# Fleet Check Point Integration

**URL:** <https://discuss.elastic.co/t/fleet-check-point-integration/280324>\
**Category:** Kibana\
**Tags:** fleet\
**Created:** [August 3, 2021, 2:00pm UTC](https://discuss.elastic.co/t/fleet-check-point-integration/280324 "2021-08-03T14:00:44Z")\
**Posts on this page:** 7\
**Page:** 1

<div class="post-metadata">

**Author:** ![francescouk](https://avatars.discourse-cdn.com/v4/letter/f/7feea3/32.png) [@francescouk](https://discuss.elastic.co/u/francescouk)\
**Post date:** [August 3, 2021, 2:00pm UTC](https://discuss.elastic.co/t/fleet-check-point-integration/280324/1 "2021-08-03T14:00:44Z")

</div>

I´ve been trying to play around with the check point integration but it looks like is going nowhere!!! Can someone help me out??? The Elastic documentation related to this integration does not help....

Really appreciate for the atention.

---

<div class="post-metadata">

**Author:** ![Marius\_Dragomir](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/marius_dragomir/32/42087_2.png) [@Marius\_Dragomir](https://discuss.elastic.co/u/Marius_Dragomir)\
**Post date:** [August 3, 2021, 7:15pm UTC](https://discuss.elastic.co/t/fleet-check-point-integration/280324/2 "2021-08-03T19:15:54Z")

</div>

Are you using this part of the documentation? [Check Point module | Filebeat Reference [7.14] | Elastic](https://www.elastic.co/guide/en/beats/filebeat/current/filebeat-module-checkpoint.html)

Where are you stuck more exactly?

---

<div class="post-metadata">

**Author:** ![francescouk](https://avatars.discourse-cdn.com/v4/letter/f/7feea3/32.png) [@francescouk](https://discuss.elastic.co/u/francescouk)\
**Post date:** [August 3, 2021, 10:05pm UTC](https://discuss.elastic.co/t/fleet-check-point-integration/280324/3 "2021-08-03T22:05:51Z")

</div>

I'm trying to add the check point logs through the fleet integrations panel.

Follow the screens, it looks like its not enough just adding the integration. I'm missing something?

 ![fleet](https://us1.discourse-cdn.com/elastic/original/3X/2/5/259897f57ce0ca1998536b98a3a1fdf5c10fdc3f.png)

 ![fleet2](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1a30ee4f7ee170c12e7ae39ae6fe5a2470cd132f.png)

I thought for a second that I only needed to make the integration and set the ports used to ingest the logs from the check point firewall.... but does not work...

Thanks for the attention.

---

<div class="post-metadata">

**Author:** ![Marius\_Dragomir](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/marius_dragomir/32/42087_2.png) [@Marius\_Dragomir](https://discuss.elastic.co/u/Marius_Dragomir)\
**Post date:** [August 4, 2021, 10:01am UTC](https://discuss.elastic.co/t/fleet-check-point-integration/280324/4 "2021-08-04T10:01:40Z")

</div>

You have the integration, then you have to deploy a Fleet agent and assign it that integration (since you're using localhost there you have to deploy the agent on the same machine that you have the Checkpoint Firewall)

---

<div class="post-metadata">

**Author:** ![francescouk](https://avatars.discourse-cdn.com/v4/letter/f/7feea3/32.png) [@francescouk](https://discuss.elastic.co/u/francescouk)\
**Post date:** [August 4, 2021, 11:48am UTC](https://discuss.elastic.co/t/fleet-check-point-integration/280324/5 "2021-08-04T11:48:22Z")

</div>

> [@Marius\_Dragomir](#):
>
> e using localhost there you have to deploy the agent on the same machine that y

Should I use another server as log collector using this agent and then from the firewall send the logs to the server in question? I dont believe I could install this agent on the same check point firewall appliance.

Thanks in advance

---

<div class="post-metadata">

**Author:** ![legoguy1000](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/legoguy1000/32/54301_2.png) [@legoguy1000](https://discuss.elastic.co/u/legoguy1000)\
**Post date:** [August 4, 2021, 11:58am UTC](https://discuss.elastic.co/t/fleet-check-point-integration/280324/6 "2021-08-04T11:58:01Z")

</div>

Correct. You need to deploy an agent somewhere and then assign the policy with the integration to it. It's no different than if you used the filebeat module.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [September 1, 2021, 11:58am UTC](https://discuss.elastic.co/t/fleet-check-point-integration/280324/7 "2021-09-01T11:58:02Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.
