This is the multi-page printable view of this section. Click here to print.

Return to the regular view of this page.

Check Point

1 - Anti-Bot

Anti-Bot: Detects and blocks botnet communications and command-and-control traffic to prevent malware infections.

To onboard such a source to Axoflow, complete the generic appliance onboarding steps.

Labels

Axoflow automatically adds the following labels to data collected from this source:

Analytics label Message field value
vendor meta.vendor checkpoint
product meta.product anti-bot

You can use the labels as:

You can use the message fields

  • in Flow Processing steps, for example, in the Query field of Select Messages steps,
  • in AQL expressions in the search bars.

Sending data to Splunk

When sending the data collected from this source to Splunk, Axoflow uses the following sourcetype and index settings:

sourcetype source index
cp_log checkpoint:endpoint netops

Sending data to Google SecOps

When sending the data collected from this source to a dynamic Google SecOps destination, Axoflow sets the following log type: CHECKPOINT_EDR.

2 - Anti-Malware

Anti-Malware: Protects endpoints from viruses, ransomware, and other malware using signature and behavior analysis.

To onboard such a source to Axoflow, complete the generic appliance onboarding steps.

Labels

Axoflow automatically adds the following labels to data collected from this source:

Analytics label Message field value
vendor meta.vendor checkpoint
product meta.product anti-malware

You can use the labels as:

You can use the message fields

  • in Flow Processing steps, for example, in the Query field of Select Messages steps,
  • in AQL expressions in the search bars.

Sending data to Splunk

When sending the data collected from this source to Splunk, Axoflow uses the following sourcetype and index settings:

sourcetype source index
cp_log checkpoint:endpoint netops

Sending data to Google SecOps

When sending the data collected from this source to a dynamic Google SecOps destination, Axoflow sets the following log type: CHECKPOINT_EDR.

3 - Anti-Phishing

Anti-Phishing: Prevents phishing attacks by analyzing email content and links to block credential theft attempts.

To onboard such a source to Axoflow, complete the generic appliance onboarding steps.

Labels

Axoflow automatically adds the following labels to data collected from this source:

Analytics label Message field value
vendor meta.vendor checkpoint
product meta.product anti-phishing

You can use the labels as:

You can use the message fields

  • in Flow Processing steps, for example, in the Query field of Select Messages steps,
  • in AQL expressions in the search bars.

Sending data to Splunk

When sending the data collected from this source to Splunk, Axoflow uses the following sourcetype and index settings:

sourcetype source index
cp_log checkpoint:email email

Sending data to Google SecOps

When sending the data collected from this source to a dynamic Google SecOps destination, Axoflow sets the following log type: CHECKPOINT_EMAIL.

4 - Anti-Spam and Email Security

Anti-Spam and Email Security: Blocks spam and malicious email content using reputation checks and email filtering techniques.

To onboard such a source to Axoflow, complete the generic appliance onboarding steps.

Labels

Axoflow automatically adds the following labels to data collected from this source:

Analytics label Message field value
vendor meta.vendor checkpoint
product meta.product antispam-emailsecurity

You can use the labels as:

You can use the message fields

  • in Flow Processing steps, for example, in the Query field of Select Messages steps,
  • in AQL expressions in the search bars.

Sending data to Splunk

When sending the data collected from this source to Splunk, Axoflow uses the following sourcetype and index settings:

sourcetype source index
cp_log checkpoint:email email

Sending data to Google SecOps

When sending the data collected from this source to a dynamic Google SecOps destination, Axoflow sets the following log type: CHECKPOINT_EMAIL.

5 - CPMI Client

CPMI Client: Legacy Check Point management client used to interface with security policies and logs.

To onboard such a source to Axoflow, complete the generic appliance onboarding steps.

Labels

Axoflow automatically adds the following labels to data collected from this source:

Analytics label Message field value
vendor meta.vendor checkpoint
product meta.product cpmi-client

You can use the labels as:

You can use the message fields

  • in Flow Processing steps, for example, in the Query field of Select Messages steps,
  • in AQL expressions in the search bars.

Sending data to Splunk

When sending the data collected from this source to Splunk, Axoflow uses the following sourcetype and index settings:

sourcetype index
cp_log netops

Sending data to Google SecOps

When sending the data collected from this source to a dynamic Google SecOps destination, Axoflow sets the following log type: CHECKPOINT_FIREWALL.

6 - cpmidu_update_tool

cpmidu_update_tool: Utility used to update configuration and database files for Check Point Multi-Domain environments.

To onboard such a source to Axoflow, complete the generic appliance onboarding steps.

Labels

Axoflow automatically adds the following labels to data collected from this source:

Analytics label Message field value
vendor meta.vendor checkpoint
product meta.product cpmidu-update-tool

You can use the labels as:

You can use the message fields

  • in Flow Processing steps, for example, in the Query field of Select Messages steps,
  • in AQL expressions in the search bars.

Sending data to Splunk

When sending the data collected from this source to Splunk, Axoflow uses the following sourcetype and index settings:

sourcetype source index
cp_log checkpoint:audit netops

Sending data to Google SecOps

When sending the data collected from this source to a dynamic Google SecOps destination, Axoflow sets the following log type: CHECKPOINT_FIREWALL.

7 - Database Tool

Database Tool: Command-line tool to extract, query, or update Check Point configuration and policy databases.

To onboard such a source to Axoflow, complete the generic appliance onboarding steps.

Labels

Axoflow automatically adds the following labels to data collected from this source:

Analytics label Message field value
vendor meta.vendor checkpoint
product meta.product database-tool

You can use the labels as:

You can use the message fields

  • in Flow Processing steps, for example, in the Query field of Select Messages steps,
  • in AQL expressions in the search bars.

Sending data to Splunk

When sending the data collected from this source to Splunk, Axoflow uses the following sourcetype and index settings:

sourcetype source index
cp_log checkpoint:audit netops

8 - Edge Secure Web Gateway (Edge SWG)

Edge Secure Web Gateway (Edge SWG): Provides configuration profiles for secure mobile access and web filtering on iOS devices.

To onboard such a source to Axoflow, complete the generic appliance onboarding steps.

Labels

Axoflow automatically adds the following labels to data collected from this source:

Analytics label Message field value
vendor meta.vendor checkpoint
product meta.product ios-profiles

You can use the labels as:

You can use the message fields

  • in Flow Processing steps, for example, in the Query field of Select Messages steps,
  • in AQL expressions in the search bars.

Sending data to Splunk

When sending the data collected from this source to Splunk, Axoflow uses the following sourcetype and index settings:

sourcetype source index
cp_log checkpoint:network netops

Sending data to Google SecOps

When sending the data collected from this source to a dynamic Google SecOps destination, Axoflow sets the following log type: CHECKPOINT_HARMONY.

9 - Endpoint Compliance

Endpoint Compliance: Checks endpoint status and posture before granting network access, enforcing security policies.

To onboard such a source to Axoflow, complete the generic appliance onboarding steps.

Labels

Axoflow automatically adds the following labels to data collected from this source:

Analytics label Message field value
vendor meta.vendor checkpoint
product meta.product endpoint-compliance

You can use the labels as:

You can use the message fields

  • in Flow Processing steps, for example, in the Query field of Select Messages steps,
  • in AQL expressions in the search bars.

Sending data to Splunk

When sending the data collected from this source to Splunk, Axoflow uses the following sourcetype and index settings:

sourcetype source index
cp_log checkpoint:endpoint netops

Sending data to Google SecOps

When sending the data collected from this source to a dynamic Google SecOps destination, Axoflow sets the following log type: CHECKPOINT_EDR.

10 - Endpoint Management

Endpoint Management: Centralized platform for managing endpoint protection, updates, and policy enforcement.

To onboard such a source to Axoflow, complete the generic appliance onboarding steps.

Labels

Axoflow automatically adds the following labels to data collected from this source:

Analytics label Message field value
vendor meta.vendor checkpoint
product meta.product endpoint-management

You can use the labels as:

You can use the message fields

  • in Flow Processing steps, for example, in the Query field of Select Messages steps,
  • in AQL expressions in the search bars.

Sending data to Splunk

When sending the data collected from this source to Splunk, Axoflow uses the following sourcetype and index settings:

sourcetype source index
cp_log checkpoint:endpoint netops

11 - Forensics

Forensics: Analyzes security incidents on endpoints to uncover attack vectors and malicious activity.

To onboard such a source to Axoflow, complete the generic appliance onboarding steps.

Labels

Axoflow automatically adds the following labels to data collected from this source:

Analytics label Message field value
vendor meta.vendor checkpoint
product meta.product forensics

You can use the labels as:

You can use the message fields

  • in Flow Processing steps, for example, in the Query field of Select Messages steps,
  • in AQL expressions in the search bars.

Sending data to Splunk

When sending the data collected from this source to Splunk, Axoflow uses the following sourcetype and index settings:

sourcetype source index
cp_log checkpoint:endpoint netops

Sending data to Google SecOps

When sending the data collected from this source to a dynamic Google SecOps destination, Axoflow sets the following log type: CHECKPOINT_EDR.

12 - GO Password Reset

GO Password Reset: Facilitates secure password reset processes for users across integrated environments.

To onboard such a source to Axoflow, complete the generic appliance onboarding steps.

Labels

Axoflow automatically adds the following labels to data collected from this source:

Analytics label Message field value
vendor meta.vendor checkpoint
product meta.product go-password-reset

You can use the labels as:

You can use the message fields

  • in Flow Processing steps, for example, in the Query field of Select Messages steps,
  • in AQL expressions in the search bars.

Sending data to Splunk

When sending the data collected from this source to Splunk, Axoflow uses the following sourcetype and index settings:

sourcetype source index
cp_log checkpoint:audit netops

Sending data to Google SecOps

When sending the data collected from this source to a dynamic Google SecOps destination, Axoflow sets the following log type: CHECKPOINT_AUDIT.

13 - HTTPS Inspection

HTTPS Inspection: Decrypts and inspects HTTPS traffic to detect hidden threats within encrypted web sessions.

To onboard such a source to Axoflow, complete the generic appliance onboarding steps.

Labels

Axoflow automatically adds the following labels to data collected from this source:

Analytics label Message field value
vendor meta.vendor checkpoint
product meta.product https-inspection
service meta.service.name CP-GW

You can use the labels as:

You can use the message fields

  • in Flow Processing steps, for example, in the Query field of Select Messages steps,
  • in AQL expressions in the search bars.

Sending data to Splunk

When sending the data collected from this source to Splunk, Axoflow uses the following sourcetype and index settings:

sourcetype source index
cp_log checkpoint:firewall netfw

Sending data to Google SecOps

When sending the data collected from this source to a dynamic Google SecOps destination, Axoflow sets the following log type: CHECKPOINT_FIREWALL.

14 - IPS

IPS: Detects and blocks known and unknown exploits, malware, and vulnerabilities in network traffic.

To onboard such a source to Axoflow, complete the generic appliance onboarding steps.

Labels

Axoflow automatically adds the following labels to data collected from this source:

Analytics label Message field value
vendor meta.vendor checkpoint
product meta.product ips

You can use the labels as:

You can use the message fields

  • in Flow Processing steps, for example, in the Query field of Select Messages steps,
  • in AQL expressions in the search bars.

Sending data to Splunk

When sending the data collected from this source to Splunk, Axoflow uses the following sourcetype and index settings:

sourcetype source index
cp_log checkpoint:ids netids

Sending data to Google SecOps

When sending the data collected from this source to a dynamic Google SecOps destination, Axoflow sets the following log type: CHECKPOINT_EDR.

15 - MDS Query Tool

MDS Query Tool: CLI tool for querying multi-domain configurations and policies in Check Point environments.

To onboard such a source to Axoflow, complete the generic appliance onboarding steps.

Labels

Axoflow automatically adds the following labels to data collected from this source:

Analytics label Message field value
vendor meta.vendor checkpoint
product meta.product mds-query-tool

You can use the labels as:

You can use the message fields

  • in Flow Processing steps, for example, in the Query field of Select Messages steps,
  • in AQL expressions in the search bars.

Sending data to Splunk

When sending the data collected from this source to Splunk, Axoflow uses the following sourcetype and index settings:

sourcetype index
cp_log netops

16 - Media Encryption & Port Protection

Media Encryption & Port Protection: Secures USB ports and encrypts removable media to protect sensitive data on endpoints.

To onboard such a source to Axoflow, complete the generic appliance onboarding steps.

Labels

Axoflow automatically adds the following labels to data collected from this source:

Analytics label Message field value
vendor meta.vendor checkpoint
product meta.product media-port

You can use the labels as:

You can use the message fields

  • in Flow Processing steps, for example, in the Query field of Select Messages steps,
  • in AQL expressions in the search bars.

Sending data to Splunk

When sending the data collected from this source to Splunk, Axoflow uses the following sourcetype and index settings:

sourcetype source index
cp_log checkpoint:endpoint netops

Sending data to Google SecOps

When sending the data collected from this source to a dynamic Google SecOps destination, Axoflow sets the following log type: CHECKPOINT_EDR.

17 - Mobile Access

Mobile Access: Enables secure remote access to corporate apps and data from mobile devices.

To onboard such a source to Axoflow, complete the generic appliance onboarding steps.

Labels

Axoflow automatically adds the following labels to data collected from this source:

Analytics label Message field value
vendor meta.vendor checkpoint
product meta.product mobile-access

You can use the labels as:

You can use the message fields

  • in Flow Processing steps, for example, in the Query field of Select Messages steps,
  • in AQL expressions in the search bars.

Sending data to Splunk

When sending the data collected from this source to Splunk, Axoflow uses the following sourcetype and index settings:

sourcetype source index
cp_log checkpoint:network netops

18 - Next-Generation Firewall (NGFW)

Next-Generation Firewall (NGFW): Next-generation firewall providing intrusion prevention, application control, and threat protection.

To onboard such a source to Axoflow, complete the generic appliance onboarding steps.

Labels

Axoflow automatically adds the following labels to data collected from this source:

Analytics label Message field value
vendor meta.vendor checkpoint
product meta.product firewall
service meta.service.name CP-GW

You can use the labels as:

You can use the message fields

  • in Flow Processing steps, for example, in the Query field of Select Messages steps,
  • in AQL expressions in the search bars.

Sending data to Splunk

When sending the data collected from this source to Splunk, Axoflow uses the following sourcetype and index settings:

sourcetype source index
cp_log checkpoint:firewall netfw

Sending data to Google SecOps

When sending the data collected from this source to a dynamic Google SecOps destination, Axoflow sets the following log type: CHECKPOINT_FIREWALL.

19 - QoS

QoS: Implements bandwidth control and traffic prioritization policies for optimized network usage.

To onboard such a source to Axoflow, complete the generic appliance onboarding steps.

Labels

Axoflow automatically adds the following labels to data collected from this source:

Analytics label Message field value
vendor meta.vendor checkpoint
product meta.product qos

You can use the labels as:

You can use the message fields

  • in Flow Processing steps, for example, in the Query field of Select Messages steps,
  • in AQL expressions in the search bars.

Sending data to Splunk

When sending the data collected from this source to Splunk, Axoflow uses the following sourcetype and index settings:

sourcetype source index
cp_log checkpoint:firewall netfw

Sending data to Google SecOps

When sending the data collected from this source to a dynamic Google SecOps destination, Axoflow sets the following log type: CHECKPOINT_FIREWALL.

20 - Quantum

Quantum: Unified threat prevention platform delivering firewall, VPN, and intrusion prevention capabilities.

If you’d like to send data from this source to AxoRouter, contact our support team for details.

21 - Query Database

Query Database: Accesses and queries internal policy or object databases in Check Point systems.

To onboard such a source to Axoflow, complete the generic appliance onboarding steps.

Labels

Axoflow automatically adds the following labels to data collected from this source:

Analytics label Message field value
vendor meta.vendor checkpoint
product meta.product query-database

You can use the labels as:

You can use the message fields

  • in Flow Processing steps, for example, in the Query field of Select Messages steps,
  • in AQL expressions in the search bars.

Sending data to Splunk

When sending the data collected from this source to Splunk, Axoflow uses the following sourcetype and index settings:

sourcetype source index
cp_log checkpoint:audit netops

22 - SmartConsole

SmartConsole: Graphical interface for managing Check Point security policies, logs, and monitoring.

To onboard such a source to Axoflow, complete the generic appliance onboarding steps.

Labels

Axoflow automatically adds the following labels to data collected from this source:

Analytics label Message field value
vendor meta.vendor checkpoint
product meta.product smartconsole

You can use the labels as:

You can use the message fields

  • in Flow Processing steps, for example, in the Query field of Select Messages steps,
  • in AQL expressions in the search bars.

Sending data to Splunk

When sending the data collected from this source to Splunk, Axoflow uses the following sourcetype and index settings:

sourcetype source index
cp_log checkpoint:audit netops

23 - SmartUpdate

SmartUpdate: Tool for updating and managing licenses, software, and hotfixes in Check Point environments.

To onboard such a source to Axoflow, complete the generic appliance onboarding steps.

Labels

Axoflow automatically adds the following labels to data collected from this source:

Analytics label Message field value
vendor meta.vendor checkpoint
product meta.product smartupdate

You can use the labels as:

You can use the message fields

  • in Flow Processing steps, for example, in the Query field of Select Messages steps,
  • in AQL expressions in the search bars.

Sending data to Splunk

When sending the data collected from this source to Splunk, Axoflow uses the following sourcetype and index settings:

sourcetype source index
cp_log checkpoint:audit netops

24 - Threat Emulation and Anti-Exploit

Threat Emulation and Anti-Exploit: Emulates files in a virtual environment to detect and block advanced persistent threats and exploits.

To onboard such a source to Axoflow, complete the generic appliance onboarding steps.

Labels

Axoflow automatically adds the following labels to data collected from this source:

Analytics label Message field value
vendor meta.vendor checkpoint
product meta.product threat-emulation

You can use the labels as:

You can use the message fields

  • in Flow Processing steps, for example, in the Query field of Select Messages steps,
  • in AQL expressions in the search bars.

Sending data to Splunk

When sending the data collected from this source to Splunk, Axoflow uses the following sourcetype and index settings:

sourcetype source index
cp_log checkpoint:endpoint netops

Sending data to Google SecOps

When sending the data collected from this source to a dynamic Google SecOps destination, Axoflow sets the following log type: CHECKPOINT_EDR.

25 - URL Filtering

URL Filtering: Controls and logs web access based on URL categories and custom site rules to enforce policy.

To onboard such a source to Axoflow, complete the generic appliance onboarding steps.

Labels

Axoflow automatically adds the following labels to data collected from this source:

Analytics label Message field value
vendor meta.vendor checkpoint
product meta.product url-filtering
service meta.service.name CP-GW

You can use the labels as:

You can use the message fields

  • in Flow Processing steps, for example, in the Query field of Select Messages steps,
  • in AQL expressions in the search bars.

Sending data to Splunk

When sending the data collected from this source to Splunk, Axoflow uses the following sourcetype and index settings:

sourcetype source index
cp_log checkpoint:firewall netfw

Sending data to Google SecOps

When sending the data collected from this source to a dynamic Google SecOps destination, Axoflow sets the following log type: CHECKPOINT_FIREWALL.

26 - Web API

Web API: Provides programmatic access to Check Point security management through RESTful API endpoints.

To onboard such a source to Axoflow, complete the generic appliance onboarding steps.

Labels

Axoflow automatically adds the following labels to data collected from this source:

Analytics label Message field value
vendor meta.vendor checkpoint
product meta.product web-api

You can use the labels as:

You can use the message fields

  • in Flow Processing steps, for example, in the Query field of Select Messages steps,
  • in AQL expressions in the search bars.

Sending data to Splunk

When sending the data collected from this source to Splunk, Axoflow uses the following sourcetype and index settings:

sourcetype source index
cp_log checkpoint:audit netops