m\u011bli byste vid\u011bt n\u011bco takov\u00e9ho:<\/p>\n

\"12.
\n
\nVe v\u00fdchoz\u00edm nastaven\u00ed zde jsou dva velk\u00e9 odd\u00edly:<\/p>\n

    \n
  1. Audit Logs View<\/b> \u2014 zde m\u016f\u017eete naj\u00edt v\u0161echny ud\u00e1losti souvisej\u00edc\u00ed se vstupy\/v\u00fdstupy administr\u00e1tor\u016f, zm\u011bnami v konfiguraci atd. Tedy klasick\u00fd audit \u010dinnost\u00ed administr\u00e1tora.<\/li>\n
  2. Logs View<\/b> \u2014 pr\u00e1v\u011b zde m\u016f\u017eete vyhled\u00e1vat podle ud\u00e1lost\u00ed, kter\u00e9 \u201egeneruj\u00ed\u201c v\u0161echny na\u0161e aktivovan\u00e9 bledy, a\u0165 u\u017e je to firewall, antivirus, IPS atd. U\u017e jsme mnohokr\u00e1t tuto funkci pou\u017e\u00edvali.<\/li>\n<\/ol>\n

    \nKrom\u011b toho zde najdete odkazy na zpr\u00e1vy (Reports<\/b>) a r\u016fzn\u00e9 dashboardy (Views<\/b>). Pro jejich funkci je pot\u0159ebn\u00fd aktivovan\u00fd bled Smart Event<\/b>. Ale o tom pozd\u011bji. Nejprve se poj\u010fme pod\u00edvat na pr\u00e1ci s protokoly.<\/p>\n

    Vyhled\u00e1v\u00e1n\u00ed v logech<\/h3>\n

    \nPodle m\u00e9ho n\u00e1zoru je pr\u00e1ce s protokoly v R80 skute\u010dn\u00fdm pot\u011b\u0161en\u00edm. M\u00e1me velmi chytrou vyhled\u00e1vac\u00ed li\u0161tu, kter\u00e1 n\u00e1m umo\u017e\u0148uje \u201e\u0159ezat\u201c jak pomoc\u00ed libovoln\u00e9ho textu, tak podle bled\u016f a dal\u0161\u00edch indexovateln\u00fdch parametr\u016f jako jsou source, destination, action atd.<\/p>\n

    \"12.
    \n
    \nP\u0159itom m\u016f\u017eeme sestavovat velmi slo\u017eit\u00e9 vyhled\u00e1vac\u00ed dotazy pomoc\u00ed logick\u00fdch oper\u00e1tor\u016f A<\/b>, Nebo<\/b>, NOT<\/b>. A pro to je dokonce mo\u017en\u00e9 nic netisknout. Filtr lze vytvo\u0159it doslova ve dvou kliknut\u00edch my\u0161\u00ed. Za chv\u00edli si to spole\u010dn\u011b vyzkou\u0161\u00edme v praxi.<\/p>\n

    Zobrazen\u00ed Log zpr\u00e1v podle Access-Listu<\/h3>\n

    \nTak\u00e9 jsme ji\u017e ohodnotili mo\u017enost zobrazit logy podle konkr\u00e9tn\u00edho seznamu p\u0159\u00edstupu. To je nesm\u00edrn\u011b pohodln\u00e9 a rychle si na to zvyk\u00e1te. Zejm\u00e9na to pom\u00e1h\u00e1 p\u0159i odhalov\u00e1n\u00ed probl\u00e9m\u016f. Vyberete zaj\u00edmav\u00fd \u201eaccess-list\u201c a sledujete doln\u00ed \u010d\u00e1st, zda odpov\u00edd\u00e1 po\u017eadovan\u00e9mu provozu. <\/p>\n

    \"12.
    \n
    \nNen\u00ed pot\u0159eba nikam p\u0159ech\u00e1zet nebo sestavovat slo\u017eit\u00fd filtr pro logy.<\/p>\n

    Zobrazen\u00ed a zpr\u00e1vy<\/h3>\n

    \nZa reportov\u00e1n\u00ed a vizualizaci dat v Check Pointu odpov\u00edd\u00e1 blade Smart Event<\/b>, kter\u00fd se aktivuje na serveru<\/a> spr\u00e1vu. Tuto funkci lze s jistotou nazvat SIEM, ale pouze pro produkty Check Point! Technicky lze na Smart Event obracet logy i z jin\u00fdch syst\u00e9m\u016f (nap\u0159. Cisco, Microsoft atd.), ale to nen\u00ed nejlep\u0161\u00edm n\u00e1padem \ud83d\ude42 V praxi je to velmi problematick\u00e9. Ale s logy \u201echeck pointu\u201c si SmartEvent porad\u00ed skv\u011ble. M\u016f\u017ee korelovat, sumarizovat, pr\u016fm\u011brovat a mnoho dal\u0161\u00edho. A to v\u0161e funguje hned po vybalen\u00ed! Samoz\u0159ejm\u011b existuj\u00ed ji\u017e hotov\u00e9 dashboardy pro zobrazen\u00ed nejd\u016fle\u017eit\u011bj\u0161\u00edch informac\u00ed. V Check Pointu se naz\u00fdvaj\u00ed Views<\/b>:<\/p>\n

    \"12.
    \n
    \nM\u016f\u017eete vid\u011bt, \u017ee zde je pom\u011brn\u011b velk\u00e9 mno\u017estv\u00ed v\u00fdchoz\u00edch dashboard\u016f, kter\u00e9 jsou velmi u\u017eite\u010dn\u00e9 pro ka\u017edodenn\u00ed administraci a monitorov\u00e1n\u00ed.<\/p>\n

    Krom\u011b dashboard\u016f, kde jsou informace pouze vizualizov\u00e1ny, existuje mo\u017enost generace plnohodnotn\u00fdch report\u016f a jejich ulo\u017een\u00ed do form\u00e1tu pdf nebo excel. M\u016f\u017eete je generovat podle pl\u00e1nu a pos\u00edlat je na n\u011bjakou e-mailovou adresu.<\/p>\n

    A to nejlep\u0161\u00ed! Dashboardy a reporty si m\u016f\u017eete vytv\u00e1\u0159et sami! To znamen\u00e1, \u017ee nejste omezeni pouze na vestav\u011bn\u00e9. T\u00edm se nem\u016f\u017ee chlubit ka\u017ed\u00fd dodavatel. \u0160ablony t\u011bchto dashboard\u016f nebo report\u016f je tak\u00e9 mo\u017en\u00e9 importovat nebo exportovat, co\u017e u\u017eivatel\u016fm umo\u017e\u0148uje sd\u00edlet sv\u00e9 v\u00fdstupy. Samotn\u00fd proces vytv\u00e1\u0159en\u00ed dashboardu je velmi jednoduch\u00fd a intuitivn\u00ed. Pokus\u00edm se v\u00e1m to uk\u00e1zat v r\u00e1mci laboratorn\u00ed pr\u00e1ce, kterou najdete ve videu n\u00ed\u017ee.<\/p>\n

    Video lekce<\/h3>\n

    \n

    \r\n \"P\u0159ehr\u00e1t\r\n
    <\/div>\r\n <\/div><\/center><\/p>\n

    Z\u016fsta\u0148te nalad\u011bni na dal\u0161\u00ed a p\u0159ipojte se k na\u0161emu YouTube kan\u00e1lu<\/a><\/noindex> \ud83d\ude42
    \n
    Zdroj:     habr.com<\/a><\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"

    \u0414\u043e\u0431\u0440\u043e \u043f\u043e\u0436\u0430\u043b\u043e\u0432\u0430\u0442\u044c \u043d\u0430 12-\u0439 \u0443\u0440\u043e\u043a. \u0421\u0435\u0433\u043e\u0434\u043d\u044f \u043c\u044b \u043f\u043e\u0433\u043e\u0432\u043e\u0440\u0438\u043c \u043e \u0435\u0449\u0435 \u043e\u0434\u043d\u043e\u0439 \u0432\u0435\u0441\u044c\u043c\u0430 \u0432\u0430\u0436\u043d\u043e\u0439 \u0442\u0435\u043c\u0435, \u0430 \u0438\u043c\u0435\u043d\u043d\u043e \u043e \u0440\u0430\u0431\u043e\u0442\u0435 \u0441 \u043b\u043e\u0433\u0430\u043c\u0438 \u0438 \u043e\u0442\u0447\u0435\u0442\u0430\u043c\u0438. \u041f\u043e\u0440\u043e\u0439 \u0434\u0430\u043d\u043d\u0430\u044f \u0444\u0443\u043d\u043a\u0446\u0438\u043e\u043d\u0430\u043b\u044c\u043d\u043e\u0441\u0442\u044c \u043e\u043a\u0430\u0437\u044b\u0432\u0430\u0435\u0442\u0441\u044f \u0447\u0443\u0442\u044c \u043b\u0438 \u043d\u0435 \u0440\u0435\u0448\u0430\u044e\u0449\u0435\u0439 \u043f\u0440\u0438 \u0432\u044b\u0431\u043e\u0440\u0435 \u0441\u0440\u0435\u0434\u0441\u0442\u0432\u0430 \u0437\u0430\u0449\u0438\u0442\u044b. \u041e\u0447\u0435\u043d\u044c \u0443\u0436 \u043b\u044e\u0431\u044f\u0442 \u00ab\u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u0438\u043a\u0438\u00bb \u0443\u0434\u043e\u0431\u043d\u0443\u044e \u0441\u0438\u0441\u0442\u0435\u043c\u0443 \u043e\u0442\u0447\u0435\u0442\u043d\u043e\u0441\u0442\u0438 \u0438 \u0444\u0443\u043d\u043a\u0446\u0438\u043e\u043d\u0430\u043b\u044c\u043d\u044b\u0439 \u043f\u043e\u0438\u0441\u043a \u043f\u043e \u0440\u0430\u0437\u043b\u0438\u0447\u043d\u044b\u043c \u0441\u043e\u0431\u044b\u0442\u0438\u044f\u043c. \u0422\u0440\u0443\u0434\u043d\u043e \u0438\u0445 \u0432 \u044d\u0442\u043e\u043c \u0432\u0438\u043d\u0438\u0442\u044c. \u041f\u043e \u0441\u0443\u0442\u0438, \u043b\u043e\u0433\u0438 […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":25448,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[688],"tags":[],"class_list":["post-33772","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-administrirovanie"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd4712. Check Point Za\u010d\u00edn\u00e1me R80.20. Logy a reporty | ProHoster","description":"V\u00edtejte na 12. lekci.","canonical_url":"https:\/\/prohoster.info\/cs\/blog\/administrirovanie\/12-check-point-getting-started-r80-20-logs-reports","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"cs_CZ","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd4712. Check Point Getting Started R80.20. Logs & Reports | ProHoster","og:description":"\u0414\u043e\u0431\u0440\u043e \u043f\u043e\u0436\u0430\u043b\u043e\u0432\u0430\u0442\u044c \u043d\u0430 12-\u0439 \u0443\u0440\u043e\u043a.","og:url":"https:\/\/prohoster.info\/cs\/blog\/administrirovanie\/12-check-point-getting-started-r80-20-logs-reports","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2019-10-31T18:54:36+00:00","article:modified_time":"2019-10-31T18:54:36+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"33772","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":null,"schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":"2026-02-09 21:46:18","breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2021-03-01 02:34:11","updated":"2026-02-09 21:46:18","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/posts\/33772","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/comments?post=33772"}],"version-history":[{"count":1,"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/posts\/33772\/revisions"}],"predecessor-version":[{"id":159761,"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/posts\/33772\/revisions\/159761"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/media\/25448"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/media?parent=33772"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/categories?post=33772"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/tags?post=33772"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}