Re: Checkpoint FW Logs

There are various ways of proactivly monitoring them, but for a simple 
plug-n-play look at the products from Loglogic. Basically you can have 
your logs setup to goto a central location and then have them monitored 
by filters for invalid access requests, deny rules, or anythign else you 
can have the checkpoint find.

Those can then either be emailed to an admin to start reviewing or sent 
as an snmp trap out to a central monitor so the NOC can proeed with 
their own procedures.

Logs are only good if you watch them :)

dmz
Andy Ha wrote:

> Does anyone know how to proactively utilize the Checkpoint firewall logs?  What 
> value can it bring if we proactively monitor it?  Any idea?
> Thanks.
>
> --------------------------------------------------------------------------
> Test Your IDS
>
> Is your IDS deployed correctly?
> Find out quickly and easily by testing it with real-world attacks from 
> CORE IMPACT.
> Go to http://www.securityfocus.com/sponsor/CoreSecurity_focus-ids_040708 
> to learn more.
> --------------------------------------------------------------------------
>
>
>
>
>  


--------------------------------------------------------------------------
Test Your IDS

Is your IDS deployed correctly?
Find out quickly and easily by testing it with real-world attacks from 
CORE IMPACT.
Go to http://www.securityfocus.com/sponsor/CoreSecurity_focus-ids_040708 
to learn more.
--------------------------------------------------------------------------