> Source: [sk112315](https://support.checkpoint.com/results/sk/sk112315) # sk112315 - R80 SmartEvent Server supplement for IBM QRadar | Property | Value | |----------|-------| | Solution ID | sk112315 | | Date Created | 2016-07-10 | | Last Modified | 2019-09-23 | | Technical Level | General | | Products | Security Management Server | | Versions | R82.10, R82, R81.20, R82.20 | | OS | Gaia | ## Solution ### Check Point SmartView and IBM QRadar Integration The integration of Check Point SmartView and IBM QRadar delivers network data and security events from Check Point appliances to QRadar, for real-time threat information in the QRadar console. This integration significantly speeds up the analytical process, with all analysis functions, from both QRadar and Check Point SmartEvent, on the one QRadar console. Security analysts also benefit from SmartEvent internal aggregation functions, which summarize Check Point logs to easy-to-read event data. A security analyst with full access to QRadar and SmartEvent can fine-tune Check Point protections directly from the SmartEvent-QRadar integration toolset. **Note: this supplement is included starting from R80.10** **Table of Contents** * System Requirements and Prerequisites * Usage * Check Point SmartView supplement installation instructions * Check Point's Server configuration * Documentation ### System Requirements and Prerequisites {#1} * IBM Security QRadar Log Manager, version 7.2.6 and higher * Check Point R80 SmartEvent Server, and the Check Point SmartView supplement * Check Point Security Management Server or Multi-Domain Management Server, version R77 or higher * [SmartView for QRadar](https://exchange.xforce.ibmcloud.com/hub/extension/Check%20Point:SmartView%20for%20QRadar) installed on the QRadar machine ### Usage {#2} From the QRadar tab, open the Check Point features: * **Check Point tab** - Graphical security overview of important attacks, allowed high risk applications, infected machines, and quick access to the Check Point SmartView portal * **Search in Check Point SmartView** - Click on a **Log Activity** or **Offense** to drill down for advanced investigation with Check Point SmartEvent features ### Check Point SmartView supplement installation instructions {#3} **Before you install this application:** * Make sure the IBM QRadar server is connected to a Check Point Log Server to read logs * Make sure the Check Point R80 SmartEvent server is connected to a Check Point Log Server to read logs * Make sure you have Admin permission for IBM QRadar **Procedure:** 1. Configure your R80 machine as SmartEvent Server: * In the First Time Configuration Wizard Products page, select Log Server/SmartEvent only. * In the Secure Internal Communication (SIC) page, define the Activation Key. Use this key to configure the dedicated server for SmartEvent object in SmartConsole. 2. Install the supplement on this R80 SmartEvent Server (It is already included in the **R80.10** version): 1. [Contact Check Point Support](http://www.checkpoint.com/support-services/contact-support/index.html) to get this package. A Support Engineer will make sure the package is compatible with your environment before providing the package. For faster resolution and verification, please collect [CPinfo files](http://supportcontent.checkpoint.com/solutions?id=sk92739) from the Security Management Server and SmartEvent Server involved in the case. 2. Procedure: **Note:** In Management HA environment, this procedure must be performed on *both* Management Servers. * On Gaia OS - using CPUSE: Refer to [sk92449: CPUSE - Gaia Software Updates (including Gaia Software Updates Agent)](https://supportcenter.checkpoint.com/supportcenter/portal?eventSubmit_doGoviewsolutiondetails=&solutionid=sk92449#How to work with CPUSE): * Section "[(4-A-c)](https://supportcenter.checkpoint.com/supportcenter/portal?eventSubmit_doGoviewsolutiondetails=&solutionid=sk92449#How to work with CPUSE - How to download and import a CPUSE package - Import instructions for Offline procedure - Gaia Portal)" / "[(4-A-d)](https://supportcenter.checkpoint.com/supportcenter/portal?eventSubmit_doGoviewsolutiondetails=&solutionid=sk92449#How to work with CPUSE - How to download and import a CPUSE package - Import instructions for Offline procedure - Gaia Clish)" - refer to import instructions for *Offline procedure* * Section "[(4-B-a)](https://supportcenter.checkpoint.com/supportcenter/portal?eventSubmit_doGoviewsolutiondetails=&solutionid=sk92449#How to work with CPUSE - How to install a CPUSE package - Installing a Hotfix package / Minor Version package)" - refer to installation instructions for *Hotfixes* **Note:** Reboot is required. * On Gaia OS - using Legacy CLI: 1. Transfer the hotfix package to the machine (into some directory, e.g., */some_path_to_fix/*). 2. Unpack and install the hotfix package: ***\[Expert@HostName:0\]# cd /some_path_to_fix/*** ***\[Expert@HostName:0\]# tar -zxvf ReportingServer_\.tgz*** ***\[Expert@HostName:0\]# ./ReportingServer_\*** **Note:** The script will stop all of Check Point services (*cpstop*) - read the output on the screen. 3. Reboot the machine. ### Check Point's Server configuration {#4} If Check Point App for QRadar does not work, then follow these steps: 1. Connect to command line on R80 SmartEvent Server. 2. Log in to Expert mode. 3. Backup the current */web/conf/extra/httpd2-smartview.conf* file: ***\[Expert@HostName:0\]# cp -v /web/conf/extra/httpd2-smartview.conf /web/conf/extra/httpd2-smartview.conf_ORIGINAL*** 4. Edit the current */web/conf/extra/httpd2-smartview.conf* file: ***\[Expert@HostName:0\]# vi /web/conf/extra/httpd2-smartview.conf*** 5. Change this line: from: ***"Header always set X-Frame-Options SAMEORIGIN"*** to: ***"Header always set Content-Security-Policy "default-src 'self' 'unsafe-inline' 'unsafe-eval';connect-src https: http: wss:; img-src 'self' data:; frame-ancestors 'self' https://\;"*** 6. Save the changes and exit from Vi editor. 7. Restart the *httpd2* daemon: ***\[Expert@HostName:0\]# tellpm process:httpd2*** ***\[Expert@HostName:0\]# tellpm process:httpd2 t*** ### Documentation {#Documentation} * [Check Point Application for QRadar Integration Guide](http://supportcontent.checkpoint.com/documentation_download?ID=51536) * [IBM Security QRadar Integration Guide](https://www.ibm.com/support/knowledgecenter/SS42VS_DSM/t_DSM_guide_Checkpoint_firewall1_OPSECLEA.html) --- # Agent Instructions This content is from the Check Point Support Center (https://support.checkpoint.com), the official knowledge base for Check Point cybersecurity products. ## Navigating This Knowledge Base - **Complete index**: [llms.txt](https://support.checkpoint.com/llms.txt) - **All SK articles**: [SecureKnowledge Sitemap](https://support.checkpoint.com/sitemaps/secureknowledge-sitemap-index.xml) - **SK article URL pattern**: `https://support.checkpoint.com/results/sk/{skId}` - **Markdown responses**: AI bot User-Agents automatically receive `text/markdown` content