Check Point FW1 VPN1

You can configure collecting Check Point FW1/VPN1 logs using a Broker VM Syslog Collector applet or with a content pack integration:

Check Point FW1/VPN1 vendor	Description
Syslog Collector applet overview	If you use Check Point FW1/VPN1 firewalls, you can forward Check Point firewall logs to Cortex XSIAM using the Broker VM Syslog Collector applet in a CEF format.
Link to Syslog Collector applet instructions	Ingest logs from Check Point firewalls
Link to content pack/integration details	The Check Point Firewall content pack manages Check Point firewall devices via API, allowing the reading information, sending commands, and orchestrating configuration and blocking actions. It contains a modeling rule (CheckPoint Firewall Collection) and several playbooks (for example Checkpoint - Block IP - Append Group, Checkpoint - Publish&Install configuration, Checkpoint - Block IP - Custom Block Rule, and Checkpoint - Block URL). It also includes the following integration: CheckPoint Firewall v2: Use this integration to read information and send commands to the Check Point Firewall server. It includes commands for handling threat protection and profiles, such as checkpoint-set-threat-protection and checkpoint-add-threat-profile.