CCX Unified Splunk Add-on for Checkpoint

About Us: CyberCX is Australia’s greatest force of cyber security experts. Our highly skilled professional services team operates a 24x7 on-shore security operations centre (SOC) servicing corporate and public sector organisations across Australia and New Zealand, specialising in Security Operations services leveraging Splunk. Description: The CCX Unified Splunk Add-on for Checkpoint looks to provide a single field extraction bundle for all Checkpoint products. This TA was built using a large dataset and endeavours to be the most CIM compliant comprehensive field extraction TA available for Checkpoint ingested logs via OPSEC LEA Server or via the new SYSLOG support or Checkpoint Cloud log-push Syslog. Below are some of the listed products supported: - Firewall - IPS - Smartdefense - Connectra - Anti Spam (MTA) - Endpoint Management/Compliance - Threat Emulation - Anti Bot - Anti Virus - Anti Ransomware - Anti Virus - Anti Malware - Mobile - URL Filtering - Checkpoint Harmony (including all Products) To receive a full list of Checkpoint products supported by this TA refer to "SUPPORT" >> "Contact Developer". Fully compatible with Splunk Enterprise and Splunk Cloud, built by an Ops team for Ops teams. Features: - This TA currently supports logtypes tagged under the following CIM datamodels: Alerts, Authentication, Change, Malware, Endpoint, Intrusion Detection (IDS), Email, Network Traffic, Network Sessions, and Web. - Log ingestion via OPSEC LEA Server please check installation requirements on this page. - Support available for SYSLOG ingestion via HTTP Event Collector (HEC) or via Splunk Heavy Forwarder Attribution: - Full credit to the Splunk team for their work and maintenance of the foundation and components 'https://splunkbase.splunk.com/app/3197/' 'https://splunkbase.splunk.com/app/5478/'