Coletar registros do firewall do Check Point

Versão do analisador:34.0

Compatível com:

Este documento explica como ingerir registros de firewall do Check Point no Google Security Operations usando o agente Bindplane.

Os firewalls da Check Point geram registros para conexões de rede, eventos de segurança, atividade de VPN, prevenção de ameaças e operações administrativas. O analisador extrai campos de chave-valor e CEF e os mapeia para o modelo de dados unificado (UDM).

Antes de começar

Verifique se você tem os pré-requisitos a seguir:

  • Uma instância do Google SecOps
  • Windows Server 2016 ou mais recente ou host Linux com systemd
  • Conectividade de rede entre o agente do Bindplane e o firewall do Check Point
  • Se você estiver executando por trás de um proxy, verifique se as portas do firewall estão abertas de acordo com os requisitos do agente do Bindplane.
  • Acesso privilegiado à UI do firewall do Check Point

Receber o arquivo de autenticação de ingestão do Google SecOps

  1. Faça login no console do Google SecOps.
  2. Acesse Configurações do SIEM > Agentes de coleta.
  3. Baixe o arquivo de autenticação de ingestão.

  4. Salve o arquivo com segurança no sistema em que o agente do Bindplane será instalado.

Receber o ID de cliente do Google SecOps

  1. Faça login no console do Google SecOps.
  2. Acesse Configurações do SIEM > Perfil.

  3. Copie e salve o ID do cliente na seção Detalhes da organização.

Instalar o agente do BindPlane

Instale o agente do Bindplane no seu sistema operacional Windows ou Linux de acordo com as instruções a seguir.

Instalação do Windows

  1. Abra o prompt de comando ou o PowerShell como administrador.

  2. Execute este comando:

    msiexec /i "https://github.com/observIQ/bindplane-agent/releases/latest/download/observiq-otel-collector.msi" /quiet

  3. Aguarde a conclusão da instalação.

  4. Execute o seguinte comando para confirmar a instalação:

    sc query observiq-otel-collector

    O serviço vai aparecer como EM EXECUÇÃO.

Instalação do Linux

  1. Abra um terminal com privilégios de root ou sudo.

  2. Execute este comando:

    sudo sh -c "$(curl -fsSlL https://github.com/observiq/bindplane-agent/releases/latest/download/install_unix.sh)" install_unix.sh

  3. Aguarde a conclusão da instalação.

  4. Execute o seguinte comando para confirmar a instalação:

    sudo systemctl status observiq-otel-collector

    O serviço vai aparecer como ativo (em execução).

Outros recursos de instalação

Para mais opções de instalação e solução de problemas, consulte o guia de instalação do agente do Bindplane.

Configurar o agente do Bindplane para ingerir syslog e enviar ao Google SecOps

Localizar o arquivo de configuração

  • Linux:

    sudo nano /etc/bindplane-agent/config.yaml

  • Windows:

    notepad "C:\Program Files\observIQ OpenTelemetry Collector\config.yaml"

Editar o arquivo de configuração

  • Substitua todo o conteúdo de config.yaml pela seguinte configuração:

    receivers:
    udplog:
        listen_address: "0.0.0.0:514"

exporters:
    chronicle/checkpoint_firewall:
        compression: gzip
        creds_file_path: '/etc/bindplane-agent/ingestion-auth.json'
        customer_id: '<customer_id>'
        endpoint: malachiteingestion-pa.googleapis.com
        log_type: CHECKPOINT_FIREWALL
        raw_log_field: body

service:
    pipelines:
        logs/checkpoint_firewall_to_chronicle:
            receivers:
                - udplog
            exporters:
                - chronicle/checkpoint_firewall

Parâmetros de configuração

Substitua os seguintes marcadores de posição:

  • Configuração do receptor:

    • listen_address: endereço IP e porta a serem detectados:
      • 0.0.0.0 para ouvir em todas as interfaces (recomendado)
      • A porta 514 é a porta padrão do syslog (requer raiz no Linux; use 1514 para não raiz).

  • Configuração do exportador:

    • creds_file_path: caminho completo para o arquivo de autenticação de ingestão:
      • Linux: /etc/bindplane-agent/ingestion-auth.json
      • Windows: C:\Program Files\observIQ OpenTelemetry Collector\ingestion-auth.json
    • customer_id: ID do cliente copiado do console do Google SecOps
    • endpoint: URL do endpoint regional:
      • EUA: malachiteingestion-pa.googleapis.com
      • Europa: europe-malachiteingestion-pa.googleapis.com
      • Ásia: asia-southeast1-malachiteingestion-pa.googleapis.com
      • Consulte a lista completa em Endpoints regionais.

Salvar o arquivo de configuração

  • Depois de editar, salve o arquivo:
    • Linux: pressione Ctrl+O, Enter e Ctrl+X.
    • Windows: clique em Arquivo > Salvar.

Reinicie o agente do Bindplane para aplicar as mudanças.

  • Para reiniciar o agente do Bindplane no Linux, execute o seguinte comando:

    sudo systemctl restart observiq-otel-collector

    1. Verifique se o serviço está em execução:

      ```bash
sudo systemctl status observiq-otel-collector
```

    2. Verifique se há erros nos registros:

      ```bash
sudo journalctl -u observiq-otel-collector -f
```

  • Para reiniciar o agente do Bindplane em Windows, escolha uma das seguintes opções:

    • Prompt de comando ou PowerShell como administrador:

      net stop observiq-otel-collector && net start observiq-otel-collector

    • Console de serviços:

      1. Pressione Win+R, digite services.msc e pressione Enter.
      2. Localize o Coletor do OpenTelemetry da observIQ.
      3. Clique com o botão direito do mouse e selecione Reiniciar.

      4. Verifique se o serviço está em execução:

        sc query observiq-otel-collector

      5. Verifique se há erros nos registros:

        type "C:\Program Files\observIQ OpenTelemetry Collector\log\collector.log"

Configurar a exportação do syslog em um firewall da Check Point

  1. Faça login na UI do firewall Check Point usando uma conta privilegiada.
  2. Acesse Logging e monitoramento > Servidores de registros.
  3. Acesse Servidores Syslog.
  4. Clique em Configurar e defina os seguintes valores:
    • Protocolo: selecione UDP para enviar registros de segurança e/ou do sistema.
    • Nome: insira um nome exclusivo (por exemplo, Bindplane_Server).
    • Endereço IP: informe o endereço IP do servidor syslog (IP do Bindplane).
    • Porta: informe a porta do servidor syslog (porta do Bindplane).
  5. Selecione Ativar servidor de registros.
  6. Selecione os registros a serem encaminhados: Registros do sistema e de segurança.
  7. Clique em Aplicar.

Tabela de mapeamento de UDM

| proto | event.idm.read_only_udm.network.application_protocol | Mapeado do registro de alterações | | helo | event.idm.read_only_udm.additional.fields | Mapeado do registro de alterações | | inner_syslog_priority | event.idm.read_only_udm.additional.fields | Mapeado do registro de alterações | | principal_ip | event.idm.read_only_udm.principal.ip e event.idm.read_only_udm.principal.asset.ip | Mapeado do registro de alterações | | syslog_priority | event.idm.read_only_udm.additional.fields | Mapeado do registro de alterações | | creation_time | event.idm.read_only_udm.metadata.event_timestamp | Mapeado do registro de alterações | | last_hit_time | event.idm.read_only_udm.security_result.last_discovered_time | Mapeado do registro de alterações | | update_count | event.idm.read_only_udm.additional.fields | Mapeado do registro de alterações | | devTime | event.idm.read_only_udm.additional.fields | Mapeado do registro de alterações | | queue_id | event.idm.read_only_udm.additional.fields | Mapeado do registro de alterações | | process | event.idm.read_only_udm.additional.fields | Mapeado do registro de alterações | | from_host | event.idm.read_only_udm.principal.hostname | Mapeado do registro de alterações | | from_host | event.idm.read_only_udm.principal.asset.hostname | Mapeado do registro de alterações | | from_ip | event.idm.read_only_udm.principal.ip | Mapeado do registro de alterações | | from_ip | event.idm.read_only_udm.principal.asset.ip | Mapeado do registro de alterações | | email_from | event.idm.read_only_udm.network.email.from | Mapeado do registro de alterações | | email_to | event.idm.read_only_udm.network.email.to | Mapeado do registro de alterações | | protocol | event.idm.read_only_udm.network.application_protocol | Mapeado do registro de alterações | | program | event.idm.read_only_udm.target.application | Mapeado do registro de alterações | | syslog_host | event.idm.read_only_udm.intermediary.ip | Mapeado do registro de alterações | | icmp_type | event.idm.read_only_udm.additional.fields | Mapeado do registro de alterações | | icmp_code | event.idm.read_only_udm.additional.fields | Mapeado do registro de alterações | | precise_error | event.idm.read_only_udm.security_result.description | Mapeado do registro de alterações | | action_reason | event.idm.read_only_udm.security_result.detection_fields | Mapeado do registro de alterações | | alert | event.idm.read_only_udm.security_result.detection_fields | Mapeado do registro de alterações | | message_type | event.idm.read_only_udm.security_result.detection_fields | Mapeado do registro de alterações | | UP_match_table | event.idm.read_only_udm.security_result.detection_fields | Mapeado do registro de alterações | | UP_match_table_2 | event.idm.read_only_udm.security_result.detection_fields | Mapeado do registro de alterações | | ROW_START | event.idm.read_only_udm.security_result.detection_fields | Mapeado do registro de alterações | | ROW_START_2 | event.idm.read_only_udm.security_result.detection_fields | Mapeado do registro de alterações | | match_id_2 | event.idm.read_only_udm.security_result.detection_fields | Mapeado do registro de alterações | | ROW_END | event.idm.read_only_udm.security_result.detection_fields | Mapeado do registro de alterações | | ROW_END_2 | event.idm.read_only_udm.security_result.detection_fields | Mapeado do registro de alterações | | layer_uuid_2 | event.idm.read_only_udm.security_result.detection_fields | Mapeado do registro de alterações | | layer_name_2 | event.idm.read_only_udm.security_result.detection_fields | Mapeado do registro de alterações | | rule_uid_2 | event.idm.read_only_udm.security_result.detection_fields | Mapeado do registro de alterações | | rule_name_2 | event.idm.read_only_udm.security_result.detection_fields | Mapeado do registro de alterações | | dst_dynobj_name | event.idm.read_only_udm.target.resource.name | Mapeado do registro de alterações | | dst_object_type | event.idm.read_only_udm.target.resource.attribute.labels | Mapeado do registro de alterações | | version | event.idm.read_only_udm.intermediary.platform_version | Mapeado do registro de alterações | | referrer | event.idm.read_only_udm.network.http.referral_url | Mapeado do registro de alterações | | mac_address | event.idm.read_only_udm.principal.mac | Mapeado do registro de alterações | | mgmt_value | event.idm.read_only_udm.additional.fields | Mapeado do registro de alterações | | date_value | event.idm.read_only_udm.additional.fields | Mapeado do registro de alterações | | origin | event.idm.read_only_udm.intermediary1.ip | Mapeado do registro de alterações | | logid | event.idm.read_only_udm.security_result.detection_fields | Mapeado do registro de alterações | | db_tag | event.idm.read_only_udm.security_result.detection_fields | Mapeado do registro de alterações | | web_client_type | event.idm.read_only_udm.additional.fields | Mapeado do registro de alterações | | acks_total", "attachments_num", "arrival_time","attack_status", "attack_traffic_bps", "attack_traffic_pps", "audit_status", "auth_method", "bandwidth", "best_practice_id", "blade_name", "cb_rate", "cb_recommendation", "cb_relevantobjectname", "cb_relevantobjectstatus", "file_count", "cb_scan_id", "from", "to", "cb_status", "cb_bp_blade", "controller", "delivery_time", "device_identification", "direction", "discard_traffic_bps", "discard_traffic_pps", "dlp_data_type_name", "dlp_relevant_data_types", "dlp_rule_name", "dlp_transport", "dns_query_type", "failure_reason", "file_size", "file_type" and "file_direction | additional.fields | Mapeado do registro de alterações | | destination_dns_hostname | target.hostname | Mapeado do registro de alterações | | email_content | security_result.description | Mapeado do registro de alterações | | email_subject | network.email.subject | Mapeado do registro de alterações | | event_name | metadata.description | Mapeado do registro de alterações | | web_client_type | network.http.user_agent | Mapeado do registro de alterações | | file_size | target.file_size | Mapeado do registro de alterações | | from | network.email.from | Mapeado do registro de alterações | | to | network.email.to | Mapeado do registro de alterações | | verdict | security_result.verdict_response | Mapeado do registro de alterações | | file_name | target.file.names | Mapeado do registro de alterações | | file_md5 | target.file.md5 | Mapeado do registro de alterações | | file_sha1 | target.file.sha1 | Mapeado do registro de alterações | | file_sha256 | target.file.sha256 | Mapeado do registro de alterações | | description | security_result.description | Mapeado do registro de alterações | | Name | security_result.detection_fields | Mapeado do registro de alterações | | Level | security_result.confidence_details | Mapeado do registro de alterações | | Impact | additional.fields | Mapeado do registro de alterações | | security_result.action | BLOCK | Mapeado do registro de alterações | | machine | target.hostname | Mapeado do registro de alterações | | user | principal.user.user_display_name | Mapeado do registro de alterações | | src | principal.hostname | Mapeado do registro de alterações | | security_result.action | ALLOW | Mapeado do registro de alterações | | operation_number | security_result.detection_fields | Mapeado do registro de alterações | | client_ip | principal.ip | Mapeado do registro de alterações | | log_sys_message | metadata.description | Mapeado do registro de alterações | | layer_name | security_result.detection_fields | Mapeado do registro de alterações | | feature_name" and "securexl_message | additional.fields | Mapeado do registro de alterações | | emailSubject | network.email.subject | Mapeado do registro de alterações | | cat | security_result.detection_fields | Mapeado do registro de alterações | | url | principal.url | Mapeado do registro de alterações | | srcPostNAT | principal.nat_ip | Mapeado do registro de alterações | | dstPostNAT | target.nat_ip | Mapeado do registro de alterações | | srcPostNATPort | principal.nat_port | Mapeado do registro de alterações | | dstPostNATPort | target.nat_port | Mapeado do registro de alterações | | dns_query | network.dns.questions | Mapeado do registro de alterações | | layer_uuid_rule_uuid | security_result.rule_id | Mapeado do registro de alterações | | domain | principal.administrative_domain | Mapeado do registro de alterações | | fservice", "appi_name", "app_risk", and "policy_name | security_result.detection_fields | Mapeado do registro de alterações | | packets", "__id", "dedup_time", "browse_time", "bytes", "product_family", "hll_key", and "calc_service | additional.fields | Mapeado do registro de alterações | | id | metadata.product_log_id | Mapeado do registro de alterações | | orig_log_server | principal.resource.product_object_id | Mapeado do registro de alterações | | environment_id | target.resource.product_object_id | Mapeado do registro de alterações | | client_outbound_packets" and "client_inbound_packets | principal.resource.attribute.labels | Mapeado do registro de alterações | | server_outbound_bytes" and "server_inbound_bytes | target.resource.attribute.labels | Mapeado do registro de alterações | | orig | principal.hostname | Mapeado do registro de alterações | | orig_log_server_ip | principal.ip | Mapeado do registro de alterações | | proto | network.ip_protocol | Mapeado do registro de alterações | | inter_host | intermediary.hostname | Mapeado do registro de alterações | | origin | target.ip | Mapeado do registro de alterações | | smartdefense_profile", "malware_rule_id", and "malware_rule_name | security_result.detection_fields | Mapeado do registro de alterações | | sequencenum", "description_url", "industry_reference", "mitre_execution", "packet_capture_name", "packet_capture_unique_id", "packet_capture_time", and "performance_impact | additional.fields | Mapeado do registro de alterações | | version | metadata.product_version | Mapeado do registro de alterações | | http_host | target.resource.attribute.labels | Mapeado do registro de alterações | | log_id | metadata.product_log_id | Mapeado do registro de alterações | | user_agent | network.http.user_agent | Mapeado do registro de alterações | | hostname", "dvc", and "principal_hostname | target.hostname | Mapeado do registro de alterações | | protection_id", "malware_action", "malware_family,protection_name", "protection_type | security_result.detection_fields | Mapeado do registro de alterações | | confidence_level | security_result.confidence | Mapeado do registro de alterações | | method | network.http.method | Mapeado do registro de alterações | | duration | network.session_duration.seconds | Mapeado do registro de alterações | | additional_info | security_result.description | Mapeado do registro de alterações | | operation | security_result.summary | Mapeado do registro de alterações | | subject | metadata.description | Mapeado do registro de alterações | | principal_hostname | intermediary.hostname | Mapeado do registro de alterações | | flags | security_result.detection_fields | Mapeado do registro de alterações | | tcp_flags | security_result.detection_fields | Mapeado do registro de alterações | | tcp_packet_out_of_state | security_result.detection_fields | Mapeado do registro de alterações | | sport_svc | principal.port | Mapeado do registro de alterações | | ProductFamily | additional.fields | Mapeado do registro de alterações | | mitre_initial_access | security_result.detection_fields | Mapeado do registro de alterações | | policy_time | security_result.detection_fields | Mapeado do registro de alterações | | profile | security_result.detection_fields | Mapeado do registro de alterações | | reject_id_kid | security_result.detection_fields | Mapeado do registro de alterações | | ser_agent_kid | security_result.detection_fields | Mapeado do registro de alterações | | app_category | security_result.category_details | Mapeado do registro de alterações | | matched_category | security_result.detection_fields | Mapeado do registro de alterações | | app_properties | security_result.detection_fields | Mapeado do registro de alterações | | conn_direction | additional.fields | Mapeado do registro de alterações | | rule_name | security_result.rule_name | Mapeado do registro de alterações | | rule","sub_policy_name","sub_policy_uid","smartdefense_profile","tags","flexString2 | security_result.detection_fields | Mapeado do registro de alterações | | dvc | intermediary.hostname | Mapeado do registro de alterações | | hostname | intermediary.hostname | Mapeado do registro de alterações | | origin_sic_name | intermediary.asset_id | Mapeado do registro de alterações | | conn_direction | network.ip_protocol | Mapeado do registro de alterações | | ifname | security_result.detection_fields | Mapeado do registro de alterações | | security_inzone | security_result.detection_fields | Mapeado do registro de alterações | | match_id | security_result.detection_fields | Mapeado do registro de alterações | | parent_rule | security_result.detection_fields | Mapeado do registro de alterações | | security_outzone | security_result.detection_fields | Mapeado do registro de alterações | | sub_policy_name | security_result.detection_fields | Mapeado do registro de alterações | | sub_policy_uid | security_result.detection_fields | Mapeado do registro de alterações | | drop_reason | security_result.summary | Mapeado do registro de alterações | | reason | security_result.summary | Mapeado do registro de alterações | | xlatesport | principal.nat_port | Mapeado do registro de alterações | | xlatedport | target.nat_port | Mapeado do registro de alterações | | ipv6_dst | target.ip | Mapeado do registro de alterações | | ipv6_src | principal.ip | Mapeado do registro de alterações | | portal_message | security_result.description | Mapeado do registro de alterações | | URL | security_result.about.url | Mapeado do registro de alterações | | Activity | security_result.summary | Mapeado do registro de alterações | | Reference | security_result.about.resource.attribute.labels | Mapeado do registro de alterações | | malware_action", "malware_family,protection_name", "protection_type | security_result.about.resource.attribute.labels | Mapeado do registro de alterações | | src_machine_name | security_result.detection_fields | Mapeado do registro de alterações | | message_info | metadata.description | Mapeado do registro de alterações |

Campo de registro Mapeamento de UDM
@timestamp metadata.event_timestamp
__id additional.fields
__nsons additional.fields
__p_dport additional.fields
__pos additional.fields
_action security_result.action_id
access_method metadata.product_event_type
acks_total additional.fields
act security_result.action_details
Action additional.fields
action_details additional.fields
action_reason security_result.detection_fields
Activity security_result.summary
additional_info security_result.description,
security_result.detection_fields
administrator target.user.userid
aggregated_log_count security_result.detection_fields
alert security_result.detection_fields
answer_rdata additional.fields
app principal.application
app_activity security_result.description
app_category security_result.category_details
app_desc additional.fields
app_id additional.fields
app_properties additional.fields,
security_result.detection_fields
app_risk security_result.detection_fields
app_session_id network.session_id
app_sig_id additional.fields
appcategory additional.fields
appi_name security_result.detection_fields
application principal.application
application_version additional.fields
arrival_time additional.fields
attachment_link additional.fields
attachments_num additional.fields
attack security_result.threat_name
attack_info security_result.description
attack_status additional.fields
attack_traffic_bps additional.fields
attackStatus security_result.detection_fields
audit_status additional.fields
auth_method additional.fields
auth_status security_result.summary
authentication_trial additional.fields
authority_rdata principal.resource.attribute.labels
authorization security_result.detection_fields
bandwidth security_result.detection_fields
best_practice_id security_result.detection_fields
blade_name security_result.detection_fields
browse_time additional.fields
browser network.http.user_agent
bytes additional.fields
c_bytes additional.fields
calc_desc security_result.description
calc_service additional.fields
cat security_result.detection_fields
category security_result.category_details
cb_bp_blade additional.fields
cb_rate additional.fields
cb_recommendation additional.fields
cb_relevantobjectname additional.fields
cb_relevantobjectstatus additional.fields
cb_scan_id security_result.detection_fields
cb_status additional.fields
certificate_validity additional.fields
client_inbound_bytes principal.network.received_bytes
client_inbound_interface additional.fields
client_inbound_packets principal.network.received_packets
client_ip principal.ip,
principal.asset.ip
client_name security_result.detection_fields
client_outbound_bytes principal.network.sent_bytes
client_outbound_interface additional.fields
client_outbound_packets principal.network.sent_packets
client_to_gateway_ciphers additional.fields
client_type_os principal.platform
client_version.0 intermediary.platform_version
cloud_hourly_quota additional.fields
cloud_hourly_quota_exceeded additional.fields
cloud_hourly_quota_usage_for_quota_id additional.fields
cloud_hourly_quota_usage_for_this_gw additional.fields
cloud_hourly_remaining_quota additional.fields
cloud_last_quota_update_gmt_time additional.fields
cloud_monthly_quota additional.fields
cloud_monthly_quota_exceeded additional.fields
cloud_monthly_quota_period_end additional.fields
cloud_monthly_quota_period_start additional.fields
cloud_monthly_quota_usage_for_quota_id additional.fields
cloud_monthly_quota_usage_for_this_gw additional.fields
cloud_quota_description additional.fields
cloud_quota_identifier additional.fields
cloud_quota_status additional.fields
cloud_remaining_quota additional.fields
cluster_info additional.fields
cn2 additional.fields
cn3 additional.fields
comment security_result.description
community additional.fields
condition additional.fields
confidence_level security_result.confidence
conn_direction network.direction,
additional.fields
connection_count security_result.detection_fields
connection_luuid additional.fields
connection_uid additional.fields
consent_flag_status additional.fields
consent_flag_value additional.fields
content_disposition target.file.names
content_length target.file.size
content_risk additional.fields
content_type target.file.mime_type
context_num additional.fields
contextnum additional.fields
contract_name security_result.detection_fields
control_log_type additional.fields
controller additional.fields
cookiei additional.fields
cookier additional.fields
cp_component_name additional.fields
cp_component_version additional.fields
creation_time principal.asset.attribute.creation_time
cs2_second intermediary.ip,
intermediary.asset.ip
cu_detected_by additional.fields
cu_detection_time additional.fields
cu_log_count additional.fields
cu_rule_category security_result.rule_name
cu_rule_id security_result.rule_id
current_value additional.fields
d_name security_result.detection_fields
data_type_name security_result.detection_fields
date_value additional.fields
datetime metadata.event_timestamp
db_tag security_result.detection_fields
db_ver additional.fields
DCE_RPC_Interface_UID additional.fields
dce-rpc_interface_uuid additional.fields
dce-rpc_interface_uuid-1 additional.fields
dce-rpc_interface_uuid-2 additional.fields
dce-rpc_interface_uuid-3 additional.fields
dedup_time additional.fields
default_device_message additional.fields
delivery_time additional.fields
desc security_result.summary
description security_result.detection_fields
description_url additional.fields
Destination additional.fields
destination_dns_hostname target.hostname,
target.asset.hostname
destinationAddress target.ip,
target.asset.ip
destinationDnsDomain target.url
destinationPort target.port
destinationTranslatedAddress target.ip,
target.asset.ip,
target.nat_ip
destinationTranslatedPort target.port,
target.nat_port
detected_by security_result.detection_fields
device intermediary.ip,
intermediary.asset.ip
device_identification additional.fields
device_message security_result.description
device_name target.hostname,
target.asset.hostname
device_type target.resource.resource_subtype
deviceCustomNumber2 additional.fields
deviceCustomString2 security_result.rule_name
deviceDirection network.direction
devTime metadata.event_timestamp
direction additional.fields
discard_traffic_bps additional.fields
discard_traffic_pps additional.fields
dlp_data_type_name additional.fields
dlp_relevant_data_types additional.fields
dlp_rule_name additional.fields
dlp_transport additional.fields
dn additional.fields
dns_domain_name target.hostname,
target.asset.hostname
dns_message_type security_result.detection_fields
dns_query_type additional.fields
dns_query.queries network.dns.questions.name
dns_type additional.fields
domain principal.administrative_domain
domain_name principal.administrative_domain
dpt target.port
drop_reason security_result.summary
dst target.ip,
target.asset.ip
dst_country target.location.country_or_region
dst_domain_name target.hostname,
target.asset.hostname
dst_ip target.ip,
target.asset.ip
dst_machine_name target.user.email_addresses
dst_phone_number target.user.phone_numbers
dst_port target.port
dst_uo_icon additional.fields
dst_uo_name target.location.country_or_region
dst_user_dn target.resource.attribute.labels
dst_user_name target.user.user_display_name
dstBytes additional.fields
dstkeyid additional.fields
dstPostNAT target.nat_ip
dstPostNATPort target.nat_port
duration network.session_duration.seconds
during_sec additional.fields
dvc target.ip,
intermediary.ip
elapsed additional.fields
email_content security_result.description
email_control additional.fields
email_queue_id security_result.detection_fields
email_queue_name security_result.detection_fields
email_session_id additional.fields
email_status security_result.detection_fields
email_subject network.email.subject
emailSubject network.email.subject
emulated_on additional.fields
encryption_fail_reason additional.fields
encryption_failure security_result.description
environment_id target.resource.product_object_id
Errors security_result.description
euid additional.fields
event_kind additional.fields
event_name metadata.description
event_start_time additional.fields
extraction_download_time additional.fields
extraction_time additional.fields
extraction_total_time additional.fields
failure_impact additional.fields
failure_reason additional.fields
feature_name additional.fields
fg-1_client_in_rule_name additional.fields
fg-1_client_out_rule_name additional.fields
fieldschanges security_result.detection_fields
file_count additional.fields
file_direction additional.fields
file_md5 target.file.md5
file_name target.file.names
file_sha1 target.file.sha1
file_sha256 target.file.sha256
file_size target.file.size
file_status target.resource.attribute.labels
file_type additional.fields
Firewall management node security_result.detection_fields
firstname principal.user.first_name
flags additional.fields
flexString2 security_result.detection_fields
FollowUp security_result.detection_fields
fragments_dropped additional.fields
from network.email.from,
additional.fields
from_user principal.user.userid
fservice security_result.detection_fields
fw_message additional.fields
fw_subproduct metadata.product_name
gateway_to_server_ciphers additional.fields
geoip_dst.country_name target.location.country_or_region
h_version security_result.detection_fields
has_accounting additional.fields
header_ip_ intermediary.ip,
intermediary.asset.ip
hll_key additional.fields
host target.hostname,
target.asset.hostname
hostname target.hostname,
target.asset.hostname
http_host target.ip,
target.asset.ip (se for um endereço IP),
target.hostname (se for um nome de host)
http_server target.application
http_status network.http.response_code
https_inspection_action additional.fields
https_inspection_rule_id security_result.detection_fields
https_inspection_rule_name security_result.detection_fields
https_validation security_result.detection_fields
i_ip intermediary.ip,
intermediary.asset.ip
icmp additional.fields
ICMP additional.fields
icmp_code additional.fields
ICMP_Code additional.fields
icmp_type additional.fields
ICMP_Type additional.fields
id metadata.product_log_id
identity_src target.application
identity_type additional.fields,
extensions.auth.type
if_direction network.direction
if_name additional.fields
ifdir network.direction
ifname security_result.detection_fields
ike security_result.description
ike_ids additional.fields
Impact additional.fields
indicator_name security_result.detection_fields
indicator_uuid security_result.detection_fields
industry_reference additional.fields
Info security_result.description
information metadata.description
inspection_category additional.fields
inspection_information additional.fields
inspection_item additional.fields
inspection_profile additional.fields
install_policy_acceleration additional.fields
instance_id principal.hostname,
principal.asset.hostname
instruction additional.fields
inter_host intermediary.ip
inter_host1 intermediary.hostname
inter_hostname_ intermediary.hostname
intermediary_application intermediary.application
intermediary_hostname_ intermediary.ip,
_intermediary.hostname
intermediary_ip intermediary.ip
inzone security_result.detection_fields
ip_address target.resource.attribute.labels
ip_address (derivado de pacotes) principal.ip
ip_address2 (derivado de pacotes) principal.ip,
principal.asset.ip
ip_host intermediary.ip,
intermediary.asset.ip (se for um endereço IP),
intermediary.hostname (se for um nome de host)
ip_id additional.fields
ip_len additional.fields
ip_offset additional.fields
ipv6_dst target.ip,
target.asset.ip
ipv6_src principal.ip,
principal.asset.ip
is_correlated additional.fields
is_last additional.fields
last_hit_time security_result.last_discovered_time
last_rematch_time additional.fields
lastchg additional.fields
lastname principal.user.last_name
lastupdatetime security_result.last_updated_time
layer_name security_result.rule_set_display_name,
security_result.detection_fields
layer_name_match_table additional.fields (lista)
layer_name_TP_match_table additional.fields (lista)
layer_names additional.fields.list
layer_uuid security_result.rule_set,
security_result.detection_fields
layer_uuid_match_table additional.fields (lista)
layer_uuid_rule_uuid.0 security_result.rule_id
layer_uuids additional.fields.list
level security_result.detection_fields
Level security_result.confidence_details
local_value additional.fields
localhost target.hostname,
target.asset.hostname
log_attachment_uid additional.fields
log_delay additional.fields
log_id metadata.product_log_id
log_link additional.fields
log_sys_message metadata.description
log_uid additional.fields
log_version metadata.product_version
logic_changes security_result.detection_fields
logicchanges.FollowUp security_result.detection_fields
logicchanges.Protection security_result.detection_fields
logicchanges.Srcs_srcs target.resource.product_object_id
logid security_result.detection_fields
loguid metadata.product_log_id
mac_address principal.mac
machine target.ip
maestro_gw additional.fields
malware security_result.detection_fields
malware_action security_result.detection_fields
malware_family security_result.detection_fields,
security_result.about.resource.attribute.labels
malware_rule_id security_result.detection_fields
malware_rule_id_TP_match_table additional.fields (lista)
malware_rule_name security_result.detection_fields
match_id additional.fields (lista)
match_id_match_table additional.fields (lista)
match_ids security_result.detection_fields
matched_category security_result.detection_fields
max_num_count_detected additional.fields
max_vms_num additional.fields
media_type additional.fields
member_id additional.fields
message_info metadata.description
metadata.product_log_id_insertion_epoch_timestamp metadata.collected_timestamp
method network.http.method
methods additional.fields
mgmt_value additional.fields
mitre_collection additional.fields
mitre_command_and_control additional.fields
mitre_credential_access additional.fields
mitre_defense_evasion additional.fields
mitre_discovery additional.fields
mitre_execution additional.fields
mitre_exfiltration additional.fields
mitre_impact additional.fields
mitre_initial_access security_result.detection_fields
mitre_lateral_movement additional.fields
mitre_persistence additional.fields
mitre_privilege_escalation additional.fields
more_sources principal.ip
msg security_result.description
msgid additional.fields
Name security_result.detection_fields,
security_result.about.resource.attribute.labels
nat_addtnl_rulenum additional.fields
NAT_addtnl_rulenum security_result.detection_fields
nat_rule_uid additional.fields
nat_rulenum security_result.detection_fields
NAT_rulenum security_result.detection_fields
needs_browse_time additional.fields
next_update_desc additional.fields
num_of_updates additional.fields
object target.ip
objectname additional.fields
objecttype security_result.detection_fields
observable_comment security_result.detection_fields
observable_id security_result.detection_fields
observable_name security_result.detection_fields
oid_prefix additional.fields
operation additional.fields
operation_number security_result.detection_fields
operation_results additional.fields
orig principal.hostname,
principal.asset.hostname
orig_log_server principal.resource.product_object_id
orig_log_server_ip principal.ip,
principal.asset.ip
origin intermediary.ip,
target.ip,
target.asset.ip (quando os detalhes da máquina principal e de destino são nulos).
origin_repetitions additional.fields
origin_sic_name intermediary.asset_id
originsicname security_result.detection_fields
os principal.platform
os_name principal.asset.platform_software.platform
os_version principal.asset.platform_software.platform_patch_level
outzone security_result.detection_fields
p_hostname principal.hostname
p_ip principal.ip,
principal.asset.ip
p_userid principal.user.userid
p_username principal.user.user_display_name
package_action additional.fields
packet_amount additional.fields
packet_capture_name additional.fields
packet_capture_time additional.fields
packet_capture_unique_id additional.fields
packets additional.fields
parameter additional.fields
parent_rule additional.fields (lista)
parent_rule_match_table additional.fields (lista)
parent_rules additional.fields.list
password_field additional.fields
path target.file.full_path
peer_gateway target.ip,
target.asset.ip
performance_impact additional.fields
performanceImpAction security_result.detection_fields
pid principal.process.pid
platform_patch_level principal.asset.platform_software.platform_patch_level
policy additional.fields
policy_name security_result.detection_fields
policy_time security_result.detection_fields
policyNames security_result.rule_set_display_name
port additional.fields
port (derivado de pacotes) principal.port
port2 (derivado de pacotes) target.port
portal_message security_result.description
ppid principal.process.parent_pid
precise_error security_result.detection_fields
principal_hostname principal.ip e principal.asset.ip (quando principal_hostname é um IP válido),
principal.hostname,
principal.asset.hostname e intermediary.hostname (todos os outros casos)
principal_ip principal.ip,
principal.asset.ip
product metadata.product_name
product_event_type metadata.product_event_type
product_family additional.fields
product_log_id metadata.product_log_id
ProductFamily additional.fields
profile security_result.detection_fields
Protection security_result.detection_fields
protection_id security_result.detection_fields
protection_name security_result.detection_fields,
security_result.about.resource.attribute.labels
protection_type security_result.detection_fields,
security_result.about.resource.attribute.labels
proto additional.fields
protocol network.application_protocol
proxy security_resultc_ipprincipal.nat_ip
query additional.fields
question_rdata security_result.detection_fields
reason security_result.summary
received_bytes network.received_bytes
Reference security_result.detection_fields,
security_result.about.resource.attribute.labels
registered_ip_phones additional.fields
reject_category security_result.summary
reject_id_kid security_result.detection_fields
resource additional.fields.list_value
resource_name target.resource.name
resource1 target.url
result security_result.summary
roles additional.fields
ROW_END additional.fields
ROW_START additional.fields
rt metadata.event_timestamp
rule security_result.rule_name,
security_result.detection_fields
rule_action security_result.action,
security_result.detection_fields
rule_action_match_table additional.fields (lista)
rule_actions security_result.detection_fields
rule_id security_result.rule_id
rule_name security_result.rule_name
rule_name_match_table additional.fields (lista)
rule_names additional.fields
`rule_uid" security_result.rule_id
rule_uid_match_table additional.fields (lista)
rule_uids security_result.detection_fields,
additional.fields
s_port additional.fields
scheme additional.fields
scope principal.ip (se for um endereço IP),
additional.fields (se não for um endereço IP)
scrub_activity additional.fields
securexl_message additional.fields
security_inzone security_result.detection_fields
security_outzone security_result.detection_fields
segment_time additional.fields
sendtotrackerasadvancedauditlog security_result.detection_fields
sensor_alert_blade additional.fields
sensor_alert_category additional.fields
sensor_alert_duration additional.fields
sensor_alert_id additional.fields
sensor_alert_message additional.fields
sensor_alert_module additional.fields
sensor_alert_solution additional.fields
sensor_alert_solution_sk additional.fields
sensor_alert_title additional.fields
sensor_alert_type additional.fields
sensor_test_name additional.fields
sent_bytes network.sent_bytes
sequencenum additional.fields
ser_agent_kid security_result.detection_fields
server_inbound_bytes network.sent_bytes
server_inbound_interface additional.fields
server_inbound_packets network.sent_bytes
server_kid additional.fields
server_outbound_bytes network.received_bytes
server_outbound_interface target.resource.attribute.labels
server_outbound_packets network.received_bytes
service target.port
service_id additional.fields
session_description security_result.detection_fields
session_id network.session_id
session_name security_result.detection_fields
session_uid network.session_id
sev security_result.severity
severity security_result.detection_fields
Severity security_result.severity
sig_id additional.fields
signature security_result.threat_name
site network.http.user_agent
smartdefense_profile security_result.detection_fields
smartdefense_profile_TP_match_table additional.fields (lista)
sni additional.fields
snid network.session_id
Source target.resource.attribute.labels
source_os additional.fields
sourceAddress principal.ip,
principal.asset.ip
sourcePort principal.port
sourceTranslatedAddress principal.ip,
principal.asset.ip,
principal.nat_ip
sourceTranslatedPort principal.port,
principal.nat_port
sourceUserName match => { "sourceUserName" => [ "%{DATA:firstname}( %{DATA:lastname})? \\\(%{DATA:userid}\\\)"]}
special_attack additional.fields
spt principal.port
sr_url security_result.about.url
src principal.ip,
principal.hostname,
principal.asset.ip,
principal.asset.hostname
src_domain_name principal.hostname,
principal.asset.hostname
src_ip principal.ip,
principal.asset.ip
src_localhost principal.hostname,
principal.asset.hostname
src_machine_group principal.resource.attribute.labels
src_machine_name principal.user.email_addresses
src_port principal.port
src_uo_icon additional.fields
src_uo_name principal.location.country_or_region
src_user principal.user.userid
src_user_dn principal.resource.attribute.labels
src_user_group principal.resource.attribute.labels
src_user_name principal.user.userid
srcBytes additional.fields
srcip additional.fields
srcPort principal.port
srcPostNAT principal.nat_ip
srcPostNATPort principal.nat_port
Srcs security_resultcstarget.resource.attribute.labels
srv_ip target.ip
ssh_connection_stage additional.fields
sshd_function additional.fields
start_time metadata.collected_timestamp
status security_result.action_details,
security_result.detection_fields,
security_result.action
stormagentaction additional.fields
stormagentname additional.fields
sub_policy_name security_result.detection_fields
sub_policy_uid security_result.detection_fields
subject metadata.description
subscription_description additional.fields
subscription_stat security_result.detection_fields
subscription_stat_desc security_result.summary
subscription_status security_result.detection_fields
suppressed_logs security_result.detection_fields
svc target.port
sys_message additional.fields
syslog_date additional.fields
syslog_facility_code additional.fields
syslog_pri additional.fields
system_alert_message additional.fields
system_application additional.fields
tags security_result.detection_fields
tar_user target.user.userid
tar_userid target.user.userid
tar_username target.user.user_display_name
target_port target.port
tcp_flags additional.fields
tcp_packet_out_of_state security_result.detection_fields
te_verdict_determined_by additional.fields
temp_duser target.user.email_addresses
tid security_result.detection_fields
time metadata.event_timestamp
time_interval additional.fields
tls_server_host_name additional.fields
to network.email.to,
additional.fields
TP_match_table additional.fields
Track additional.fields
two-factor_authentication security_result.detection_fields
type security_result.rule_type
uid additional.fields
UP_match_table additional.fields
update_count additional.fields
update_service additional.fields
update_status security_result.action,
security_result.action_details
url principal.url
url_count additional.fields
user principal.user.user_display_name
user_agent network.http.user_agent,
network.http.parsed_user_agent
usercheck_interaction_name security_result.rule_name
userid principal.user.userid
userip principal.ip,
principal.asset.ip
UUid metadata.product_log_id
validation_log additional.fields
vendor_list security_result.detection_fields
vendor_name metadata.vendor_name
verdict security_result.verdict_info.verdict_response
version metadata.product_version
version_ additional.fields
via additional.fields
voip_call_dir additional.fields
voip_call_id network.session_id
voip_call_state additional.fields
voip_duration additional.fields
voip_log_type additional.fields
voip_media_ipp additional.fields
voip_media_port additional.fields
voip_method additional.fields
voip_reason_info additional.fields
voip_reg_ip additional.fields
voip_reg_ipp additional.fields
voip_reg_period additional.fields
voip_reg_port additional.fields
voip_reg_server additional.fields
voip_reject_reason additional.fields
VPN additional.fields
vpn_feature_name additional.fields
watermark additional.fields
web_client_type network.useragent
web_client_type.0 network.http.user_agent,
network.http.parsed_user_agent
xlatedport target.nat_port
xlatedst target.nat_ip
xlatesport principal.nat_port
xlatesrc principal.nat_ip

Deltas de lançamento

Em 1º de março de 2026, o Google SecOps lançou uma nova versão do analisador de firewall do Check Point, que inclui mudanças significativas no mapeamento de campos de registro Parser_Name para campos UDM e no mapeamento de tipos de eventos.

Delta de mapeamento de campo de registro

A tabela a seguir lista o delta de mapeamento para campos de registro do firewall do Check Point para UDM expostos antes de 1º de março de 2026 e depois (listados nas colunas Mapeamento antigo e Mapeamento atual, respectivamente):

Campo de registro Mapeamento antigo Mapeamento atual
client_inbound_bytes princiapal.resource.attribute_labels principal.network.received_bytes
client_outbound_bytes princiapal.resource.attribute_labels principal.network.sent_bytes
lastupdatetime additional.fields security_result.last_updated_time
layer_names security_result.detection_fields additional.fields.list
layer_uuids security_result.detection_fields, additional.fields additional.fields.list
operation security_result.detection_fields additional.fields
originsicname intermediary.labels security_resul.detection_fields
parent_rules additional.fields additional.fields.list
pid additional.fields principal.process.pid
scope additional.fields principal.ip (se for um endereço IP),
additional.fields (se não for um endereço IP)
server_inbound_bytes target.resource.attribute.labels, network.sent_bytes network.sent_bytes
server_inbound_packets target.resource.attribute.labels, network.sent_packets network.sent_packets
server_outbound_bytes target.resource.attribute.labels, network.received_bytes network.received_bytes
server_outbound_packets target.resource.attribute.labels, network.received_packets network.received_packets
src_machine_name additional.fields principal.user.email_addresses
src_user_dn sr.detection_fields principal.resource.attribute.labels
suppressed_logs additional.fields security_result.detection_fields
web_client_type additional.fields network.useragent

Delta de mapeamento de tipo de evento

Vários eventos que foram classificados de forma genérica agora são classificados corretamente com tipos de eventos significativos.

A tabela a seguir lista o delta para o processamento de tipos de eventos de firewall do Check Point antes e depois de 1º de março de 2026 (listados nas colunas Old event_type e Current event_type, respectivamente):

Formatar ID do evento do registro Old event_type event_type atual
SYSLOG+KV O registro tem sourceAddress e host GENERIC_EVENT NETWORK_CONNECTION
SYSLOG+JSON O registro tem sourceAddress e host NETWORK_HTTP NETWORK_CONNECTION
SYSLOG+JSON O registro tem sourceAddress e host NETWORK_HTTP NETWORK_CONNECTION

Registro de alterações

Ver o registro de alterações deste analisador

Precisa de mais ajuda? Receba respostas de membros da comunidade e profissionais do Google SecOps.