Loads the necessary objects from the Security Management Server. The log server collects logs from various sources.Ĭorrelation Unit (CU) – Reads in real time the records from the current log file of the Log server and analyzes them using the Correlation Policy, generating security events that it sends to the Event Server.Īnalyzer Server – Loads the Event Policy policy onto the Correlation Unit, saves the security events received from the Correlation Unit in its database, interacts with the Security Management Server to block the source of the threat on the Check Point security gateways. Let’s look at the parts of the SmartEvent product and what functions these parts perform: SmartEvent solves the problem of automating log analysis for the purpose of identifying security incidents. The output can be the automation of the log analysis process.

You can certainly use filtering mechanisms, but you need to know that different logs are important for filtering out and detecting for different incidents. First of all, because there are a lot of these logs. The information stored in the form of logs can be used to study and analyze security incidents, but it is extremely difficult to quickly identify log-based incidents. Most of them are messages about allowed and blocked connections, less often – messages about the protection of IPS and other blades of the product. Let’s continue this topic and see how the Smart Event blade is arranged.Ĭheck Point’s software blades generate a huge variety of messages that are stored in the log database.

This product complements and expands the capabilities of the Check Point firewall, turning it into an effective tool that helps identify, recognize and process security incidents. In this article, we want to talk about the Check Point SmartEvent product.

Smart endpoint checkpoint