Configuring Smartevent; Preparing Smartevent On Security Management Server; Configuring The Smartevent Clients - Check Point Smart-1 25 Getting Started Manual

Chapter 3

Configuring SmartEvent

This section explains how to get up and running with SmartEvent.
In This Chapter

Preparing SmartEvent on Security Management Server

Configuring the SmartEvent Clients

Preparing SmartEvent on Security
Management Server
To configure SmartEvent, first establish connectivity between the components.
1. Launch SmartDashboard.
2. In SmartDashboard, create a new host for each computer that contains a component of SmartEvent:
a) Select Manage > Network Object > New > Check Point > Host
b) In the General Properties window, click Communication and enter the activation key.
Note - If the Security Management Server and SmartEvent are installed on different sides of the firewall,
add a rule that allows SIC traffic between them.
c) The version is not entered automatically if the SmartEvent version is newer than the version of the
Security Management Server. If so, select the most recent version available from the Version drop-
down list.
d) In the Management Software Blades list, select the blades that are installed on the new host.
3. Install the database on all log servers from which SmartEvent reads data: select Policy > Install
Database and select the log servers as the targets.
4. To allow the SmartEvent Intro server to block attacks from specific IP addresses, configure the Security
Management Server to accept SAM commands from the SmartEvent Intro server:
a) On the Security Management Server, edit the $CPDIR/conf/sic_policy.conf file:
Search for the section [Inbound rules], and add the following line under # sam proxy:
DN_Mgmt ; Reporting_Tool; ANY; sam ; sslca
b) From the command line in the Security Management Server computer, run the following commands:
cpstop
cpstart
Configuring the SmartEvent Clients
You must perform these configurations to make the components of the SmartEvent functional.
After you have accomplished the tasks for SmartEvent Intro, events will begin to appear in the SmartEvent
Intro client.
After you have accomplished the tasks for SmartReporter, logs will be created and sent to the
SmartReporter database. Reports can then be created.
24
24
Page 24