You may want to enable checkboxes for No-Resolve Mode and Online Mode. Important: Though not displayed in below screenshot. Provide the Connection name, IP Address, Port Number and Click Next. Click on the New Connection tab on the Checkpoint OPSEC LEA page. Once done we need to configure the connection on Splunk Server. Run the command to generate the certificate. You should be able to see pull-cert.sh script.
#Checkpoint smartdashboard download install
Once these dependencies are install go to /opt/splunk/etc/apps/Splunk_TA_opseclea_linux22/bin directory. Add the below command and then run the same command again for installing these dependencies.
#Checkpoint smartdashboard download 64 Bit
You need to install Pam 64 bit libraries and then install the 32 bit libraries. The second command “yum install pam.i686” will not work directly. Since my Splunk was installed on CentOS, below is the procedure to install these dependencies. Login to the Linux distro on which you have installed Splunk and install the following dependencies. Now we need to pull the certificate from Checkpoint management server on the Splunk Server.īefore this we need to install 2 dependencies which are crucial for getting the certificate from the management server. Once Done you should be able to see below message. Select the management server and click Ok. Post this Install Database on the Management Server Go To File–> Policy–> Install Database. Copy this and save it, this will also be used later. Open the Splunk OPSEC Application and In the Communication Section you can see the DN for the Splunk LEA Server. In the SIC Status Page Copy the DN name entry and save it in notepad or other editor this will be used later. We need to also copy the SIC DN name of the Checkpoint Management Server and The Splunk Server.įor this Double Click on the Checkpoint Management Server and from the general properties page click on Test SIC Status. You should be able to see Trust State as initialized But Trust Not Established. Give a SIC key, you need to remember this key which will be used when we pull the SIC certificate on the Splunk Server.Ĭlick On initialize. Select Client Entity as LEA.įor creating trust between the Management Server and Splunk Server we need to initialize SIC. Once the host is created it should show up in the Host Section of the OPSEC application. Provide a Name for the Splunk Server and also add the Splunk Server’s IP Address in the Host General Properties Page. Provide a Name to the Splunk Server application. Create a new host to represent the Splunk Server’s IP Address. Once Dashboard is open Go to Manage–> Click On Servers And OPSEC Applications.Ĭreate a New OPSEC Application for the Splunk Server. Open Smartdashboard to Checkpoint Management Server. Post restart you can see the application installed and you can proceed with integration of your management with Splunk. Once the application is installed Splunk service has to be restarted, click on Restart Splunk. Go to Apps section and click on Install app from file, browse to the file which we downloaded earlier and click open. Lets start with installing the Splunk Add On For Checkpoint Opsec LEA Application on the Splunk server.ĭownload the application and store it in a location on your computer. Working Communication between the Management/Log Server and Splunk Server.
0 kommentar(er)
