Services or capabilities described in Amazon Web Services documentation might vary by Region. To see the differences applicable to the China Regions, see Getting Started with Amazon Web Services in China (PDF).

Source configuration for Check Point NGFW

Integrating with Check Point NGFW

Check Point NGFW integration uses Amazon S3 and Amazon SQS to ingest log data into CloudWatch pipelines. Log data is forwarded from the Check Point appliance using the cp_log_export utility to a syslog receiver, then collected by Fluent Bit and delivered to an Amazon S3 bucket. Amazon SQS notifications alert the pipeline when new log objects arrive.

Prerequisites

Log forwarding setup

Check Point NGFW exports logs using the cp_log_export utility, which forwards log data in syslog format to a designated receiver. Fluent Bit running on the syslog receiver host collects these logs and delivers them to Amazon S3 in NDJSON format.

Instructions to setup Amazon S3 and Amazon SQS

Complete the following steps to configure the Amazon S3 and Amazon SQS infrastructure for Check Point NGFW log ingestion.

Step 1: Create Amazon S3 bucket

Create an Amazon S3 bucket to store Check Point NGFW logs. The bucket must reside in the same Amazon Region where you plan to create the CloudWatch pipeline.

Step 2: Create Amazon SQS queue

Create an Amazon SQS queue in the same Amazon Region as your Amazon S3 bucket. This queue receives notifications when new log files are added to the bucket.

Step 3: Connect Amazon S3 to Amazon SQS

Configure the Amazon S3 bucket to send event notifications for s3:ObjectCreated:* events to the Amazon SQS queue.

Step 4: Configure Amazon SQS queue policy

Configure the Amazon SQS queue policy to allow the Amazon S3 bucket to send messages to the queue. Apply the following policy to your Amazon SQS queue:

{
  "Version": "2012-10-17",
  "Id": "AllowS3ToSQS",
  "Statement": [
    {
      "Sid": "AllowS3BucketNotification",
      "Effect": "Allow",
      "Principal": {
        "Service": "s3.amazonaws.com"
      },
      "Action": "sqs:SendMessage",
      "Resource": "arn:aws:sqs:<region>:<account-id>:<queue-name>",
      "Condition": {
        "ArnEquals": {
          "aws:SourceArn": "arn:aws:s3:::<YOUR-BUCKET>"
        },
        "StringEquals": {
          "aws:SourceAccount": "<account-id>"
        }
      }
    }
  ]
}

Step 5: Configure Check Point log export and Fluent Bit

On the Check Point appliance, configure cp_log_export to forward logs to your syslog receiver:

cp_log_export add name my_export target-server <syslog-host> target-port 514 protocol udp format syslog

On the syslog receiver host, install Fluent Bit and configure it to tail the Check Point NGFW log files and upload them to Amazon S3. Use the following example configuration:

########################################
# SERVICE SECTION
########################################
[SERVICE]
    Flush                        5
    Daemon                       Off
    Log_Level                    info
    storage.path                 /etc/fluent-bit/db/storage
    storage.sync                 normal
    storage.checksum             off
    storage.backlog.mem_limit    10M

########################################
# INPUT SECTION
########################################
[INPUT]
    Name                         tail
    Path                         /var/logs/<checkpoint_ip_address>/*.log
    Tag                          checkpoint.*
    Read_from_Head               True
    DB                           /etc/fluent-bit/db/checkpoint.db
    DB.Sync                      Normal
    storage.type                 filesystem
    Rotate_Wait                  30
    Refresh_Interval             60

########################################
# OUTPUT SECTION
########################################
[OUTPUT]
    Name                         s3
    Match                        checkpoint.*
    Bucket                       <<Bucket name>>
    Region                       <region>
    S3_Key_Format                /checkpoint-ngfw/%Y/%m/%d/%H/%M/%S.log.gz
    compression                  gzip
    use_put_object               On
    store_dir                    /etc/fluent-bit/db/s3
    total_file_size              1M
    log_key                      log
    upload_timeout               60

Step 6: IAM permissions

Create an IAM policy with the following permissions for the Fluent Bit host to write objects to the Amazon S3 bucket:

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Sid": "FluentBitS3Write",
      "Effect": "Allow",
      "Action": [
        "s3:PutObject",
        "s3:GetBucketLocation",
        "s3:ListBucket",
        "s3:ListMultipartUploadParts",
        "s3:AbortMultipartUpload",
        "s3:CreateMultipartUpload",
        "s3:CompleteMultipartUpload"
      ],
      "Resource": [
        "arn:aws:s3:::<YOUR-BUCKET>",
        "arn:aws:s3:::<YOUR-BUCKET>/checkpoint-ngfw/*"
      ]
    }
  ]
}

Step 7: Verify

Verify the setup by confirming that log files appear in the Amazon S3 bucket and that Amazon SQS notifications are being generated. Check the Amazon SQS queue for messages indicating new object creation events.

Configuring the CloudWatch pipeline

Supported Open Cybersecurity Schema Framework Event Classes

This integration supports OCSF schema version v1.5.0. The following table shows the mapping between Check Point NGFW event types and OCSF event classes.