> Source: [sk98861](https://support.checkpoint.com/results/sk/sk98861)

# sk98861 - How to map Windows Events fields to Check Point log fields

| Property | Value |
|----------|-------|
| Solution ID | sk98861 |
| Date Created | 2014-03-17 |
| Last Modified | 2023-07-04 |
| Technical Level | General |
| Products | Security Management Server |
| Versions | R82.10, R82, R81.20, R82.20 |
| OS | Windows |

## Symptoms

- Entire Event information is shown in the '`Information`' column in SmartLog / SmartView Tracker (instead of spreading the information in correct columns according to the type of information).

## Cause

Required mapping of event fields to Check Point log fields is not configured on Windows Server that generates these events.

## Solution

Follow these steps on the Windows Server:

**Note:** This procedure assumes that [WinEventToCPLog Agent](http://supportcontent.checkpoint.com/file_download?id=7200) is already installed on Windows Server.

1. Stop the **`Check Point Windows Event Service`** service:

   1. Start - Run - type **`services.msc`** - click on OK   

   2. Find the '`Check Point Windows Event Service`' service - right-click - '`Stop`'

   <br />

   <br />

2. Open Windows Command Prompt:

   Start - Run - type **`cmd`** - click on OK   

3. Navigate to the WinEventToCPLog Agent folder:

   `C:\> `**cd /d "C:\Program Files (x86)\CheckPoint\WinEventToCPLog\R63\bin\"**   

4. Run the WinEventToCPLog Agent under debug:

   `C:\Program Files (x86)\...\bin> `**windowEventToCPLog -d**   

5. Re-create an event, for which you wish to map the event fields in Check Point log fields.   

6. Stop the WinEventToCPLog Agent - press CTRL+C.   

7. Open the WinEventToCPLog Agent log file:

   **`C:\Program Files (x86)\CheckPoint\WinEventToCPLog\R63\log\windowEvent0.log`**   

8. Find the relevant event.

   > *Example - mapping of the user name*:
   > * '`CPEventLog`' is parameter number **%6**
   > * Application is **Microsoft-Windows-Security-Auditing**
   > * Event ID is **4624**
   > Show / Hide debug example  
   >
   > ```
   > Reading internal event number: 26320
   > Tue Mar 04 11:40:31 2014
   > Forwarded
   > EventsEventID: 4624
   > EventTime: 4624
   > %1 = S-1-0-0
   > %2 = -
   > %3 = -
   > %4 = 0x0
   > %5 = S-1-1-11-1111111111-1111111111-1111111111-1111
   > %6 = CPEventLog
   > %7 = AAA
   > %8 = 0xaaa11
   > %9 = 3
   > %10 = NtLmSsp
   > %11 = NTLM
   > %12 = WORKSTATION-1
   > %13 = {00000000-0000-0000-0000-000000000000}
   > %14 = -
   > %15 = NTLM V2
   > %16 = 128
   > %17 = 0x0
   > %18 = -
   > %19 = -
   > %20 = -
   > Win Message(string): An account was successfully logged on.
   > Security ID(string): S-1-0-0Account Name(string): -
   > Account Domain(string): -
   > Logon ID(string): 0x0
   > Logon Type(string): 3
   > Security ID1(string): S-1-1-11-1111111111-1111111111-1111111111-1111
   > Account Name1(string): CPEventLog
   > Account Domain1(string): AAA
   > Logon ID1(string): 0xaaa11
   > Logon GUID(string): {00000000-0000-0000-0000-000000000000}
   > Process ID(string): 0x0
   > Process Name(string): -
   > Workstation Name(string): WORKSTATION-1
   > Source Network Address(string): -
   > Source Port(string): -
   > Logon Process(string): NtLmSsp
   > Authentication Package(string): NTLM
   > Transited Services(string): -
   > Package Name (NTLM only)(string): NTLM V2
   > Key Length(string): 128
   > Product(string): Windows OS
   > Event Source File(string): ForwardedEvents
   > Application(string): Microsoft-Windows-Security-Auditing
   > __orig(ipaddr): 192.168.2.14
   > Computer(string): COMP.AD
   > Event Type(string): Success Audit
   > ```

9. Backup the configuration mapping file:

   **`C:\Program Files (x86)\CheckPoint\WinEventToCPLog\R63\conf\winEventToCPLog_User_Fields.C`**   

10. Edit the configuration mapping file in an **advanced** text editor (Notepad++, UltraEdit, PSPad, etc.):

    **`C:\Program Files (x86)\CheckPoint\WinEventToCPLog\R63\conf\winEventToCPLog_User_Fields.C`**   

11. Add the relevant section for desired event (under the comments section).

    > *Example - mapping of the user name* (based on the debug):
    >
    > ```
    > (
    > 	: ("Microsoft-Windows-Security-Auditing:4624" 
    > 		: (%6
    > 			:field_name (User)
    > 			:field_type (string)
    > 		)
    > 	)
    > )
    > ```

12. Save the changes in the file and close it.   

13. Start the **`Check Point Windows Event Service`** service:

    1. Start - Run - type **`services.msc`** - click on OK   

    2. Find the '`Check Point Windows Event Service`' service - right-click - '`Start`'

    <br />

    <br />

14. Connect with to the Check Point Log Server with SmartLog / SmartEvent / SmartView Tracker and check the logs.

*** ** * ** ***

**Note:** Definitions of Check Point log fields are located in the *$FWDIR/conf/log_fields.C* file on Security Management Server / Domain Management Server.

---

# Agent Instructions

This content is from the Check Point Support Center (https://support.checkpoint.com), the official knowledge base for Check Point cybersecurity products.

## Navigating This Knowledge Base

- **Complete index**: [llms.txt](https://support.checkpoint.com/llms.txt)
- **All SK articles**: [SecureKnowledge Sitemap](https://support.checkpoint.com/sitemaps/secureknowledge-sitemap-index.xml)
- **SK article URL pattern**: `https://support.checkpoint.com/results/sk/{skId}`
- **Markdown responses**: AI bot User-Agents automatically receive `text/markdown` content