Check Point
TMA-CHECKPOINT-REMOTE-SYSLOG
Ensure logs are sent to a remote syslog server
MediumLevel 1Automatedcheckpoint
Description
PASS requires at least one 'add syslog log-remote-address' entry. Audited against the Gaia clish 'show configuration' output.
How it is checked
Audit method: Configuration pattern
- Pattern
(?m)^add syslog log-remote-address \S+
How it is fixed
Fix method: Guidance or infrastructure patch
add syslog log-remote-address 10.0.0.50 level info save config WebUI: System Management > System Logging > Remote System Logging.
Properties
- Operating systems
- Any
- Tags
- checkpointlogging
- Reference
- CIS Check Point Firewall Benchmark - Logging - Remote syslog server (verify section number for your Gaia release)
Check this host
Run this on a machine you are allowed to audit. The scan is read-only.
shell
tmaegis scan --target checkpoint