# Useful Smartlog Queries

## Generic Queries

<table class="table-striped" id="bkmrk-research-smartlog-qu"><tbody><tr><th scope="col" style="width: 343px;">Research</th><th scope="col" style="width: 741px;">SmartLog Query</th></tr><tr><td style="width: 343px;">Search for E-Mail Subject  
Note: Search without quotation marks and wildcard works for email\_subject</td><td style="width: 741px;">***email\_subject:\*TEXT**\**</td></tr><tr><td style="width: 343px;">Application Control Proxy Log</td><td style="width: 343px;">***blade:"Application Control" AND appi\_name:"Web Surfen" AND \*part-of-hostname**\**</td></tr><tr><td style="width: 343px;">Every logs of a specific rule</td><td style="width: 741px;">***{ABC12345-ABC1-ABC1-ABC1-ABC123ABC12}***</td></tr><tr><td style="width: 343px;">Security Management Log Server : when logs were not able to be sent to it</td><td style="width: 741px;">***"were not sent to log server"***</td></tr><tr><td style="width: 343px;">Filter Logs by Geo-Location</td><td style="width: 741px;">***src\_country:"Germany" AND src:&lt;ip-address&gt;***</td></tr><tr><td style="width: 343px;">Alert on GW</td><td style="width: 741px;">***<span class="monospace">type:Alert AND origin:&lt;fw-gwname&gt;</span>***</td></tr><tr><td style="width: 343px;">FW Control Messages (Failover etc.)</td><td style="width: 741px;">***<span class="monospace">type:Control</span>***</td></tr><tr><td style="width: 343px;">ClusterXL Control Messages, Cluster Switch over Messages</td><td style="width: 741px;">***<span class="monospace">type:Control ClusterXL</span>***</td></tr><tr><td style="width: 343px;">DHCP Messages</td><td style="width: 741px;">***<span class="monospace">service:dhcp</span>***</td></tr><tr><td style="width: 343px;">Address Spoofing</td><td style="width: 741px;">***address spoofing***</td></tr><tr><td style="width: 343px;">Find aggressive aging events</td><td style="width: 741px;">***aggressive aging***</td></tr><tr><td style="width: 343px;">Any TCP state errors listed in <span class="wikiexternallink">[sk101221‌](https://supportcenter.checkpoint.com/supportcenter/portal?eventSubmit_doGoviewsolutiondetails=&solutionid=sk101221&partition=Advanced&product=Security)</span></td><td style="width: 741px;">***tcp (fin OR syn) NOT "both fin" NOT "established"***

In the query field, type "***tcp state***" (without quotes) or any relevant text (e.g., "***syn\_sent***", "***both fin***")

</td></tr><tr><td style="width: 343px;">Global Broadcast</td><td style="width: 741px;">***<span class="monospace">dst:255.255.255.255</span>***</td></tr><tr><td style="width: 343px;">HTTPS Inspection CRL or OCSP errors</td><td style="width: 741px;">***<span class="monospace">blade:"HTTPS Inspection" crl OR ocsp</span>***</td></tr><tr><td style="width: 343px;">Certificates: any alert regarding crl (Certification Revocation List) or certificates‌ (see <span class="wikiexternallink">[sk104400‌](https://supportcenter.checkpoint.com/supportcenter/portal?eventSubmit_doGoviewsolutiondetails=&solutionid=sk104400&partition=General&product=IPSec)</span>for more details)</td><td style="width: 741px;">***type:alert (certificate or CRL)***</td></tr><tr><td style="width: 343px;">Potential network configuration problem messages in log - See <span class="wikiexternallink">[SK63160](https://supportcenter.checkpoint.com/supportcenter/portal?eventSubmit_doGoviewsolutiondetails=&solutionid=sk63160)</span></td><td style="width: 741px;">***<span class="monospace">"Engine Settings - TCP"</span>***

</td></tr><tr><td style="width: 343px;">IPS Bypass Messages  
See discussion here: <span class="wikiexternallink">[Checkmates: IPS bypass](https://community.checkpoint.com/thread/8884-ips-bypass)</span></td><td style="width: 741px;">***<span class="monospace">blade:IPS NOT( action: (prevent OR block) ) OR "IPS Bypass Engaged" OR "IPS Bypass Disengaged"</span>***</td></tr></tbody></table>

## Threat Extraction / Emulation

<table class="table-striped" id="bkmrk-research-smartlog-qu-0"><tbody><tr><th scope="col" style="width: 343px;">Research</th><th scope="col" style="width: 741px;">SmartLog Query</th></tr><tr><td style="width: 343px;">Threat Extraction</td><td style="width: 741px;">***<span class="monospace">blade:"Threat Extraction" AND action:Extract</span>***</td></tr><tr><td style="width: 343px;">Threat Extraction Search for E-Mail Subject</td><td style="width: 741px;">***<span class="monospace">blade:"Threat Extraction" OR blade:"Threat Emulation" AND email\_subject:" TTTTT" OR email\_subject:"TTTTT"</span>***</td></tr><tr><td style="width: 343px;">Threat Extraction show last activity</td><td style="width: 741px;">***blade:"Threat Extraction" AND "Content Removal" OR "Conversion to PDF"***</td></tr><tr><td style="width: 343px;">Threat Emulation show errors</td><td style="width: 741px;">***blade:"Threat Emulation" \*"ended with verdict Error"\****</td></tr><tr><td style="width: 343px;">Threat Emulation show found threats</td><td style="width: 741px;">***blade:"Threat Emulation" AND severity:Critical NOT type:Correlated***</td></tr></tbody></table>

## Endpoint Security &amp; Remote Access

<table class="table-striped" id="bkmrk-research-smartlog-qu-1"><tbody><tr><th scope="col" style="width: 343px;">Research</th><th scope="col" style="width: 741px;">SmartLog Query</th></tr><tr><td style="width: 343px;">Seeing tunnels activities</td><td style="width: 741px;">***tunnel\_test or action:"Key Install" or action:"Failed Log In" OR action:"Log In" OR action:"Log Out" OR action:reject OR action:Update***</td></tr><tr><td style="width: 343px;">Connection Errors</td><td style="width: 741px;">***blade:vpn AND action:Reject ( "endpoint" OR "user" OR "Office Mode" )***</td></tr><tr><td style="width: 343px;">Errors Authenticating Users</td><td style="width: 741px;">***"Could not obtain user object" "IKE failure"***</td></tr></tbody></table>