Check Point Firewall Logs Ingestion in Graylog
Build a complete centralized security log management system by ingesting Check Point Firewall logs into Graylog using Syslog and Docker. Learn how to collect, store, parse, and analyze enterprise-grade firewall telemetry inside Graylog for threat detection and monitoring.
Overview
In this project, you will set up a centralized log management environment and ingest Check Point Firewall logs into Graylog for security analytics. You’ll configure your Check Point appliance (or Management Server) to forward logs using Syslog to Graylog for ingestion and threat analysis. You’ll deploy Graylog, OpenSearch, and MongoDB using Docker Compose, then configure UDP/TCP Syslog inputs, pipelines, and extractors to properly parse Check Point log fields. Afterward, you’ll build streams and dashboards to categorize security data like Allow/Deny logs, VPN events, and Threat Prevention alerts. Finally, you’ll validate that Check Point logs are successfully visible and searchable inside Graylog.
What You'll Learn
-
Deploy Graylog Stack using Docker
Learn how to install and configure Graylog, OpenSearch, and MongoDB using Docker Compose on Ubuntu.
-
Configure Syslog Inputs in Graylog
Set up UDP/TCP Syslog inputs to receive firewall logs from Check Point devices.
About Trainer
Jaimin Pathak
Jaimin Pathak is a dynamic cybersecurity leader with deep expertise in Blue Team operations, digital forensics, and threat intelligence. As the Head of Security at HaxSecurity, Jaimin brings a hands-on approach to building and scaling modern Security Operations Centers (SOC). His career spans years of dedicated work in incident response, SIEM engineering, and proactive threat hunting. Jaimin is also a passionate mentor and educator, having guided thousands of cybersecurity learners through practical training programs, shaping the next generation of defenders in the field.
Related Projects
Practical AWS Cloud Security Posture Assessment Using Scout Suite
Identify real-world AWS attack surfaces through visual security posture analysis.
Wazuh + n8n + Anyrun: Automated Malware Analysis
Automate malware analysis by sending Wazuh-detected suspicious files into ANY.RUN, retrieving detailed reports and IOCs, and integrating results back into your SOC workflow.
Apache Web Server Log Monitoring using Wazuh
Real-time detection of HTTP errors, brute-force and suspicious requests from Apache logs