https://live.paloaltonetworks.com/t5/cortex-xdr-discussions/cortex-xdr/m-p/547406#M4661 We have configured checkpoint firewall CEF log forwarding to Cortex XDR. Please provide a sample field for CEF-formatted logs. Tue, 27 Jun 2023 12:55:00 GMT Vinothkumar_SBA 2023-06-27T12:55:00Z https://live.paloaltonetworks.com/t5/cortex-xdr-discussions/cortex-xdr/m-p/547406#M4661 We have configured checkpoint firewall CEF log forwarding to Cortex XDR. Please provide a sample field for CEF-formatted logs. Tue, 27 Jun 2023 12:55:00 GMT https://live.paloaltonetworks.com/t5/cortex-xdr-discussions/cortex-xdr/m-p/547406#M4661 Vinothkumar_SBA 2023-06-27T12:55:00Z https://live.paloaltonetworks.com/t5/cortex-xdr-discussions/cortex-xdr/m-p/547610#M4673 <P>Hello&nbsp;<a href="https://live.paloaltonetworks.com/t5/user/viewprofilepage/user-id/243138">@Vinothkumar_SBA</a>&nbsp;</P> <P>&nbsp;</P> <P>Thanks for reaching out on LiveCommunity.</P> <P>If i understood your question correctly, you are looking for guidance on how to map external alerts from Checkpoint firewall to Cortex XDR.</P> <P>After<SPAN>&nbsp;</SPAN><SPAN class="phrase">Cortex XDR</SPAN><SPAN>&nbsp;</SPAN>begins receiving external alerts, you must map the following required fields to the<SPAN>&nbsp;</SPAN><SPAN class="phrase">Cortex XDR</SPAN><SPAN>&nbsp;</SPAN>format.</P> <DIV class="itemizedlist"> <UL class="itemizedlist"> <LI class="listitem"> <P>TIMESTAMP</P> </LI> <LI class="listitem"> <P>SEVERITY</P> </LI> <LI class="listitem"> <P>ALERT NAME</P> </LI> </UL> </DIV> <P>In addition, these optional fields are available, if you want to map them to the<SPAN>&nbsp;</SPAN><SPAN class="phrase">Cortex XDR</SPAN><SPAN>&nbsp;</SPAN>format.</P> <DIV class="itemizedlist"> <UL class="itemizedlist"> <LI class="listitem"> <P>SOURCE IP</P> </LI> <LI class="listitem"> <P>SOURCE PORT</P> </LI> <LI class="listitem"> <P>DESTINATION IP</P> </LI> <LI class="listitem"> <P>DESTINATION PORT</P> </LI> <LI class="listitem"> <P>DESCRIPTION</P> </LI> <LI class="listitem"> <P>DIRECTION</P> </LI> <LI class="listitem"> <P>EXTERNAL ID</P> </LI> <LI class="listitem"> <P>CATEGORY</P> </LI> <LI class="listitem"> <P>ACTION</P> </LI> <LI class="listitem"> <P>PROCESS COMMAND LINE</P> </LI> <LI class="listitem"> <P>PROCESS SHA256</P> </LI> <LI class="listitem"> <P>DOMAIN</P> </LI> <LI class="listitem"> <P>PROCESS FILE PATH</P> </LI> <LI class="listitem"> <P>HOSTNAME</P> </LI> <LI class="listitem"> <P>USERNAME</P> </LI> </UL> <P>Please refer to below link for more information on external alert&nbsp;</P> <P><A href="https://docs-cortex.paloaltonetworks.com/r/Cortex-XDR/Cortex-XDR-Pro-Administrator-Guide/Ingest-External-Alerts" target="_blank">https://docs-cortex.paloaltonetworks.com/r/Cortex-XDR/Cortex-XDR-Pro-Administrator-Guide/Ingest-External-Alerts</A></P> <P><A href="https://docs-cortex.paloaltonetworks.com/r/Cortex-XDR/Cortex-XDR-Pro-Administrator-Guide/Ingest-Logs-from-Check-Point-Firewalls" target="_blank">https://docs-cortex.paloaltonetworks.com/r/Cortex-XDR/Cortex-XDR-Pro-Administrator-Guide/Ingest-Logs-from-Check-Point-Firewalls</A></P> <P>&nbsp;</P> </DIV> Wed, 28 Jun 2023 17:29:28 GMT https://live.paloaltonetworks.com/t5/cortex-xdr-discussions/cortex-xdr/m-p/547610#M4673 nsinghvirk 2023-06-28T17:29:28Z https://live.paloaltonetworks.com/t5/cortex-xdr-discussions/cortex-xdr/m-p/547661#M4674 <P><SPAN>Thank you for the response!</SPAN></P> Thu, 29 Jun 2023 04:42:32 GMT https://live.paloaltonetworks.com/t5/cortex-xdr-discussions/cortex-xdr/m-p/547661#M4674 Vinothkumar_SBA 2023-06-29T04:42:32Z