LevelBlue Completes Acquisition of Cybereason. Learn More

Government
Contact Us
Login

USM Anywhere Login

Fusion Platform Login

Support Downloads/Forums Login

MailMarshal Cloud Login
Incident Response
Experiencing a security breach?

Get access to immediate incident response assistance.

24 HOUR HOTLINES
AMERICAS +1 855 438 4305

EMEA +44 8081687370

AUSTRALIA +61 1300901211

SINGAPORE +65 68175019

Recommended Actions

Government
Contact Us
Login

login

USM Anywhere Login

Fusion Platform Login

Support Download/Forum Login

MailMarshal Cloud Login
Incident Response
Incident Response
Experiencing a security breach?

Get access to immediate incident response assistance.

24 HOUR HOTLINES
AMERICAS +1 855 438 4305

EMEA +44 8081687370

AUSTRALIA +61 1300901211

SINGAPORE +65 68175019

Recommended Actions

LevelBlue Completes Acquisition of Cybereason. Learn More

Cyber Advisory

Managed Cloud Security

Data Security

Managed Detection & Response

Email Security

Managed Network Infrastructure Security

Exposure Management

Security Operations Platforms

Incident Readiness & Response

SpiderLabs Threat Intelligence

View All Services

BY INDUSTRY

BY REGULATION

BY TOPIC

Offensive Security

Solutions to maximize your security ROI

Operational Technology

End-to-end OT security

Microsoft Security

Unlock the full power of Microsoft Security

Securing the IoT Landscape

Test, monitor and secure network objects

About Us

We reduce cyber risk and fortify organizations

Awards and Accolades

Recognition by analysts and media outlets

LevelBlue SpiderLabs

Global researchers, ethical hackers, and responders

LevelBlue Security Operations Platforms

Unprecedented security visibility and control

Security Colony

Access to cybersecurity threat protection resources

Microsoft Security

Unlock the full power of Microsoft Security

Technology Alliance Partners

Key alliances who align and support our ecosystem of security offerings

BLOGS

UPCOMING

MEDIA & ASSETS

NOTICES

HELP

LevelBlue Knowledge Base

KB Home Search Latest Additions Most Popular

Knowledgebase

Home » Knowledgebase » Legacy Products » Firewall Suite » INFO: Sample Log File - Check Point Log File Formats

INFO: Sample Log File - Check Point Log File Formats

Show/Hide Article Tools

This article applies to:

Security Reporting Center 2.0
Security Reporting Center 2.1
WebTrends Firewall Suite 4.x

Question:

What are sample Log Files in Check Point Log File Formats?

Information:

Sample Opsec LEA Log File

datetime= 9Dec1998 11:43:39 action=reject fw_name=10.0.1.1 dir=inbound datetime= 9Dec1998 11:43:39 action=reject fw_name=10.0.1.1 dir=inbound datetime= 9Dec1998 11:43:56 action=ctl fw_name=10.0.1.1 dir=inbound sys_msgs=installed Standard datetime= 9Dec199811:43:56 action=accept fw_name=10.0.1.1 dir=inbound

Sample Exported Check Point Log File

num;date;time;orig;type;action;alert;i/f_name;i/f_dir;proto;src;dst;service;s_port;len;rule;xlatesrc;xlatedst;xlatesport;xlatedport;icmp-type;icmp-code;sys_msgs 0;30Sep98;11:59:51;208.1.1.1;control;ctl;;daemon;inbound;;;;;;;;;;;;;;started sending log to localhost 1;30Sep98;11:59:51;208.1.1.1;log;accept;;El90x3;inbound;tcp;192.4.7.171;204.170.22.93;https;1197;44;1;208.1.1.1;204.170.22.93;33548;https;;; 2;30Sep98;11:59:51;208.1.1.1;log;accept;;El90x3;inbound;tcp;192.4.7.48;209.1.224.13;http;1266;44;1;208.1.1.1;209.1.224.13;33549;http;;; 3;30Sep98;11:59:51;208.1.1.1;log;accept;;El90x3;inbound;tcp;192.4.7.48;209.1.224.13;http;1267;44;1;208.1.1.1;209.1.224.13;33550;http;;; 4;30Sep98;11:59:51;208.1.1.1;log;accept;;El90x3;inbound;tcp;192.4.7.48;209.1.224.13;http;1268;44;1;208.1.1.1;209.1.224.13;33551;http;;;

Sample of INCORRECTLY exported Check Point Log File

"119310" "15Aug2002" " 8:00:18" "eth-s1p3c0" "146.105.234.6" "log" "accept" "nameserver" "146.1.2.1" "158.43.128.72" "udp" "22" "4487" "" "" "" "" "" "193.132.126.2" "158.43.128.72" "4487" "nameserver" "firewall" " len 72" "119311" "15Aug2002" " 8:00:18" "eth-s1p1c0" "146.105.234.6" "log" "accept" "https" "146.105.175.86" "143.252.77.4" "tcp" "55" "1158" "" "" "" "" "" "" "" "" "" "firewall" " len 48" "119312" "15Aug2002" " 8:00:30" "eth-s1p1c0" "146.105.234.16" "log" "drop" "nbdatagram" "146.105.65.32" "192.168.73.2" "udp" "80" "nbdatagram" "" "" "" "" "" "" "" "" "" "firewall" " len 257" "119313" "15Aug2002" " 8:00:18" "eth-s6p1c0" "146.105.234.6" "log" "accept" "smtp" "195.11.209.131" "193.132.126.2" "tcp" "15" "2230" "" "" "" "" "" "195.11.209.131" "146.1.2.1" "2230" "smtp" "firewall" " len 48" "119314" "15Aug2002" " 8:00:18" "eth-s1p3c0" "146.105.234.6" "log" "accept" "nameserver" "146.1.2.1" "158.43.128.72" "udp" "22" "4489" "" "" "" "" "" "193.132.126.2" "158.43.128.72" "4489" "nameserver" "firewall" " len 73"