Welcome to lesson 12. Today we will talk about another very important topic, namely working with logs and reports. Sometimes this functionality turns out to be decisive when choosing a protection tool. Security professionals really appreciate a convenient reporting system and functional search across various events. It's hard to blame them for this. Essentially, logs and reports are critical elements in assessing security. How to understand the current level of security if you can't see what's happening? Fortunately, Check Point excels in this area and even more. Check Point has one of the best reporting systems that works out of the box! Furthermore, there is the possibility of customization and creating your own reports! All this is complemented by a user-friendly and intuitive process for working with logs. But let's go through everything step by step.
A completely new interface
If you worked with Check Point before, you must have been surprised by the entirely new interface for working with logs and reports in R80. The picture shows how many different utilities have been combined within one new tab Logs & Monitor:
The Logs & Monitor section
If you go to Logs & Monitor and open a new tab, you should see something like this:
By default, there are two large sections here:
- Audit Logs View — here you can find all events related to administrator logins/logouts, configuration changes, etc. In other words, a classic audit of administrator actions.
- Logs View — this is where you can search for events generated by all our active blades, be it firewall, antivirus, IPS, etc. We've used this feature many times.
In addition, there are links to reports (Reports) and various dashboards (Views). Their operation requires the active blade Smart Event. But we'll discuss this a bit later. First, let's delve into working with logs.
Log search
In my opinion, working with logs in R80 is a pleasure. We have a fairly smart search bar that allows us to search using arbitrary text, blades, and any other indexable parameters like source, destination, action, etc.
At the same time, we can create quite complex search queries using logical operators. AND, OR, NOTAnd for this, you don't even need to type anything. You can create a filter in just a couple of mouse clicks. We'll try this out in practice a little later.
Displaying Log Messages by Access-List
We have already assessed the ability to display logs by a specific access list. This is incredibly convenient, and you quickly get used to it. It's especially helpful during troubleshooting. You select the access list that interests you and check below to see if the required traffic is covered.
There's no need to go anywhere or create a complex filter for the logs.
Views & Reports
The blade responsible for reporting and data visualization in Check Point Smart Eventis activated on server management. This functionality can confidently be called a SIEM, but only for Check Point products! Technically, Smart Event can handle logs from other systems (like Cisco, Microsoft, etc.), but that's not the best idea 🙂 In practice, it can be quite problematic. However, when it comes to Check Point logs, Smart Event handles it superbly. It can correlate, summarize, average, and much more. And all of this works out of the box! Naturally, there are already ready-made dashboards for displaying the most important information. In Check Point, they are called Views:
You can see that there is quite a large number of default dashboards that are very useful for everyday administration and monitoring.
Besides dashboards, where information is simply visualized, there is the possibility of generating full reports and saving them in PDF or Excel format. You can generate them on a schedule and send them to any email inbox.
And the best part! Dashboards and reports can be created by you! That is, you're not limited to the built-in ones. Not every vendor can boast this. Moreover, the templates for these dashboards or reports can be imported or exported, allowing users to share their creations. The process of creating a dashboard is quite simple and intuitive. I will try to show you this in the lab work you will find in the video lesson below.
Video lesson
Stay tuned for more and join our 🙂
Source: habr.com
