Comment List
  • Hi Richard,

    Yes, I have raised a service request with HP support with regards to this issue.

    Please refer the SR# 4651710544.



  • Hi Ingrid, Thanks for checking into this for us!

    , not sure if you've filed tickets with support, but there seems to be two issues compounded together:

    1) the parser is mapping the field 'app_name' instead of 'appi_name'.

    2) it's then mapping to 'Device Service Name', which isn't a standard ArcSight field

  • I checked the parser, which shows Device Service Name being mapped to app_name as is documented in the guide, not Device Process Name.  I am checking with development to determine whether the parser needs to be updated. Until then, I won't be able to make the change in the configuration guide.


  • Hi ,

    As per this discussion (), Mr seems to have found a typo in the Checkpoint doc(s).

    On page 27 for the doc above specifically, the field "app_name" is listed incorrectly as mapped to "Device Service Name". It should be "Device Process Name".

  • Yes, under R70 and above the Domain's (CMA's) SIC name doesn't show up in the Domain object like it did in R65.  But you can find it using GUIDBedit.exe (if using Windows and R75.47 it would be in in C:\Program Files (x86)\CheckPoint\SmartConsole\R75.47\PROGRAM).  Find your Domain\CMA object in the network objects and then scroll down through the fields until you find "sic_name" and there's what you are looking for.

  • There is one essential piece of information missing from the documentation : if you configure ssl_opsec, the OPSEC Entity SIC Name is not always displayed by the Check Point Smart Center but you can guess it :

    OPSEC Entity SIC Name is the concatenation of the fixed string “CN=cp_mgmt,” and the string after the first comma in the opsec_sic_name. For instance, "CN=cp_mgmt,O=test..8u5G5z". It is confirmed by this post :

    If you don't configure the opsec entity SIC name in your Smart Connector, your connection will fail.

Related Discussions