Checkpoint

LogZilla App Store application: Checkpoint

Overview

Check Point Software Technologies provides enterprise network security solutions including next-generation firewalls, VPN gateways, and threat prevention systems. The VPN-1 & FireWall-1 product family delivers deep packet inspection, application control, and identity awareness capabilities.

App Function

The Check Point app performs the following functions:

  • Parse Check Point syslog messages containing key-value pairs
  • Extract network, identity, and security metadata into user tags
  • Translate numeric values (confidence level, app risk) to human-readable names
  • Convert port numbers to service names
  • Classify events for cross-vendor filtering (network, security, auth)

LogZilla Configuration

Check Point requires a dedicated syslog port in LogZilla because Check Point's syslog format does not include a standard program name field.

Step 1: Configure Dedicated Port

  1. Navigate to Settings > System > Application Ports
  2. Set Check Point syslog port to a dedicated port (e.g., 5514)
  3. Click Save

The syslog and parser services will reload automatically. Both TCP and UDP listeners are enabled on the configured port.

Step 2: Configure Check Point Device

  1. Navigate to Logs & Monitoring → External Log Servers
  2. Click Configure under Syslog Servers
  3. Add a new syslog server with:
    • Protocol: UDP or TCP
    • IP address: LogZilla server IP
    • Port: The dedicated port configured above (e.g., 5514)
  4. Enable System logs and/or Security logs
  5. Click Apply

Vendor Documentation

Log Source Details

ItemValue
VendorCheck Point Software Technologies
Device TypeNext-Generation Firewall, VPN Gateway
Collection MethodSyslog (RAW port)
Configurable Log Output?Yes
Log Source TypeKey-value pairs

Incoming Log Format

Check Point logs use key-value pair format with values enclosed in double quotes.

text
<85>Aug 8 15:55:39 GATEWAY01 Action="accept" inzone="Internal"
outzone="External" src="172.16.0.4" dst="8.8.8.8" proto="17"
protocol="DNS-UDP" user="" ProductName="VPN-1 & FireWall-1"

Parsed Metadata Fields

The app extracts a curated whitelist of fields using human-friendly tag names.

Global Tags

Tag NameExampleDescription
VendorCheck PointVendor name
ProductFirewallProduct name
Event ClassnetworkEvent classification (network, security, auth)

Standardized Tags

Tag NameExampleDescription
ActionacceptFirewall action
SrcIP172.16.0.4Source IP address
DstIP8.8.8.8Destination IP address
UserjsmithUsername
ProtocolDNS-UDPProtocol name
DstPorthttpsDestination port
SrcNAT203.0.113.1NAT translated source IP
DstNAT203.0.113.2NAT translated destination IP

Check Point Product Tags

Tag NameExampleDescription
CP ProductVPN-1 & FireWall-1Check Point product name
CP Product FamilyNetworkProduct family
CP Source ZoneInternalSource security zone
CP Destination ZoneExternalDestination security zone
CP RuleAllow-WebMatched rule name
CP PolicyStandardSecurity policy name

Identity Tags

Tag NameExampleDescription
CP Source UserjsmithSource username
CP Source MachineWORKSTATION01Source machine name
CP VPN Uservpn_user1VPN username

Security Tags

Tag NameExampleDescription
CP AttackSQL InjectionDetected attack name
CP Malware FamilyTrojanMalware family name
CP VerdictMaliciousThreat verdict
CP SeverityHighEvent severity
CP ConfidenceHighThreat confidence

Application Control Tags

Tag NameExampleDescription
CP ApplicationFacebookApplication name
CP App RiskMediumApplication risk level
CP CategorySocial NetworkingURL/application category

Value Translations

The app translates numeric values to human-readable names:

Confidence Level

RawTranslated
0N/A
1Low
2Medium-Low
3Medium
4Medium-High
5High

Application Risk

RawTranslated
0Unknown
1Very Low
2Low
3Medium
4High
5Critical

Event Classification

The Event Class tag enables cross-vendor dashboard filtering:

ValueTrigger Fields
securityattack, malware_family, malware_action, protection_id
authauth_status, auth_method
networkDefault for firewall logs

MITRE ATT&CK Mapping

The app maps security events to MITRE ATT&CK techniques:

Event TypeMITRE TechniqueTactic
SQL InjectionT1190Initial Access
XSS AttackT1189Initial Access
Command InjectionT1059Execution
Brute ForceT1110Credential Access
DoS/DDoST1499Impact
Malware/TrojanT1204Execution
RansomwareT1486Impact

Triggers

TriggerCondition
Check Point: MITRE ATT&CK Threat DetectedAny MITRE-mapped threat
Check Point: Malware DetectedCP Malware Family exists
Check Point: Attack DetectedCP Attack exists
Check Point: High Risk ApplicationCP App Risk = Critical/High
Check Point: VPN Connection FailedVPN product + deny action
Check Point: Traffic DeniedAction = deny/drop/reject/block
Check Point: Traffic AcceptedAction = accept/allow

Log Examples

Firewall Accept

text
<85>Aug 8 15:55:39 GATEWAY01 Action="accept" inzone="Internal"
outzone="External" src="172.16.0.4" dst="8.8.8.8" proto="17"
xlatesrc="70.163.95.60" protocol="DNS-UDP" user=""
ProductName="VPN-1 & FireWall-1" svc="53" rule_name="Outgoing"

Firewall Drop

text
<85>Aug 8 16:22:15 GATEWAY01 Action="drop" src="203.0.113.50"
dst="192.168.1.100" proto="6" attack="SQL_Injection"
malware_action="block" verdict="malicious" severity="high"
ProductName="IPS Blade"

VPN Connection

text
<85>Aug 8 17:45:30 VPNGW01 Action="accept" src="198.51.100.45"
dst="192.168.1.100" proto="6" vpn_user="[email protected]"
identity_type="vpn" client_type_os="Windows_10"
ProductName="VPN-1 & FireWall-1"
Checkpoint | LogZilla Documentation