By configuring Sycope as a flow collector in Gaia, organizations can use their existing Check Point infrastructure as a source of network telemetry for continuous monitoring and historical analysis.
The integration uses standard flow protocols supported by both platforms and does not require a dedicated proprietary connector.
Table of Contents
From Check Point traffic to network analysis
Check Point supports NetFlow v5, NetFlow v9 and IPFIX export. A collector configuration defines the destination IP address and port, source address where required and the format used for export.
Security Gateways and Cluster Members can export records describing traffic that passes through them. Gaia supports up to three NetFlow collectors and sends records to each configured destination.
Once Sycope receives the flow records, the data becomes available for network analysis, dashboards, searches, reporting and monitoring rules.
This extends the visibility provided by the gateway with historical analysis across communication observed over time.
Complementary capabilities, clearly divided
Check Point and Sycope remain independent platforms and perform different roles within the network and security architecture.
Check Point provides:
- Firewall and Access Control policy enforcement
- Security inspection
- Network session processing
- Security Gateway and cluster functionality
- NetFlow v5, NetFlow v9 and IPFIX export
- Control over which accepted traffic is included in NetFlow export
Sycope provides:
- NetFlow and IPFIX collection and analysis
- Host-to-host communication visibility
- Historical network traffic data
- Network performance analysis
- Network anomaly and threat detection
- Traffic search and filtering
- Dashboards, reporting and alerting
Check Point controls and inspects communication as it passes through the Security Gateway. Sycope uses the exported flow records to analyze that communication over time and together with telemetry from other network devices.
Using Security Gateway data for broader network visibility
Flow records generated by Check Point provide information about communication traversing the gateway. Collecting this information in Sycope makes it possible to use the same traffic data for longer-term operational and security analysis.
Communication between systems
Flow data provides information about the endpoints involved in communication, ports, traffic volumes and timing.
Sycope can use these records to show which systems communicated, when communication occurred and how much data was exchanged.
This supports investigations involving connectivity problems, unexpected communication and changes in traffic patterns affecting systems behind Check Point Security Gateways.
Historical traffic analysis
An investigation often begins after the relevant communication has already occurred.
Retaining flow records in Sycope allows teams to return to the time of an incident or performance problem and examine the communication associated with a particular system or service.
Analysts can review communication partners, traffic volumes and activity over time rather than relying only on the current state of the gateway or individual log entries.
Network performance and traffic usage
Flow data can also be used to understand how network capacity is consumed.
Sycope analyzes traffic volumes across hosts, services, exporters and interfaces, helping teams identify changes in network usage and systems responsible for unusual amounts of traffic.
The same historical information can support troubleshooting, capacity analysis and investigation of performance degradation.
Security analysis based on network behavior
Check Point security controls and Sycope flow analytics provide different views of the same traffic.
The Security Gateway remains responsible for policy enforcement and security inspection. Sycope analyzes communication patterns and historical behavior, providing another source of evidence when unusual or suspicious activity requires investigation.
This gives NOC and SOC teams access to a longer-term network perspective while retaining Check Point’s existing role at the security boundary.
Controlling which traffic is exported
Check Point provides control over the traffic included in NetFlow export.
In a clean R82 installation, NetFlow export is enabled by default for traffic accepted by Access Control rules. Administrators can also enable the NetFlow Fw rule option to restrict export to traffic accepted by rules configured in SmartConsole with Track: Log and Accounting.
This makes it possible to align flow export with the monitoring scope required by the organization rather than treating all gateway traffic identically.
The exact configuration depends on the Gaia version and whether the environment is a clean installation or has been upgraded from an earlier release, so the applicable Check Point documentation should be followed during deployment.
Multiple gateways and collectors
Check Point allows up to three NetFlow collectors to be configured on a Security Gateway. Each configured collector receives a copy of the exported records.
This allows Sycope to be introduced alongside another existing flow collector without necessarily replacing the current destination.
In larger environments, multiple Check Point Security Gateways can export data to the same Sycope environment. The resulting flow information can then be analyzed together with telemetry received from other compatible network devices.
This provides a common analytical layer across different network segments and exporter types.
How the integration works
The integration consists of three main elements.
NetFlow export in Check Point Gaia
A NetFlow collector is configured in Gaia Portal or Gaia Clish using the IP address and port of the Sycope collector.
The administrator selects the required export format: NetFlow v5, NetFlow v9 or IPFIX. A source IPv4 address can also be defined when required by the network configuration.
In cluster environments, Check Point requires NetFlow to be configured consistently on all Cluster Members.
The configuration can additionally determine whether accepted traffic is exported generally or only when it matches Access Control rules using Log and Accounting.
Flow collection in Sycope
Sycope receives the exported NetFlow or IPFIX records and processes them as network telemetry.
The default NetFlow listening port in Sycope is 2055, although additional ports can be configured. Sycope supports NetFlow v5, NetFlow v9 and IPFIX, as well as other flow protocols used by different exporters.
The Check Point data can therefore be analyzed in the same environment as flows received from switches, routers, firewalls and other supported infrastructure.
Analysis, visualization and alerting
Once processed, Check Point flow records become available throughout the Sycope analytical environment.
Teams can use the data to search historical communication, analyze traffic patterns, create dashboards and reports and apply monitoring or security rules.
Check Point continues to enforce firewall and security policies, while Sycope provides the historical and behavioral analysis of the communication observed by the gateway.
From gateway traffic to historical network context
Consider an internal server whose communication passes through a Check Point Security Gateway.
The gateway processes the traffic according to the configured Access Control and security policies and exports corresponding flow information to Sycope.
Sycope retains and analyzes those records over time.
If the server later becomes part of a security investigation or experiences a performance issue, the team can examine its historical communication in Sycope, including communication partners, services, traffic volumes and changes in activity during the relevant period.
The same information can be compared with flow data from other exporters to reconstruct a broader view of network activity.
Check Point remains responsible for controlling communication at the gateway, while Sycope provides the historical network evidence used to understand how the affected systems communicated.
Check Point and Sycope integration
Check Point NetFlow and IPFIX export provides a standard way to use existing Security Gateways as network data sources for Sycope.
Flow information collected from Check Point can be analyzed together with telemetry from other network devices, providing broader visibility into communication, network usage and security behavior without changing the role of the existing firewall infrastructure.
To discuss using Check Point flow data with Sycope, contact our team.
