Skip to content

[checkpoint] Update setting of event.kind and event.outcome #20341

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
mjwolf merged 4 commits into from
Jul 28, 2026
Merged

[checkpoint] Update setting of event.kind and event.outcome #20341

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
4 commits
Select commit Hold shift + click to select a range
9e8aadd
[checkpoint] Update setting of event.kind and event.outcome
mjwolf Jul 23, 2026
e7a96f3
Update changelog
mjwolf Jul 23, 2026
b498ece
[checkpoint] Extend action fallback to Accept/Allow outcome and type …
mjwolf Jul 28, 2026
1b4b1ae
Merge branch 'main' into checkpoint_event_types
mjwolf Jul 28, 2026
File filter

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
5 changes: 5 additions & 0 deletions packages/checkpoint/changelog.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,4 +1,9 @@
# newer versions go on top
- version: "1.49.0"
changes:
- description: Fix missing ECS categorization for firewall drop and threat prevention events where checkpoint.rule_action is absent by falling back to checkpoint.action to set event.type, event.kind, event.outcome, and event.category.
type: enhancement
link: https://github.com/elastic/integrations/pull/20341
- version: "1.48.0"
changes:
- description: Improve handling of different user formats in logs.
Expand Down
63 changes: 54 additions & 9 deletions ...heckpoint/data_stream/firewall/_dev/test/pipeline/test-checkpoint-audit.log-expected.json
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -30,8 +30,13 @@
"id": "{0x6596336e,0x0,0x1f67238a,0x1b3f363d}",
"kind": "event",
"original": "<134>1 2024-01-04T04:26:20Z THENEWAUDITTEST CheckPoint 13885 - [action:\"Accept\"; flags:\"163872\"; ifdir:\"outbound\"; loguid:\"{0x6596336e,0x0,0x1f67238a,0x1b3f363d}\"; origin:\"192.168.1.153\"; originsicname:\"cn=cp_mgmt,o=auditTest..aw4c8s\"; sequencenum:\"1\"; time:\"1704342380\"; version:\"5\"; administrator:\"testUser\"; advanced_changes:\" \"; client_ip:\"192.168.1.153\"; domain_name:\"'auditTest_domain'\"; fieldschanges:\"Name: was not modified Source: was not modified Destination: Added 'bm_core_switches' VPN: was not modified Action: was not modified Track: was not modified Layer Name: 'bnkb01-Bermuda_Prod Security' Policy Names: ''\"; logic_changes:\"Dsts.dsts: Added '54bbefc0-48c4-4525-8120-2f94f9ac7b8e' \"; objectname:\"ospf rule\"; objecttype:\"Access Control Rule\"; operation:\"Modify Rule\"; product:\"SmartConsole\"; sendtotrackerasadvancedauditlog:\"0\"; session_description:\"CHG0887797\"; session_name:\"testUser@1/4/2024\"; session_uid:\"565dc65a-1c9f-43b2-8d71-4b4c7c311c71\"; subject:\"Object Manipulation\"; uid:\"9cd56553-3079-4873-8f19-46bee168b44a\"]",
"outcome": "success",
"sequence": 1,
"timezone": "UTC"
"timezone": "UTC",
"type": [
"allowed",
"connection"
]
},
"message": "Object Manipulation",
"network": {
Expand Down Expand Up @@ -103,8 +108,13 @@
"id": "{0x65963c39,0x0,0x1f67238a,0x33ac672c}",
"kind": "event",
"original": "<134>1 2024-01-04T05:03:52Z THENEWAUDITTEST CheckPoint 26412 - [action:\"Accept\"; flags:\"163872\"; ifdir:\"outbound\"; loguid:\"{0x65963c39,0x0,0x1f67238a,0x33ac672c}\"; origin:\"192.168.1.153\"; originsicname:\"cn=cp_mgmt,o=CASCC1DMBNTB1002..7f4rte\"; sequencenum:\"1\"; time:\"1704344632\"; version:\"5\"; administrator:\"testUser\"; advanced_changes:\" \"; client_ip:\"192.168.1.153\"; domain_name:\"'testUser_domain'\"; fieldschanges:\"Name: name is empty Source: Added 'Alice', 'Bob', 'Cat'; Destination: Added 'Alice.2', 'Alice.3', 'Alice.4', 'Alice.5'; VPN: Any Action: Changed from 'Drop' to 'Accept' Track: Changed from 'None' to 'Log' Comments: 'CHG0887890 TS 040124' Services & Applications: Added 'tcp_5601', 'tcp_3001', 'TCP_1002', 'TCP_5600'; UseLogPerConnection: Changed from 'Disable' to 'Enable' Layer Name: 'CAMCCCVBNTB009_prod Security' Policy Names: ''\"; logic_changes:\"ActionSettings.action: Changed from 'rtheyht-8eec-4103-ad21-cd461ac2c473' to 'rtheyht-8eec-4103-ad21-cd461ac2c472' TrackSettings.useLogPerConnection: Changed from 'Disable' to 'Enable' \"; objecttype:\"Access Control Rule\"; operation:\"Create Rule\"; product:\"SmartConsole\"; sendtotrackerasadvancedauditlog:\"0\"; session_name:\"testUser@1/4/2024\"; session_uid:\"59383b5a-947b-415b-a5fa-6049514dc150\"; subject:\"Object Manipulation\"; uid:\"9a53d1d3-273a-4106-bc7d-9edb225d927e\"]",
"outcome": "success",
"sequence": 1,
"timezone": "UTC"
"timezone": "UTC",
"type": [
"allowed",
"connection"
]
},
"message": "Object Manipulation",
"network": {
Expand Down Expand Up @@ -173,8 +183,13 @@
"id": "{0x65963946,0x5,0x1f67238a,0x33ac672c}",
"kind": "event",
"original": "<134>1 2024-01-04T04:51:17Z THENEWAUDITTEST CheckPoint 26412 - [action:\"Accept\"; flags:\"163872\"; ifdir:\"outbound\"; loguid:\"{0x65963946,0x5,0x1f67238a,0x33ac672c}\"; origin:\"192.168.1.153\"; originsicname:\"cn=cp_mgmt,o=CASCC1DMBNTB1002..7f4rte\"; sequencenum:\"6\"; time:\"1704343877\"; version:\"5\"; administrator:\"testUser\"; advanced_changes:\" \"; client_ip:\"192.168.1.153\"; domain_name:\"'testUser_domain'\"; fieldschanges:\"Name: name is empty Source: Added 'Alice.2', 'Alice.3', 'Alice.4', 'Alice.5'; Destination: Added 'BNTB_10.255.109.83', 'BNTB_10.255.109.76', 'HP_155.61.9.27'; VPN: Any Action: Changed from 'Drop' to 'Accept' Track: Changed from 'None' to 'Log' Comments: 'CHG0887889 TS 040124' Services & Applications: Added 'tcp_3001', 'TCP_1002', 'TCP_5600', 'tcp_5601'; UseLogPerConnection: Changed from 'Disable' to 'Enable' Layer Name: 'CAMCCCVBNTB005_prod_Clone Security' Policy Names: ''\"; logic_changes:\"ActionSettings.action: Changed from 'rtheyht-8eec-4103-ad21-cd461ac2c473' to 'rtheyht-8eec-4103-ad21-cd461ac2c472' Applications.applications: Added 'c8dea3f3-9dc5-4015-9a53-28d7ff74269c', '964309ed-bf93-43ab-829c-e0c932e1036d', '8f4a01b6-d247-48e8-828d-da78c3bd705c', '92cd90d2-e1e8-45c8-a27a-7df33bc35cd4'; Removed '97aeb369-9aea-11d5-bd16-0090272ccb30' Comments: 'CHG0887889 TS 040124' Dsts.dsts: Added '0ab016cd-442f-4d70-9dab-49302b909f1a', 'fd0040e8-b195-4d84-a7a5-145c2ed47b48', '9ab91246-8916-470f-0a31-73bc06b9458a'; Removed '97aeb369-9aea-11d5-bd16-0090272ccb30' Srcs.srcs: Added '384f949d-3eb2-49f8-872d-759c6a47dea5', '43f8deeb-4d91-498c-be12-bf856a8e455a', 'b2ff1fb1-280f-499c-bae0-32b31016721d', '28dc7aad-dc42-4696-a263-1994aff44699'; Removed '97aeb369-9aea-11d5-bd16-0090272ccb30' TrackSettings.track: Changed from '29e53e3d-23bf-48fe-b6b1-d59bd88036f9' to '598ead32-aa42-4615-90ed-f51a5928d41d' TrackSettings.useLogPerConnection: Changed from 'Disable' to 'Enable' \"; objecttype:\"Access Control Rule\"; operation:\"Create Rule\"; product:\"SmartConsole\"; sendtotrackerasadvancedauditlog:\"0\"; session_name:\"testUser@1/4/2024\"; session_uid:\"1c6dee37-a6aa-4998-ba2b-7a568b7bba4c\"; subject:\"Object Manipulation\"; uid:\"169949b7-51ee-4195-b7c8-a586fefc3b7c\"]",
"outcome": "success",
"sequence": 6,
"timezone": "UTC"
"timezone": "UTC",
"type": [
"allowed",
"connection"
]
},
"message": "Object Manipulation",
"network": {
Expand Down Expand Up @@ -244,8 +259,13 @@
"id": "{0x65941b1e,0x2,0x1f67238a,0x1b3f363d}",
"kind": "event",
"original": "<134>1 2024-01-02T14:18:04Z THENEWAUDITTEST CheckPoint 13885 - [action:\"Accept\"; flags:\"163872\"; ifdir:\"outbound\"; loguid:\"{0x65941b1e,0x2,0x1f67238a,0x1b3f363d}\"; origin:\"172.16.1.190\"; originsicname:\"cn=cp_mgmt,o=auditTest..aw4c8s\"; sequencenum:\"3\"; time:\"1704205084\"; version:\"5\"; administrator:\"System\"; advanced_changes:\" \"; client_ip:\"172.16.1.190\"; domain_name:\"'auditTest_domain'\"; fieldschanges:\"Name: '2c90c96e-2c99-47a4-a3c3-993a14c018f4_765e58b0-ccbb-4947-bb97-44fe0f6d0b29' Profile: 'g_Recommended_Protection' Protection: 'Exponent CMS SQL Injection (CVE-2017-7991)' ProtectionId: '7732550153' StagingMode: 'Enable' \"; logic_changes:\"Name: '2c90c96e-2c99-47a4-a3c3-993a14c018f4_765e58b0-ccbb-4947-bb97-44fe0f6d0b29' Profile: '2c90c96e-2c99-47a4-a3c3-993a14c018f4' Protection: '765e58b0-ccbb-4947-bb97-44fe0f6d0b29' ProtectionId: '6854867' StagingMode: 'Enable' \"; objectname:\"2c90c96e-2c99-47a4-a3c3-993a14c018f4_765e58b0-ccbb-4947-bb97-44fe0f6d0b29\"; objecttype:\"ThreatIpsProtectionOverride\"; operation:\"Create Object\"; sendtotrackerasadvancedauditlog:\"0\"; session_description:\"Global Domain Assignment\"; session_name:\"Global Domain Assignment\"; session_uid:\"d5c7cc4f-01ea-4ac7-8de1-72ae05d28bc6\"; subject:\"Object Manipulation\"; uid:\"efa04289-5905-4583-82a5-a576c33a72c4\"]",
"outcome": "success",
"sequence": 3,
"timezone": "UTC"
"timezone": "UTC",
"type": [
"allowed",
"connection"
]
},
"message": "Object Manipulation",
"network": {
Expand Down Expand Up @@ -441,8 +461,13 @@
"id": "{0x65941b1e,0x3,0x1f67238a,0x1b3f363d}",
"kind": "event",
"original": "<134>1 2024-01-02T14:18:04Z THENEWAUDITTEST CheckPoint 13885 - [action:\"Accept\"; flags:\"163872\"; ifdir:\"outbound\"; loguid:\"{0x65941b1e,0x3,0x1f67238a,0x1b3f363d}\"; origin:\"172.16.1.190\"; originsicname:\"cn=cp_mgmt,o=auditTest..aw4c8s\"; sequencenum:\"4\"; time:\"1704205084\"; version:\"5\"; administrator:\"System\"; client_ip:\"172.16.1.190\"; fieldschanges:\"2 Objects were changed\"; operation:\"Publish\"; product:\"SmartConsole\"; sendtotrackerasadvancedauditlog:\"0\"; session_description:\"Global Domain Assignment\"; session_name:\"Global Domain Assignment\"; session_uid:\"d5c7cc4f-01ea-4ac7-8de1-72ae05d28bc6\"; subject:\"Revision Control\"]\t",
"outcome": "success",
"sequence": 4,
"timezone": "UTC"
"timezone": "UTC",
"type": [
"allowed",
"connection"
]
},
"message": "Revision Control",
"network": {
Expand Down Expand Up @@ -509,8 +534,13 @@
"id": "{0x65941b1e,0x1,0x1f67238a,0x1b3f363d}",
"kind": "event",
"original": "<134>1 2024-01-02T14:18:04Z THENEWAUDITTEST CheckPoint 13885 - [action:\"Accept\"; flags:\"163872\"; ifdir:\"outbound\"; loguid:\"{0x65941b1e,0x1,0x1f67238a,0x1b3f363d}\"; origin:\"172.16.1.190\"; originsicname:\"cn=cp_mgmt,o=auditTest..aw4c8s\"; sequencenum:\"2\"; time:\"1704205084\"; version:\"5\"; administrator:\"System\"; advanced_changes:\" \"; client_ip:\"172.16.1.190\"; domain_name:\"'auditTest_domain'\"; fieldschanges:\"Name: '2c90c96e-2c99-47a4-a3c3-993a14c018f4_8e063574-e017-3745-96ed-80a573d73488' Profile: 'g_Recommended_Protection' Protection: 'Microsoft Exchange Server Remote Code Execution (CVE-2022-41082)' ProtectionId: '8589640366' StagingMode: 'Enable' \"; logic_changes:\"Name: '2c90c96e-2c99-47a4-a3c3-993a14c018f4_8e063574-e017-3745-96ed-80a573d73488' Profile: '2c90c96e-2c99-47a4-a3c3-993a14c018f4' Protection: '8e063574-e017-3745-96ed-80a573d73488' ProtectionId: '8589640366' StagingMode: 'Enable' \"; objectname:\"2c90c96e-2c99-47a4-a3c3-993a14c018f4_8e063574-e017-3745-96ed-80a573d73488\"; objecttype:\"ThreatIpsProtectionOverride\"; operation:\"Create Object\"; sendtotrackerasadvancedauditlog:\"0\"; session_description:\"Global Domain Assignment\"; session_name:\"Global Domain Assignment\"; session_uid:\"d5c7cc4f-01ea-4ac7-8de1-72ae05d28bc6\"; subject:\"Object Manipulation\"; uid:\"30d36d30-6a20-4336-98ee-37c25d52d4db\"]",
"outcome": "success",
"sequence": 2,
"timezone": "UTC"
"timezone": "UTC",
"type": [
"allowed",
"connection"
]
},
"message": "Object Manipulation",
"network": {
Expand Down Expand Up @@ -580,8 +610,13 @@
"id": "{0x65941b1d,0x0,0x1f67238a,0x1cc73972}",
"kind": "event",
"original": "<134>1 2024-01-02T14:18:04Z THENEWAUDITTEST CheckPoint 14706 - [action:\"Accept\"; flags:\"163872\"; ifdir:\"outbound\"; loguid:\"{0x65941b1d,0x0,0x1f67238a,0x1cc73972}\"; origin:\"172.16.1.190\"; originsicname:\"cn=cp_mgmt,o=auditTest..aw4c8s\"; sequencenum:\"1\"; time:\"1704205084\"; version:\"5\"; administrator:\"System\"; client_ip:\"172.16.1.190\"; domain_name:\"auditTest_domain\"; fieldschanges:\"IPS version was updated from 635240010 to 635240034\"; operation:\"IPS Update\"; product:\"cpmidu_update_tool\"; sendtotrackerasadvancedauditlog:\"0\"; session_description:\"IPS\"; session_name:\"IPS\"; session_uid:\"d5c7cc4f-01ea-4ac7-8de1-72ae05d28bc6\"; subject:\"IPS Update\"]",
"outcome": "success",
"sequence": 1,
"timezone": "UTC"
"timezone": "UTC",
"type": [
"allowed",
"connection"
]
},
"message": "IPS Update",
"network": {
Expand Down Expand Up @@ -713,8 +748,13 @@
"id": "{0x6592c9b6,0x13,0x1f67238a,0x1cc73972}",
"kind": "event",
"original": "<134>1 2024-01-01T14:18:28Z THENEWAUDITTEST CheckPoint 14706 - [action:\"Accept\"; flags:\"163872\"; ifdir:\"outbound\"; loguid:\"{0x6592c9b6,0x13,0x1f67238a,0x1cc73972}\"; origin:\"172.16.1.190\"; originsicname:\"cn=cp_mgmt,o=auditTest..aw4c8s\"; sequencenum:\"20\"; time:\"1704118708\"; version:\"5\"; administrator:\"System\"; advanced_changes:\" \"; client_ip:\"172.16.1.190\"; domain_name:\"'auditTest_domain'\"; fieldschanges:\" \"; logic_changes:\" \"; objectname:\"5f549fc1-4870-4c1c-8ff4-23531cf94370_213ab0bb-a88c-bb44-a75a-6e6d3ae080fe\"; objecttype:\"ThreatIpsProtectionOverride\"; operation:\"Delete Object\"; sendtotrackerasadvancedauditlog:\"0\"; session_description:\"Global Domain Assignment\"; session_name:\"Global Domain Assignment\"; session_uid:\"47d8237d-0dc9-41ac-a181-6a593e0f6657\"; subject:\"Object Manipulation\"; uid:\"f5cb2423-5ea6-4116-8858-faed44e3047e\"]",
"outcome": "success",
"sequence": 20,
"timezone": "UTC"
"timezone": "UTC",
"type": [
"allowed",
"connection"
]
},
"message": "Object Manipulation",
"network": {
Expand Down Expand Up @@ -784,8 +824,13 @@
"id": "{0x65920efe,0x0,0x1f67238a,0x1cc7b972}",
"kind": "event",
"original": "<134>1 2024-01-01T01:01:48Z THENEWAUDITTEST CheckPoint 14706 - [action:\"Accept\"; flags:\"163872\"; ifdir:\"outbound\"; loguid:\"{0x65920efe,0x0,0x1f67238a,0x1cc7b972}\"; origin:\"172.16.1.190\"; originsicname:\"cn=cp_mgmt,o=auditTest..aw4c8s\"; sequencenum:\"1\"; time:\"1704070908\"; version:\"5\"; administrator:\"Scheduled system update\"; client_ip:\"172.16.1.190\"; domain_name:\"auditTest_domain\"; fieldschanges:\"Application Control & URL Filtering Update version was updated from 141202312141035 to 141202312261218\"; operation:\"Application Control & URL Filtering Update\"; product:\"Scheduled system update\"; sendtotrackerasadvancedauditlog:\"0\"; session_description:\"APPI Update\"; session_name:\"APPI Update\"; session_uid:\"3f68858c-8028-4d0c-9813-c12f9061cacf\"; subject:\"Application Control & URL Filtering Update\"]",
"outcome": "success",
"sequence": 1,
"timezone": "UTC"
"timezone": "UTC",
"type": [
"allowed",
"connection"
]
},
"message": "Application Control & URL Filtering Update",
"network": {
Expand Down
7 changes: 6 additions & 1 deletion ...point/data_stream/firewall/_dev/test/pipeline/test-checkpoint-with-time.log-expected.json
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -108,8 +108,13 @@
"id": "{0x60928f1d,0x8,0x40de101f,0xfcdbb197}",
"kind": "event",
"original": "<134>1 2021-05-05T12:27:09Z cp-m CheckPoint 1231 - [action:\"Drop\"; flags:\"278528\"; ifdir:\"inbound\"; ifname:\"bond1.3999\"; loguid:\"{0x60928f1d,0x8,0x40de101f,0xfcdbb197}\"; origin:\"127.0.0.1\"; originsicname:\"CN=CP,O=cp.com.9jjkfo\"; sequencenum:\"62\"; time:\"1620217629\"; version:\"5\"; __policy_id_tag:\"product=VPN-1 & FireWall-1[db_tag={F6212FB3-54CE-6344-9164-B224119E2B92};mgmt=cp-m;date=1620031791;policy_name=CP-Cluster]\"; action_reason:\"Dropped by multiportal infrastructure\"; dst:\"81.2.69.144\"; product:\"VPN & FireWall\"; proto:\"6\"; s_port:\"52780\"; service:\"80\"; src:\"81.2.69.144\"]",
"outcome": "success",
"sequence": 62,
"timezone": "UTC"
"timezone": "UTC",
"type": [
"connection",
"denied"
]
},
"network": {
"direction": "inbound",
Expand Down
Loading
Loading