Flex Config File Not Parsing Log Files

Products

• CASB Security Standard
• CASB Security Premium
• CASB Security Advanced
• CASB Audit
• CASB Gateway
• CASB Gateway Advanced

Issue/Introduction

When creating a custom flex config to parse Checkpoint log data, it is not functioning correctly. 

CloudSOC may say that it has processed the data, but when clicking on data none is available. 

Cause

One possible cause is that the Config format does not match the logs format.

Resolution

1. Log in to CloudSOC
2. Navigate to the Knowledge Base web page
3. Click the 'Audit' option
4. Locate the Knowledge Base Article titled: Using the Flex Universal Log Processor
5. Click Knowledge Base Article to download
6. Follow directions as outlined

 

Flex universal log processor