Enterasys Security Information and Event Manager, Configuration Manual

Page: 61 / 426

Configuring DSMs
Check Point FireWall-1 45
For more information on configuring log sources, see the Log Sources User Guide .
For more information about Check Point FireWall-1, see the Check Point
FireWall-1 documentation.
Integrating Check
Point FireWall-1
Using OPSEC
This section describes how to ensure that the SIEM Check Point FireWall-1 DSM
accepts events using Open Platform for Security (OPSEC/LEA). When integrating
Check Point OPSEC/LEA with SIEM, you must create two Secure Internal
Communication (SIC) files and enter the information in to SIEM as a Check Point
Firewall-1 log source.
To integrate Check Point Firewall-1 with SIEM, you must complete the following
procedures in sequence:
•
Add SIEM as a host for Check Point FireWall-1. See Adding a Check Point
FireWall-1 Host .
•
Add an OPSEC application to Check Point Firewall-1. See Creating an OPSEC
Application Object .
•
Locate the Log Source Secure Internal Communications DN. See Locate the
Log Source SIC .
•
In SIEM, configure the OPSEC LEA protocol. See Configuring SIEM
OPSEC/LEA Parameters .
•
Verify the OPSEC/LEA communications configuration. See Verifying or
Changing the OPSEC Communications Configuration .
Adding a Check Point FireWall-1 Host
To add SIEM as a host in Check Point FireWall-1 SmartCenter:
Step 1
Log in to the Check Point SmartDashboard user interface.
Step 2
Select Manage > Network Objects > New > Node > Host .
Step 3
Type parameters for your Check Point Firewall-1 host:
Name:
SIEM
IP Address:
<IP address of SIEM system or Event Processor>
Comment:
<Optional>
Step 4
Click OK .
Step 5
Select Close .
You are now ready to create an OPSEC Application Object for Check Point
Firewall-1. See
Creating an OPSEC Application Object .