Purpose
This guide explains how to configure the Check Point Management Response integration in Logsign USO, so that Incidents and Alarms can automatically, or an analyst can manually, list and manage host objects, list managed gateways, and block or unblock an IP through the Check Point Management API. This is a Response (action) integration, configured under Settings > Integrations > Responses > +Device.
This is a different integration from "Check Point Firewall" (the existing block-ip/unblock-ip integration documented in CheckPoint Firewall Integration and Incident Management - Checkpoint Action), which talks to an individual gateway's run-script API. Check Point Management instead talks to the Security Management Server itself, and works at the level of managed objects (hosts, gateways) and policy install, per the Check Point Management API reference: Check Point Management API. If your environment centrally manages gateways through a Security Management Server or Multi-Domain Server, this is typically the more appropriate integration to use; if you only have a standalone gateway, the existing "Check Point Firewall" integration may be simpler.
Prerequisites
- A Check Point Security Management Server (or Multi-Domain Server) with Web API access enabled.
- An administrator account with permission to read/write host objects and to install policy (required for a host-object change to actually take effect on gateways).
- Use least privilege. Create a dedicated administrator profile for this integration in SmartConsole, scoped to the specific objects and policy layers this integration needs to touch, rather than reusing a Super User account.
Step 1: Enable the Web API and Prepare an Account
- Log in to Check Point SmartConsole (or the Security Management Server's Gaia portal) with an administrator account.
- Enable Web Services / the Management API if it is not already enabled (Manage & Settings > Blades > Management API in SmartConsole, or the equivalent Gaia setting, depending on your Check Point version).
- Create a dedicated administrator account for Logsign to use, and note its username and password.
- Note the Security Management Server's base URL (the address SmartConsole/Web API clients use to reach it).
Step 2: Configure the Integration in Logsign USO
In Logsign USO, go to Settings > Integrations > Responses, search for Check Point Management, click Configure then +Device, and fill in:
| Field | Required | Description |
|---|---|---|
| Device Name | Yes | Free-text label identifying this Check Point Management device in Logsign. |
| Base Url | Yes | Base URL of your Security Management Server's Web API. |
| User | Yes | The administrator account username from Step 1. |
| Password | Yes | Password for that account. Stored encrypted at rest. |
Click Create to save the device.
Available Methods
- show-hosts (Analysis) — lists host objects.
- show-host (Analysis) — gets details of a specific host object.
- add-host — creates a new host object.
- delete-host — removes a host object.
- show-simple-gateways (Analysis) — lists managed gateways.
- block (Containment) — blocks an IP via the Check Point Management API.
- unblock (Recovery) — unblocks a previously blocked IP.
As with any Check Point Management API change, object/policy changes generally require a policy install to take effect on the actual gateways; confirm your Check Point environment's policy-install behavior (automatic vs. manual) applies to changes made through this integration.
Troubleshooting
| Symptom | Likely cause | What to check |
|---|---|---|
| 401 Unauthorized | Wrong User/Password, or the Web API session could not be established. | Re-enter the User and Password fields and confirm the account can log in to SmartConsole directly. |
| 403 Forbidden | The account's administrator profile does not permit the object/action being called. | Confirm the account's assigned permission profile in SmartConsole covers host object and policy management. |
| block/add-host succeeds but has no effect on traffic | Policy was not installed after the change. | Confirm whether your environment auto-installs policy on API changes, or whether a manual policy install/publish step is required. |
Notes and Limits
- This integration is separate from the existing "Check Point Firewall" (block-ip/unblock-ip via run-script) integration; do not assume the two are interchangeable or that configuring one also configures the other.
- The exact SmartConsole navigation path for enabling the Web API and creating a scoped administrator profile was not independently verified against a live Security Management Server during this research (not independently verified); the field names and method behavior above are taken directly from Logsign's integration code. For general Check Point Management API reference, see Check Point's own API documentation.