Forcepoint Firewall

Forcepoint Firewall is part of the Stonesoft Security Management Center (SMC). The Stonesoft SMC provides security coverage for firewall, IDS, VPN, and other protective measures in your security environment.

You can export your firewall events from Stonesoft Forcepoint to InsightIDR in a CEF format from the SMC Log Server. You can read about this process here: https://support.forcepoint.com/KBArticle?id=000015002

To start forwarding Stonesoft logs from the Stonesoft SMC Log Server:

  1. Create Log Forwarding Rules
  2. Enable Logging from the SMC
  3. Create Traffic Access Rules
  4. Add a Firewall Event Source to InsightIDR

Create Log Forwarding Rules

Complete these steps in the Forcepoint SMC.

To create log forwarding rules:

  1. Sign into your SMC console.
  2. From your Home dashboard, select the Others tab from the left menu.
  3. Select the Monitoring tab and click the Add button to add a new Server element.
  4. Click the Add button to add a new local filter.
  5. In the “Name” field, provide a name for the InsightIDR collector.
  6. In the “IP Source” field, enter the IP address of your InsightIDR collector. Click the Save button.
  1. Click the Log Forwarding tab.
  2. Click the Add button.
  3. From the “Target Host” dropdown, select the previously added InsightIDR Collector.
  1. In the “Service” dropdown, select your protocol.
  2. In the “Port” field, enter the unique port you want to use.
  3. In the “Format” dropdown, select the CEF format.
  4. In the “Data Type” dropdown, select the All Data Types option.
  5. In the “Filter” dropdown, select the Empty Filter option.
  6. Leave “TLS Profile” and “TLS Server Identity” blank.
  7. Click the OK button to save the configuration.

Read more about this process here: https://help.stonesoft.com/onlinehelp/StoneGate/SMC/6.2.0/GUID-4C98583A-7BA4-4028-AD85-6D20B58EC420.html#GUID-4C98583A-7BA4-4028-AD85-6D20B58EC420

Enable Logging from the SMC

After you’ve properly created a log forwarding rule for the InsightIDR Collector, you must enable logging from the SMC to external servers.

To enable logging from the SMC:

  1. Navigate to **Configuration NGFW > Policies > Firewall Policy. **
  1. Right click the Logging policy you want to change and select the Edit option.
  2. Select the appropriate version for the IP Access tab. Scroll to the right in the cell table and double click on the “Logging” cell. Then choose the Edit option.
  1. Check the Override Collected Values Set With Continue Rules box.
  2. From the “Log Level” dropdown, select the Stored or Essential option.
  3. Click the OK button, and then click the Save button.

Create Access Rules

Lastly, you must allow access from the Firewall to external servers.

To do create access rules for the firewall

  1. In your SMC, navigate to Configuration NGFW > Policies > Firewall Policy.
  2. Select the appropriate version for the IP Access tab. Right click on the policy and select the Add Rule option.
  1. In the “Source” field, select the Management Server option.
  2. In the “Destination” field, select the host element that represents the InsightIDR Collector.
  3. In the “Service” field, select the Syslog (UDP) option.
  4. In the “Action” cell, select the Allow option.
  5. In the “Logging” cell, select None to avoid a logging loop.
  6. Click the Save button.

Configure InsightIDR to collect data from the event source

After you complete the prerequisite steps and configure the event source to send data, you must add the event source in InsightIDR.

To configure the new event source in InsightIDR:

  1. From the left menu, go to Data Collection and click Setup Event Source > Add Event Source.
  2. Do one of the following:
    • Search for Forcepoint Firewall in the event sources search bar.
    • In the Product Type filter, select Firewall.
  3. Select the Forcepoint Firewall event source tile.
  4. Choose your collector and select Forcepoint Firewall as your event source. You can also name your event source if you want.
  5. Choose the timezone that matches the location of your event source logs.
  6. Optionally choose to send unparsed logs.
  7. Configure your default domain and any advanced settings.
  8. Select Syslog as your data collection method and select UDP as your protocol.
  9. Enter the unique port you specified during configuration in the SMC.
  10. Click the Save button.