Check Point Smart-1 205, Getting Started Manual

Page: 30 / 114

Configuring SmartEvent
30 | Smart-1 205/210 Appliances Getting Started Guide
Note
- If running SmartEvent in a Security Management Server environment,
the internal network will be defined automatically from firewall topology
information. You can customize the internal network definition
In a Multi-Domain Security Management environment, define an internal network for
each Domain Management Server.
To define the Internal Network:
1. Start the SmartEvent Client.
2. From the
Policy
view, select
General Settings > Initial Settings > Internal
Network
.
3. Add objects (hosts, networks, groups, IP ranges) that define your environment's
internal network.
Defining Correlation Units and Log Servers for
SmartEvent
1. From the
Policy
view of the SmartEvent client, select
General Settings > Initial
Settings > Correlation Units
.
2. Select Add .
3. Click the button of the
Correlation Unit
field.
4. In the
Select Objects
window, select a Correlation Unit.
5. Click OK .
6. Click
Add
and select the Log Servers available as data sources to the Correlation
Unit.
Note - In a Multi-Domain Security Management environment, add the Log Servers
for each Domain Management Server.
7. Select Save .
8. From the
Actions
menu, select
Install Event policy
.
At this point, SmartEvent will begin to read logs and detect events.
To learn how to manage and fine-tune the system using the SmartEvent Client, see the
SmartEvent Administration Guide
for your software version on the Check Point
Support Center http://supportcenter.checkpoint.com .