checkpoint-quantum-firewall.yaml

# bypass-global-no-service-config-checks
id: checkpoint-quantum-firewall
metric_id: checkpoint-quantum-firewall
backend_only: false
facets:
  - groups:
      - Geoip
    name: City Name
    path: network.client.geoip.city.name
    source: log
  - groups:
      - Geoip
    name: Continent Code
    path: network.client.geoip.continent.code
    source: log
  - groups:
      - Geoip
    name: Continent Name
    path: network.client.geoip.continent.name
    source: log
  - groups:
      - Geoip
    name: Country ISO Code
    path: network.client.geoip.country.iso_code
    source: log
  - groups:
      - Geoip
    name: Country Name
    path: network.client.geoip.country.name
    source: log
  - groups:
      - Geoip
    name: Subdivision ISO Code
    path: network.client.geoip.subdivision.iso_code
    source: log
  - groups:
      - Geoip
    name: Subdivision Name
    path: network.client.geoip.subdivision.name
    source: log
  - groups:
      - Web Access
    name: Client IP
    path: network.client.ip
    source: log
  - groups:
      - Web Access
    name: Client Port
    path: network.client.port
    source: log
  - groups:
      - Geoip
    name: Destination City Name
    path: network.destination.geoip.city.name
    source: log
  - groups:
      - Geoip
    name: Destination Continent Code
    path: network.destination.geoip.continent.code
    source: log
  - groups:
      - Geoip
    name: Destination Continent Name
    path: network.destination.geoip.continent.name
    source: log
  - groups:
      - Geoip
    name: Destination Country ISO Code
    path: network.destination.geoip.country.iso_code
    source: log
  - groups:
      - Geoip
    name: Destination Country Name
    path: network.destination.geoip.country.name
    source: log
  - groups:
      - Geoip
    name: Destination Subdivision ISO Code
    path: network.destination.geoip.subdivision.iso_code
    source: log
  - groups:
      - Geoip
    name: Destination Subdivision Name
    path: network.destination.geoip.subdivision.name
    source: log
  - groups:
      - Web Access
    name: Destination IP
    path: network.destination.ip
    source: log
  - groups:
      - Web Access
    name: Destination Port
    path: network.destination.port
    source: log
  - groups:
      - User
    name: User Name
    path: usr.name
    source: log
  - facetType: list
    groups:
      - Checkpoint Quantum Firewall
    name: Application Name
    path: checkpoint.quantum.firewall.appi_name
    source: log
    type: string
  - facetType: list
    groups:
      - Checkpoint Quantum Firewall
    name: Application Risk
    path: checkpoint.quantum.firewall.app_risk_str
    source: log
    type: string
  - facetType: range
    groups:
      - Checkpoint Quantum Firewall
    name: Client Inbound Bytes
    path: checkpoint.quantum.firewall.client_inbound_bytes
    source: log
    type: integer
    unit:
      family: bytes
      name: byte
  - facetType: range
    groups:
      - Checkpoint Quantum Firewall
    name: Client Inbound Packets
    path: checkpoint.quantum.firewall.client_inbound_packets
    source: log
    type: integer
  - facetType: range
    groups:
      - Checkpoint Quantum Firewall
    name: Client Outbound Bytes
    path: checkpoint.quantum.firewall.client_outbound_bytes
    source: log
    type: integer
    unit:
      family: bytes
      name: byte
  - facetType: range
    groups:
      - Checkpoint Quantum Firewall
    name: Client Outbound Packets
    path: checkpoint.quantum.firewall.client_outbound_packets
    source: log
    type: integer
  - facetType: range
    groups:
      - Checkpoint Quantum Firewall
    name: Server Inbound Packets
    path: checkpoint.quantum.firewall.server_inbound_packets
    source: log
    type: integer
  - facetType: range
    groups:
      - Checkpoint Quantum Firewall
    name: Server Outbound Packets
    path: checkpoint.quantum.firewall.server_outbound_packets
    source: log
    type: integer
  - facetType: range
    groups:
      - Checkpoint Quantum Firewall
    name: Total Bytes
    path: checkpoint.quantum.firewall.bytes
    source: log
    type: integer
    unit:
      family: bytes
      name: byte
pipeline:
  type: pipeline
  name: Checkpoint Quantum Firewall
  enabled: true
  filter:
    query: "source:checkpoint-quantum-firewall"
  processors:
    - type: service-remapper
      name: Define `product` as the official service of the log
      enabled: true
      sources:
        - product
    - type: date-remapper
      name: Define `time` as the official date of the log
      enabled: true
      sources:
        - time
    - name: Lookup for `severity` to `severity` field
      enabled: true
      source: severity
      target: severity
      lookupTable: |-
        0, Info
        1, Low
        2, Medium
        3, High
        4, Critical
        Info, Info
        Low, Low
        Medium, Medium
        High, High
        Critical, Critical
      type: lookup-processor
    - name: Lookup for `severity` to `severity_to_status` field
      enabled: true
      source: severity
      target: severity_to_status
      lookupTable: |-
        Info, debug
        Low, info
        Medium, warning
        High, error
        Critical, critical
      type: lookup-processor
    - type: status-remapper
      name: Define `severity_to_status` as the official status of the log
      enabled: true
      sources:
        - severity_to_status
    - type: attribute-remapper
      name: Map `bytes` to `checkpoint.quantum.firewall.bytes`
      enabled: true
      sources:
        - bytes
      sourceType: attribute
      target: checkpoint.quantum.firewall.bytes
      targetType: attribute
      preserveSource: false
      overrideOnConflict: false
    - type: pipeline
      name: Remapper for Web Access Attributes
      enabled: true
      filter:
        query: '@product:("Application Control" OR "DLP" OR Firewall OR "Identity
          Awareness" OR "URL Filtering" OR "Threat Emulation" OR "Anti-Spam and
          Email Security" OR "IPS")'
      processors:
        - type: attribute-remapper
          name: Map `src` to `network.client.ip`
          enabled: true
          sources:
            - src
          sourceType: attribute
          target: network.client.ip
          targetType: attribute
          preserveSource: false
          overrideOnConflict: false
        - type: attribute-remapper
          name: Map `dst` to `network.destination.ip`
          enabled: true
          sources:
            - dst
          sourceType: attribute
          target: network.destination.ip
          targetType: attribute
          preserveSource: false
          overrideOnConflict: false
        - type: attribute-remapper
          name: Map `s_port` to `network.client.port`
          enabled: true
          sources:
            - s_port
          sourceType: attribute
          target: network.client.port
          targetType: attribute
          preserveSource: false
          overrideOnConflict: false
        - type: attribute-remapper
          name: Map `src_country` to `network.client.geoip.country.iso_code`
          enabled: true
          sources:
            - src_country
          sourceType: attribute
          target: network.client.geoip.country.iso_code
          targetType: attribute
          preserveSource: false
          overrideOnConflict: false
        - type: attribute-remapper
          name: Map `service` to `network.destination.port`
          enabled: true
          sources:
            - service
          sourceType: attribute
          target: network.destination.port
          targetType: attribute
          preserveSource: false
          overrideOnConflict: false
        - type: attribute-remapper
          name: Map `server_inbound_bytes` to `network.bytes_read`
          enabled: true
          sources:
            - server_inbound_bytes
          sourceType: attribute
          target: network.bytes_read
          targetType: attribute
          preserveSource: false
          overrideOnConflict: false
        - type: attribute-remapper
          name: Map `server_outbound_bytes` to `network.bytes_written`
          enabled: true
          sources:
            - server_outbound_bytes
          sourceType: attribute
          target: network.bytes_written
          targetType: attribute
          preserveSource: false
          overrideOnConflict: false
        - type: geo-ip-parser
          name: GeoIP Parser for `network.client.ip`
          enabled: true
          sources:
            - network.client.ip
          target: network.client.geoip
          ip_processing_behavior: do-nothing
        - type: geo-ip-parser
          name: GeoIP Parser for `network.destination.ip`
          enabled: true
          sources:
            - network.destination.ip
          target: network.destination.geoip
          ip_processing_behavior: do-nothing
        - type: attribute-remapper
          name: Map `appi_name` to `checkpoint.quantum.firewall.appi_name`
          enabled: true
          sources:
            - appi_name
          sourceType: attribute
          target: checkpoint.quantum.firewall.appi_name
          targetType: attribute
          preserveSource: false
          overrideOnConflict: false
        - type: attribute-remapper
          name: Map `client_inbound_bytes` to
            `checkpoint.quantum.firewall.client_inbound_bytes`
          enabled: true
          sources:
            - client_inbound_bytes
          sourceType: attribute
          target: checkpoint.quantum.firewall.client_inbound_bytes
          targetType: attribute
          preserveSource: false
          overrideOnConflict: false
        - type: attribute-remapper
          name: Map `client_inbound_packets` to
            `checkpoint.quantum.firewall.client_inbound_packets`
          enabled: true
          sources:
            - client_inbound_packets
          sourceType: attribute
          target: checkpoint.quantum.firewall.client_inbound_packets
          targetType: attribute
          preserveSource: false
          overrideOnConflict: false
        - type: attribute-remapper
          name: Map `client_outbound_bytes` to
            `checkpoint.quantum.firewall.client_outbound_bytes`
          enabled: true
          sources:
            - client_outbound_bytes
          sourceType: attribute
          target: checkpoint.quantum.firewall.client_outbound_bytes
          targetType: attribute
          preserveSource: false
          overrideOnConflict: false
        - type: attribute-remapper
          name: Map `client_outbound_packets` to
            `checkpoint.quantum.firewall.client_outbound_packets`
          enabled: true
          sources:
            - client_outbound_packets
          sourceType: attribute
          target: checkpoint.quantum.firewall.client_outbound_packets
          targetType: attribute
          preserveSource: false
          overrideOnConflict: false
        - type: attribute-remapper
          name: Map `server_inbound_packets` to
            `checkpoint.quantum.firewall.server_inbound_packets`
          enabled: true
          sources:
            - server_inbound_packets
          sourceType: attribute
          target: checkpoint.quantum.firewall.server_inbound_packets
          targetType: attribute
          preserveSource: false
          overrideOnConflict: false
        - type: attribute-remapper
          name: Map `server_outbound_packets` to
            `checkpoint.quantum.firewall.server_outbound_packets`
          enabled: true
          sources:
            - server_outbound_packets
          sourceType: attribute
          target: checkpoint.quantum.firewall.server_outbound_packets
          targetType: attribute
          preserveSource: false
          overrideOnConflict: false
    - type: pipeline
      name: Remapper for Username Attribute
      enabled: true
      filter:
        query: '@product:("Anti-Exploit" OR "Anti-Ransomware" OR "Anti-Bot" OR "Anti-Virus")'
      processors:
        - type: attribute-remapper
          name: Map `src_user_name` to `usr.name`
          enabled: true
          sources:
            - src_user_name
          sourceType: attribute
          target: usr.name
          targetType: attribute
          preserveSource: false
          overrideOnConflict: false
    - type: pipeline
      name: Remapper for Username Attribute
      enabled: true
      filter:
        query: "@product:DLP"
      processors:
        - type: attribute-remapper
          name: Map `user` to `usr.name`
          enabled: true
          sources:
            - user
          sourceType: attribute
          target: usr.name
          targetType: attribute
          preserveSource: false
          overrideOnConflict: false
    - type: pipeline
      name: String Building for Source and Destination IP Port
      enabled: true
      filter:
        query: '@product:("Firewall" OR "IPS" OR "Anti-Spam and Email Security" OR "URL
          Filtering") '
      processors:
        - type: string-builder-processor
          name: "Define `src_ip_port` equal to
            %{network.client.ip}: %{network.client.port}"
          enabled: true
          template: "%{network.client.ip}:%{network.client.port}"
          target: src_ip_port
          replaceMissing: false
        - type: string-builder-processor
          name: "Define `dst_ip_port` equal to
            %{network.destination.ip}: %{network.destination.port}"
          enabled: true
          template: "%{network.destination.ip}:%{network.destination.port}"
          target: dst_ip_port
          replaceMissing: false
    - type: pipeline
      name: Lookup for `app_risk` field
      enabled: true
      filter:
        query: '@product:("Application Control" OR "URL Filtering") '
      processors:
        - name: Lookup for `app_risk` to `checkpoint.quantum.firewall.app_risk_str` field
          enabled: true
          source: app_risk
          target: checkpoint.quantum.firewall.app_risk_str
          lookupTable: |-
            0, Unknown
            1, Very low
            2, Low
            3, Medium
            4, High
            5, Critical
            Unknown, Unknown
            Very low, Very low
            Low, Low
            Medium, Medium
            High, High
            Critical, Critical
          type: lookup-processor
    - type: pipeline
      name: Remapper for Status Attribute
      enabled: true
      filter:
        query: '@product:"HTTPS Inspection"'
      processors:
        - type: status-remapper
          name: Define `status` as the official status of the
            log
          enabled: true
          sources:
            - status
    - type: status-remapper
      name: Define `severity_to_status` as the official status of the log
      enabled: true
      sources:
        - severity_to_status