Integrations
Checkpoint and WitFoo
WitFoo supports 2 Checkpoint products. Their output is parsed, deduplicated and correlated with the rest of your stack on the way in — no per-connector fee, and no parser for your team to maintain.
Supported Checkpoint products
| Product |
|---|
| Checkpoint FW |
| Harmony Email |
Sending this data somewhere else today? Conductor can sit in front of an existing SIEM and cut what you forward to it, or feed WitFoo Analytics directly. Either way the license is flat per appliance, not per gigabyte.
What WitFoo does with Checkpoint data
Every supported product is handled the same way, which is the point: you should not have to care which vendor emitted a record in order to investigate it.
-
Ingest, without a parser to write. WitFoo maintains the parser, so a vendor changing its log layout is our problem rather than yours.
-
Deduplicate. ProtoGraph collapses repeated reports of the same event from a source into one record instead of several alerts.
-
Correlate. Records join the graph alongside every other source, so an incident is assembled from whatever actually saw it.
-
Deliver. Conductor ships to Elastic, Splunk, Microsoft Sentinel, and its other built-in destinations, several at once, including the SIEM you already own.
Core integrations ship in every tier; full integration support is included in Pro and Max.
Priced per appliance, not per connector.
Adding Checkpoint — or any other supported product — does not change your bill. Data rates are unlimited in every tier.