This guide explains how to use the Checkpoint OPSEC LEA tool with UserInsight.
That was a tough one to configure!
For the record, following the procedure broke the connection from the log server to the SmartEvent server (both running on the same machine).
I had to find this to reestablish connection:
Configuring a Log Server to work with both SmartEvent component and an OPSEC LEA server
It seems you need to login with a Checkpoint account to view the solution. We unfortunately are not Checkpoint customers anymore. Can you share the solution as well please and we'll update our documentation.
There is a lot of "it depends" in the document (is SmartEvent running on the same server or not, which version are you running, do you want encryption or not, etc), the document seems to be a live document (created in 2012 and last updated in July 2015), and the support site is full of copyright notices, so if I were you, I would update your documentation with: "Please note, if you are already using the Log Export API, for instance using SmartEvent or Splunk, be aware that you may have to do additional configuration according to" and then a link to the document above. My guess is that anyone running SmartEvent and wanting to integrate with UserInsight are existing customers and will have access to the documentation.
Retrieving data ...