ArcSight - Integration with Checkpoint Sandblast Agent Logs - Micro Focus Community

Big news! The community will be moving to a new platform April 21. Read more.

106 views

Hi all,

Have ever anyone integrated Sandblast agent alert logs (EDR solution from CheckPoint) with ArcSight?

In the following link: https://sc1.checkpoint.com/documents/Infinity_Portal/WebAdminGuides/EN/SandBlast-Agent-Admin-Guide/Topics-SBA-AG/Log-Exporter.htm?TocPath=_____19

it is mentioned that Log Exporter can be used for log extraction and sent to remote syslog server using CEF format.

I have tested the Log Exporter for the rest of the Checkpoint Logs (Log Exporter CEF/Management Console) but not the Sandblast agent logs.

Thank you,

Greg

0 Replies

The opinions expressed above are the personal opinions of the authors, not of Micro Focus. By using this site, you accept the . Certain versions of content ("Material") accessible here may contain branding from Hewlett-Packard Company (now HP Inc.) and Hewlett Packard Enterprise Company. As of September 1, 2017, the Material is now offered by Micro Focus, a separately owned and operated company. Any reference to the HP and Hewlett Packard Enterprise/HPE marks is historical in nature, and the HP and Hewlett Packard Enterprise/HPE marks are the property of their respective owners.