Purpose
This guide explains how to send Check Point Harmony Endpoint events to Logsign USO over syslog using the Event Forwarding feature of the Check Point Infinity Portal. Event Forwarding delivers each record as an RFC 5424 syslog message with a JSON body. Logsign parses these messages with the dedicated Harmony Endpoint plugin, which covers both Infinity Portal management audit records (for example policy installation) and Harmony Endpoint logs such as Threat Emulation, Threat Extraction, Anti-Malware, URL Filtering and Endpoint Security Console audit events.
If you collect Harmony Endpoint data through the API instead, see Checkpoint Harmony integration via API. The two methods are configured separately.
Prerequisites
- Logsign USO version 6.4.119 or later.
- A Check Point Infinity Portal account that is allowed to manage Event Forwarding settings for your Harmony Endpoint tenant.
- Network connectivity from the forwarding source to the Logsign USO collector on your syslog port (UDP/TCP 514 by default). Event Forwarding is sent by Check Point, so make sure the collector port is reachable from the address the messages actually arrive from.
Step 1: Configure Event Forwarding in the Infinity Portal
Menu names can differ between Infinity Portal releases. If a step below does not match your portal, check the Check Point Infinity Portal documentation for Event Forwarding.
- Log in to the Check Point Infinity Portal.
- Open the Event Forwarding settings and add a new syslog destination.
- Enter the IP address or host name of the Logsign USO collector, and set the protocol and port.
- Select the Harmony Endpoint logs you want to forward and save the destination.
Messages sent by Event Forwarding carry an application name that starts with eventforwarding- in the syslog header. Logsign uses this value to recognize the records, so do not change or strip it on the way.
Step 2: Add the Data Source in Logsign USO
- Add a new syslog source in Logsign USO for the IP address the Event Forwarding messages arrive from.
- Select CheckPoint as the vendor and Harmony Endpoint as the product.
- Harmony Endpoint records are long single-line JSON messages. If your records are longer than the Max Line Length to Process value of the source, increase it so the JSON body is not cut off.
- Click Save.
Do not select the Check Point Log Exporter product for these messages. That plugin parses the key/value output of the on-premises Log Exporter and does not recognize the JSON body sent by Event Forwarding, so the records would stay uncategorized.
Supported Message Format
Logsign parses messages that look like this:
1 2026-09-09T13:01:19.548Z Checkpoint eventforwarding-00000000-0000-0000-0000-000000000000 1650 - - {"time":"2026-09-09 12:50:12","action":"Allow","product":"Threat Emulation","event_type":"TE Event","product_family":"Endpoint","severity":"Informational","verdict":"Benign","file_name":["report.xlsx"]}
The line must start with the syslog header (an optional version number, the timestamp, host name, an application name beginning with eventforwarding-, PROCID, MSGID and structured data), followed by a single JSON object on the same line. Timestamps can end with Z or a UTC offset, with or without fractional seconds.
How Records Are Processed
- Time: Time.Generated is taken from the
timefield (Harmony Endpoint logs) or thecreatedAtfield (Infinity Portal audit) of the JSON body. Check Point sends these values in UTC, and Logsign converts them to the local time of the Logsign server. If the body has no time in the expected text format, the syslog header timestamp is used instead. - List values: Check Point wraps many values in JSON arrays, for example
"file_name":["report.xlsx"]. Array items are joined into one value separated by;. For URLs, the first entry ofresourceis also split into scheme, domain, path and query. - Empty values: fields that are empty or contain only spaces are skipped.
- Severity: the
severityvalue sent by Check Point is used when present (Info or Informational as information, Low as notice, Medium as warning, High as error). When the record has no severity, the severity defined for that event in the Logsign Check Point event library is used.
What Gets Collected
| Check Point JSON Field | Logsign Field |
|---|---|
product or category | Event.Category |
product_family | Event.SubCategory |
event_type or event | Event.Type |
action | Event.Action |
verdict | Event.Result |
reason | Event.Reason |
module | Event.Module |
description or eventData | Event.Note |
action_details | Event.Description |
additional_info | Event.AdditionalInformation |
src_user_name, user_name, user or createdBy | Source.UserName |
user_sid | Source.UserSID |
authType | Source.UserType |
src_machine_name | Source.HostName |
os_name, os_version | Source.OS, Source.OSVersion |
src or client_ip | Source.IP |
dst | Destination.IP |
administrator | Source.AdministratorName |
orig, origin_sic_name | Source.Origin, Source.OriginSIC |
domain_name | Source.Domain |
_tenant_id or tenant_id | Tenant.ID |
operation, result | Operation.Name, Operation.Result |
subject | TargetSubject.Info |
objectname | Object.Name |
file_md5, file_sha1, file_sha256, file_size | Object.MD5, Object.SHA1, Object.SHA256, Object.Size |
file_name, file_type | File.Name, File.Type |
process_exe_path | Process.Path |
malware_action | Threat.ActionTaken |
protection_name, protection_type | Protection.Name, Protection.Type |
policy_name or securitypolicy | Policy.Name |
machine_guid, host_type | Device.ID, Device.Type |
engine_ver | Engine.Version |
client_version | Authentication.ClientVersion |
appi_name, app_rule_name, app_properties | Application.Name, Application.RuleName, Application.Properties |
matched_category | URL.Category |
resource | URL.URI, URL.Scheme, URL.Domain, URL.Path, URL.Query |
web_client_type | URL.Client |
i_f_dir | Traffic.Direction |
| Host name in the syslog header | EventSource.HostName |
JSON fields that are not listed above are not shown as separate Logsign fields.
Event Classification
Records are classified with the Logsign Check Point event library, which is shared with the Check Point Log Exporter plugin. The lookup combines Event.Category, Event.Type and Event.Action. Some examples:
| Record | EventMap (Context / Type / SubType) | Event.Info |
|---|---|---|
| Threat Emulation, TE Event, Allow | Security / Malware / Info | Threat Emulation Allow |
| Threat Extraction, TEX Event, Extract | System / Operation / Info | Threat Extraction Extract |
| Infinity Portal audit, category Policy, event INSTALL POLICIES | System / Policy / Apply | Infinity Portal Install Policies |
Records that have no matching entry in the library are classified as Security / Other / Other.
Every record is stored with Vendor CheckPoint, Product Harmony Endpoint, EventSource Type Security System, Category Security Manager and Prefix ID 4427. Event.SystemID is the Prefix ID followed by the Event.VendorID of the matched library entry.
Notes and Limits
- The syslog header must be at the very start of the line. If the messages pass through an intermediate syslog server that adds its own timestamp or host name in front of the original message, the records are shown as uncategorized. Forward the original message unchanged, or send it directly to Logsign USO.
- Each record must be a single, complete JSON object on one line. Records that are cut off, bodies that are a JSON array, and messages with plain text instead of JSON are not parsed.
- Messages whose application name does not start with
eventforwarding-are not parsed by this plugin. - The API integration for Harmony Endpoint uses the same Prefix ID (4427) and Product name, but stores events with EventSource Type Cloud Computing. If you use both methods, filter on EventSource.Type to tell the two sources apart in searches and reports.