Checkpoint Filebeat Module

dev/import-beats-resources/checkpoint/docs/README.md

@@ -0,0 +1,18 @@
+# Check Point Integration
+
+This integration is for Check Point products. It includes the
+following datasets for receiving logs:
+
+- `firewall` dataset: consists of log entries from the Log Exporter in the Syslog format.
+
+## Compatibility
+
+This module has been tested against Check Point Log Exporter on R80.X but should also work with R77.30.
+
+## Logs
+
+### Firewall
+
+Consists of log entries from the Log Exporter in the Syslog format.
+
+{{fields "firewall"}}

packages/checkpoint/dataset/firewall/agent/stream/log.yml.hbs

@@ -0,0 +1,18 @@
+paths:
+{{#each paths as |path i|}}
+  - {{path}}
+{{/each}}
+exclude_files: [".gz$"]
+tags:
+{{#each tags as |tag i|}}
+  - {{tag}}
+{{/each}}
+{{#contains tags "forwarded"}}
+publisher_pipeline.disable_host: true
+{{/contains}}
+processors:
+  - add_locale: ~
+  - add_fields:
+      target: ''
+      fields:
+        ecs.version: 1.5.0

packages/checkpoint/dataset/firewall/agent/stream/syslog.yml.hbs

@@ -0,0 +1,15 @@
+protocol.udp:
+  host: "{{syslog_host}}:{{syslog_port}}"
+tags:
+{{#each tags as |tag i|}}
+- {{tag}}
+{{/each}}
+{{#contains tags "forwarded"}}
+publisher_pipeline.disable_host: true
+{{/contains}}
+processors:
+  - add_locale: ~
+  - add_fields:
+      target: ''
+      fields:
+        ecs.version: 1.5.0