Page 28
Chapter 4
Configuring SmartEvent
This section explains how to get up and running with SmartEvent.
In This Chapter
Preparing SmartEvent on Security Management Server
Preparing SmartEvent on the Multi-Domain Server
Enabling Connectivity with Multi-Domain Security Management
Configuring the SmartEvent Clients
Preparing SmartEvent on Security
Management Server
To configure SmartEvent, first establish connectivity between the components.
1. Launch SmartDashboard.
2. In SmartDashboard, create a new host for each computer that contains a component of SmartEvent:
a) Select
Manage > Network Object > New > Check Point > Host
b) In the
General Properties
window, click
Communication
and enter the activation key.
Note
- If the Security Management Server and SmartEvent are installed on different sides of the firewall,
add a rule that allows SIC traffic between them.
c) The version is not entered automatically if the SmartEvent version is newer than the version of the
Security Management Server. If so, select the most recent version available from the
Version
drop-
down list.
d) In the
Management Software Blades
list, select the blades that are installed on the new host.
3. Install the database on all log servers from which SmartEvent reads data: select
Policy > Install
Database
and select the log servers as the targets.
4. To allow the SmartEvent Intro server to block attacks from specific IP addresses, configure the Security
Management Server to accept SAM commands from the SmartEvent Intro server:
a) On the Security Management Server, edit the
$CPDIR/conf/sic_policy.conf
file:
Search for the section
[Inbound rules]
, and add the following line under
# sam proxy
:
DN_Mgmt ; Reporting_Tool; ANY; sam ; sslca
b) From the command line in the Security Management Server computer, run the following commands:
cpstop
cpstart
Preparing SmartEvent on the Multi-Domain
Server
The first stage configuring SmartEvent is to establish connectivity between the components.
1. Launch Global SmartDashboard.
