Introduction to SmartEvent

We were able to see how extensive Check Point logging capabilities are and how we can filter the logs to focus on traffic flows, connections, and actions. That said, there are a lot of logs being generated even by modest infrastructures. While a periodic manual log review is still a good practice for abnormal traffic detection, it is not a realistic approach for real-time reactions to security events by administrators.

If your company has implemented a SIEM and SOAR and have those configured to consume Check Point logs, generate actionable intelligence, and trigger automated responses, that is great. However, the likelihood of that happening for the majority of implementations is not very high.

In this case, the solution you are looking for is Check Point’s own SmartEvent server. Essentially, it is a native SIEM and SOAR product that is primarily focused on working with Check Point gateways and endpoint clients that is also capable of integrating...