Defining Correlation Units And Log Servers For Smartevent - Check Point Smart-1 205 Guía De Introducción

Configuring SmartEvent
Note - If running SmartEvent in a Security Management Server environment,
the internal network will be defined automatically from firewall topology
information. You can customize the internal network definition
In a Multi-Domain Security Management environment, define an internal network for
each Domain Management Server.
To define the Internal Network:
1. Start the SmartEvent Client.
2. From the Policy view, select General Settings > Initial Settings > Internal
Network.
3. Add objects (hosts, networks, groups, IP ranges) that define your environment's
internal network.
Defining Correlation Units and Log Servers for
SmartEvent
1. From the Policy view of the SmartEvent client, select General Settings > Initial
Settings > Correlation Units.
2. Select Add.
3. Click the button of the Correlation Unit field.
4. In the Select Objects window, select a Correlation Unit.
5. Click OK.
6. Click Add and select the Log Servers available as data sources to the Correlation
Unit.
Note - In a Multi-Domain Security Management environment, add the Log Servers
for each Domain Management Server.
7. Select Save.
8. From the Actions menu, select Install Event policy.
At this point, SmartEvent will begin to read logs and detect events.
To learn how to manage and fine-tune the system using the SmartEvent Client, see the
SmartEvent Administration Guide
Support Center http://supportcenter.checkpoint.com.
30 | Smart-1 205/210 Appliances Getting Started Guide
for your software version on the Check Point