Enterasys Security Information and Event Manager, Configuration Manual

Page: 59 / 426

Configuring DSMs
13 C
HECK
P
OINT
This section provides information on the following DSMs:
• Check Point FireWall-1
•
Check Point Provider-1
Check Point
FireWall-1
You can configure SIEM to integrate with a Check Point FireWall-1 device using
one of the following methods:
• Integrating Check Point FireWall-1 Using Syslog
• Integrating Check Point FireWall-1 Using OPSEC
NOTE
Depending on your Operating System, the procedures for the Check Point
FireWall-1 device may vary. The following procedures are based on the Check
Point SecurePlatform Operating system.
Integrating Check
Point FireWall-1
Using Syslog
This section describes how to ensure that the SIEM Check Point FireWall-1 DSMs
accepts FireWall-1 events using syslog.
NOTE
If Check Point SmartCenter is installed on Microsoft Windows, you must integrate
Check Point with SIEM using OPSEC. For more information, see
Integrating
Check Point FireWall-1 Using OPSEC .
Before you configure SIEM to integrate with a Check Point FireWall-1 device:
Step 1
Type the following command to access the Check Point console as an expert user:
expert
A password prompt is displayed.
Step 2
Type your expert console password. Press the Enter key.
Step 3
Open the following file:
/etc/rc.d/rc3.d/S99local
Step 4
Add the following lines: