Integrating with Check Point Harmony

Overview

The Check Point Harmony log integration includes ingestion of Check Point Harmony Email Security logs. Sending these logs to Blumira for storage and analysis alongside other ingested data centralizes visibility while helping you to meet reporting and compliance needs.

Before you begin

This integration requires a Blumira sensor to be installed before you can complete the steps below. Ensure that you complete the steps in Building a Blumira sensor with Ubuntu before you continue.

Gather the IP address of your Blumira sensor to use when configuring the external service.

To find and copy the IP address of the sensor, do the following:

1. In Blumira, navigate to Ingestion > Sensors.
2. Click the sensor row to open the details page.
3. In the Overview section, next to Host Details, copy the IP address.

Sending logs to Blumira

To begin forwarding logs to Blumira, do the following:

1. Log in to the Infinity Portal.
2. Click Security Settings > Security Engines.
3. For SIEM Integration, click Configure.
4. Under Transport, select TCP.
5. In the "TCP Host" box, type the IP address of your Blumira sensor.
6. In the "TCP Port" box, type 514.
7. Under Format, select JSON.
8. Click Save.
   

Reference: For additional information, including the list of supported security events, see Managing Security Events: SIEM / SOAR Integration in the Check Point Harmony Email & Collaboration Administration Guide.