Check Point Firewall

This pack includes Cortex XSIAM content.

Configuration on Server Side

You need to configure Check Point to forward Syslog messages in CEF format.

Go to Checkpoint Log Export, and follow the instructions under "Basic Deployment" to set up the connection using the following guidelines:

If you use version R77.30 or R80.10, follow the instructions to install a Log Exporter.
Set the Syslog port to 514 or your agent port.
Replace the "name" and "<target-server IP address\>" in the CLI with the broker VM name and IP address.
Set the format to CEF.

Collect Events from Vendor

In order to use the collector, use the Broker VM option.

Broker VM

To create or configure the Broker VM, use the information described here.

You can configure the specific vendor and product for this instance.

Navigate to Settings > Configuration > Data Broker > Broker VMs.
Right-click, and select Syslog Collector > Configure.
When configuring the Syslog Collector, set the following values:
- vendor as vendor - Checkpoint
- product as product - Firewall

Name	Description
CheckpointFWBackupStatus	Deprecated. Use ssh command instead. Connect to a CheckPoint firewall appliance using SSH and retrieve the status for backup tasks. The user account being used to access the device must be set to use the SSH shell and not the built-in CheckPoint CLI. For more information, consult the CheckPoint documentation.
CheckPointDownloadBackup	Deprecated. Use ssh command instead. Downloads the Check Point policy backup to the Cortex XSOAR War Room.
CheckpointFWCreateBackup	Deprecated. Use ssh command instead. Connect to a Check Point firewall appliance using SSH and trigger a task to create a configuration backup of the device. The user account being used to access the device must be set to use the SSH shell and not the built-in Check Point CLI. For more information, consult the CheckPoint documentation.

Name

Description

CheckpointFWBackupStatus

Deprecated. Use ssh command instead. Connect to a CheckPoint firewall appliance using SSH and retrieve the status for backup tasks. The user account being used to access the device must be set to use the SSH shell and not the built-in CheckPoint CLI. For more information, consult the CheckPoint documentation.

CheckPointDownloadBackup

Deprecated. Use ssh command instead. Downloads the Check Point policy backup to the Cortex XSOAR War Room.

CheckpointFWCreateBackup

Deprecated. Use ssh command instead. Connect to a Check Point firewall appliance using SSH and trigger a task to create a configuration backup of the device. The user account being used to access the device must be set to use the SSH shell and not the built-in Check Point CLI. For more information, consult the CheckPoint documentation.

Name	Description
Check Point Firewall (Deprecated)	Deprecated. Use the Check Point Firewall v2 integration instead. Manage Check Point firewall via API
CheckPoint Firewall v2	Use this integration to read information and send commands to the Check Point Firewall server.

Name

Description

Check Point Firewall (Deprecated)

Deprecated. Use the Check Point Firewall v2 integration instead. Manage Check Point firewall via API

CheckPoint Firewall v2

Use this integration to read information and send commands to the Check Point Firewall server.

Name	Description
Checkpoint - Publish&Install configuration	Publish the Check Point Firewall configuration and install policy on all available gateways.
Checkpoint - Block IP - Append Group	The playbook receives malicious IP addresses as inputs, checks if the object group exists (if not, the object group is created), and appends the related IPs to that object. If you have not assigned the appended group to a rule in your firewall policy, you can use `rule_name` and the playbook creates a new rule.
Checkpoint - Block IP - Custom Block Rule	This playbook blocks IP addresses using Custom Block Rules in Check Point Firewall. The playbook receives malicious IP addresses as inputs, creates a custom bi-directional rule to block them, and publishes the configuration.
Checkpoint - Block URL	This playbook blocks URLs using Check Point Firewall through Custom URL Categories. The playbook checks whether the input URL category already exists, and if the URLs are a part of this category. Otherwise, it creates the category, blocks the URLs, and publishes the configuration.

Name

Description

Checkpoint - Publish&Install configuration

Publish the Check Point Firewall configuration and install policy on all available gateways.

Checkpoint - Block IP - Append Group

The playbook receives malicious IP addresses as inputs, checks if the object group exists (if not, the object group is created), and appends the related IPs to that object. If you have not assigned the appended group to a rule in your firewall policy, you can use rule_name and the playbook creates a new rule.

Checkpoint - Block IP - Custom Block Rule

This playbook blocks IP addresses using Custom Block Rules in Check Point Firewall.
The playbook receives malicious IP addresses as inputs, creates a custom bi-directional rule to block them, and publishes the configuration.

Checkpoint - Block URL

This playbook blocks URLs using Check Point Firewall through Custom URL Categories.
The playbook checks whether the input URL category already exists, and if the URLs are a part of this category. Otherwise, it creates the category, blocks the URLs, and publishes the configuration.

Name	Description
CheckpointFWBackupStatus	Deprecated. Use ssh command instead. Connect to a CheckPoint firewall appliance using SSH and retrieve the status for backup tasks. The user account being used to access the device must be set to use the SSH shell and not the built-in CheckPoint CLI. For more information, consult the CheckPoint documentation.
CheckpointFWCreateBackup	Deprecated. Use ssh command instead. Connect to a Check Point firewall appliance using SSH and trigger a task to create a configuration backup of the device. The user account being used to access the device must be set to use the SSH shell and not the built-in Check Point CLI. For more information, consult the CheckPoint documentation.
CheckPointDownloadBackup	Deprecated. Use ssh command instead. Downloads the Check Point policy backup to the Cortex XSIAM War Room.

Name

Description

CheckpointFWBackupStatus

CheckpointFWCreateBackup

CheckPointDownloadBackup

Deprecated. Use ssh command instead. Downloads the Check Point policy backup to the Cortex XSIAM War Room.

Name	Description
CheckPoint Firewall v2	Use this integration to read information and send commands to the Check Point Firewall server.
Check Point Firewall (Deprecated)	Deprecated. Use the Check Point Firewall v2 integration instead. Manage Check Point firewall via API

Name

Description

CheckPoint Firewall v2

Use this integration to read information and send commands to the Check Point Firewall server.

Check Point Firewall (Deprecated)

Deprecated. Use the Check Point Firewall v2 integration instead. Manage Check Point firewall via API

Name	Description
CheckPoint Firewall Collection

Name

Description

CheckPoint Firewall Collection

Name	Description
Checkpoint - Block IP - Append Group	The playbook receives malicious IP addresses as inputs, checks if the object group exists (if not, the object group is created), and appends the related IPs to that object. If you have not assigned the appended group to a rule in your firewall policy, you can use `rule_name` and the playbook creates a new rule.
Checkpoint - Block IP - Custom Block Rule	This playbook blocks IP addresses using Custom Block Rules in Check Point Firewall. The playbook receives malicious IP addresses as inputs, creates a custom bi-directional rule to block them, and publishes the configuration.
Checkpoint - Block URL	This playbook blocks URLs using Check Point Firewall through Custom URL Categories. The playbook checks whether the input URL category already exists, and if the URLs are a part of this category. Otherwise, it creates the category, blocks the URLs, and publishes the configuration.
Checkpoint - Publish&Install configuration	Publish the Check Point Firewall configuration and install policy on all available gateways.

Name

Description

Checkpoint - Block IP - Append Group

Checkpoint - Block IP - Custom Block Rule

Checkpoint - Block URL

Checkpoint - Publish&Install configuration

Publish the Check Point Firewall configuration and install policy on all available gateways.

Pack Name	Pack By
Base	By: Cortex XSOAR
Common Playbooks	By: Cortex XSOAR
Common Scripts	By: Cortex XSOAR
Remote Access	By: Cortex XSOAR

Pack Name	Pack By
Rasterize	By: Cortex XSOAR
Common Scripts	By: Cortex XSOAR
Common Playbooks	By: Cortex XSOAR
Filters And Transformers	By: Cortex XSOAR
Remote Access	By: Cortex XSOAR
Base	By: Cortex XSOAR
Cortex REST API	By: Cortex XSOAR
MITRE ATT&CK	By: Cortex XSOAR

Certification	Certified	Read more
Supported By	Cortex
Created	September 23, 2020
Last Release	November 21, 2023

Check Point Firewall

Check Point Firewall

Configuration on Server Side

Collect Events from Vendor

Broker VM

Integrations

CheckPoint Firewall v2

Scripts

CheckPointDownloadBackup

Integrations

CheckPoint Firewall v2

Playbooks

Checkpoint - Block IP - Append Group

Integrations

CheckPoint Firewall v2

Integrations

CheckPoint Firewall v2

Scripts

CheckpointFWBackupStatus

CheckpointFWCreateBackup

Integrations

CheckPoint Firewall v2

Scripts

CheckpointFWBackupStatus

CheckpointFWCreateBackup

PUBLISHER

PLATFORMS

INFO

WORKS WITH THE FOLLOWING INTEGRATIONS:

DISCLAIMER