Trying to upload Checkpoint firewall logs to Defender Cloud Discovery Snapshot report

Paul Chen 0 Reputation points
2026-03-23T17:30:11.0433333+00:00

I chose Checkpoint CSV and have upload logs file with these field.

User's image

and try one with these headings.

Time Blade Action Type Severity Confidence Level Suppressed Logs Source Source User Name Machine Name Destination Protection Type Sent Bytes Received Bytes Malware Family Malware Action Protection Name Resource

I also try the sample data that Microsoft listed for Checkpoint CSV

User's image

All of them don't work. Any ideas?

Microsoft Security | Microsoft Defender | Microsoft Defender for Cloud

1 answer

Sort by: Oldest
Most helpful Newest Oldest

  1. AI answer

    2026-03-23T17:30:32.5866667+00:00

    Defender for Cloud Apps cloud discovery is very strict about log format. If Check Point CSV uploads fail even when using the documented sample, the issue is almost always that the actual log format does not match the parser’s expectations, or that the wrong source type is selected.

    Use these steps to get the logs working:

    1. Verify the data source and format
      • When creating the snapshot report, under Source, make sure the selected type exactly matches the log format being exported from Check Point.
      • If the Check Point CSV you have does not match the expected sample, Defender for Cloud Apps will not parse it. In that case, do not use the Check Point source; instead configure a custom format.
      • In the snapshot wizard, use View log format / Download sample log for the Check Point source and compare line‑by‑line (field order, delimiters, date/time format, header row presence) with the Check Point file.
    2. If the Check Point format does not match, use a custom log parser
      • In the snapshot wizard, under Source, scroll down and select Custom log format….
      • Open the Check Point CSV in a text editor and identify the columns that correspond to the required Defender for Cloud Apps fields (for example: time, source IP, destination IP, destination port, bytes sent, bytes received, action, user).
      • In the Custom log format dialog, map the columns to the required fields in the exact order shown in the dialog. Required fields (marked with *) must exist in the file and appear in the same sequence.
      • Ensure that:
        • Column names in the file exactly match what is configured in the custom format (case‑sensitive).
        • The date/time format selected in the dialog matches the format in the file.
      • Save the custom format, then upload the same Check Point CSV under Upload traffic logs.
    3. If using automatic upload/log collector
      • When defining data sources under Settings > Cloud Apps > Cloud Discovery > Automatic log upload, use View sample of expected log file for the chosen source and compare with the Check Point output.
      • If the Check Point appliance is using a newer or unsupported format and uploads fail, define the data source as Other > Customer log format and use the custom parser, or as Other (manual only) for snapshot uploads.
    4. If the format still cannot be matched
      • If the Check Point log format is newly released or significantly different from the samples and cannot be aligned even with a custom parser, configure the data source as Other when uploading and provide the appliance/log type so it can be reviewed, and consider opening a support case as recommended in the documentation.

    Following these steps ensures that Defender for Cloud Apps receives logs in a format it can parse, either by matching the built‑in Check Point format exactly or by using a custom log parser tailored to the Check Point CSV layout.

    References:

    AI-generated content may be incorrect. Read our transparency notes for more information.

    Was this answer helpful?

Your answer

Answers can be marked as 'Accepted' by the question author and 'Recommended' by moderators, which helps users know the answer solved the author's problem.