aiFObserve
Distributed, Contextual Visibility & Governance for Enterprise AI Traffic. No Agents, No APIs, No
Check Point Capture Guide For Unified aiFObserve
Best Capture Source
Use Check Point Log Exporter from the Management Server or Log Server. JSON, CEF, LEEF, syslog, and key-value text are supported by the converter, but JSON or clear key-value exports normally preserve the most useful fields.
Basic Logging
For rules allowing outbound SaaS and AI traffic:
- Enable logging in the Access Control policy.
- Use
Detailed LogorExtended Logfor application-aware rules. - Use
Per connectionwhen you need constituent connections. - Keep session logs enabled when you want user activity grouped by application or site.
- Export logs with Log Exporter.
Minimum fields to export:
- loguid
- hll_key, when available
- creation_time
- last_hit_time or duration
- src, dst
- spt, dpt
- proto
- bytes, packets
- client_outbound_bytes, server_outbound_bytes
- client_outbound_packets, server_outbound_packets
- action, rule_name
- src_user
- app, matched_category, service_id
Extended Logging
- URL Filtering fields with full URL or site
- Application Control categories and application names
- HTTPS Inspection action and inspection result
- blade/product fields
- severity and confidence fields
- attack/protection name fields
- source and destination country
- update logs that share loguid
The converter groups related records by hll_key and then loguid so update chains can become one stronger session row.
User And App Identity
Best identity signals:
- src_user
- Identity Awareness usernames
- app, matched_category, service_id
- URL/site fields from Extended Log
Use HTTPS Inspection where permitted to avoid generic HTTPS-only application labels.
AI Provider And Location Evidence
Keep destination address, country, application/site, URL, category, and HTTPS inspection fields. These help the compliance builder show AI provider usage and data boundary evidence.