Configuring the SmartEvent Clients
Configuring SmartEvent
Page 25
Defining the Internal Network for SmartEvent
To help SmartEvent Intro determine whether events originated internally or externally, the Internal Network
must be defined. Certain network objects are copied from the management server to the SmartEvent Intro
server during the initial synchronization and updated afterwards periodically. Define the Internal Network
from these objects.
Note
- If running IPS Event Analysis in a Security Management Server environment, the internal network will
be defined automatically from firewall topology information. You can customize the internal network
definition.
To define the Internal Network:
1. Start the SmartEvent Intro Client.
2. From the
Policy
view, select
General Settings > Initial Settings > Internal Network
.
3. Add objects (hosts, networks, groups, IP ranges) that define your environment's internal network.
Defining Correlation Units and Log Servers for
SmartEvent
1. From the
Policy
view of the SmartEvent Intro client, select
General Settings > Initial Settings >
Correlation Units
.
2. Select
Add
.
3. Click the button of the
Correlation Unit
field.
4. In the
Select Objects
window, select a Correlation Unit.
5. Click
OK
.
6. Click
Add
and select the Log Servers available as data sources to the Correlation Unit.
7. Select
Save
.
8. From the
Actions
menu, select
Install Events policy
.
At this point, SmartEvent Intro will begin to read logs and detect events.
To learn how to manage and fine-tune the system using the SmartEvent Intro Client, see the
SmartEvent
Administration Guide
for your software version on the Check Point Support Center
http://supportcenter.checkpoint.com
).
Creating a Consolidation Session for SmartReporter
The Consolidation session reads logs from the log server and adds them to the SmartReporter database.
If there is a single log server in the environment, the Consolidation session is automatically created.
If there is more than one log server, you must create the Consolidation session for each log server.
To create a Consolidation session:
1. In the
Selection Bar
view, select
Management > Consolidation
.
2. Select the
Sessions
tab.
3. Click
Create New
to create a new session.
The
New Consolidation Session
window appears.
4. Select the log server from which logs will be collected and will be used to generate reports.
5. Click
Next
.
The
New Consolidation Session
window appears.
6. Choose whether to use the default source logs and database tables, or select custom source logs and
database tables for consolidation.
If you selected
Select default log files and database
, click
Finish
to complete the process. The source of
the reports will be preselected logs. The report data will be stored in the default database table named
CONNECTIONS. The preselected logs are the sequence of log files that are generated by Check Point
products. The preselected logs session will begin at the beginning of the last file in the sequence, or at the
point the sequence was stopped.