The following decoders seem to work for me. The regex is a little dirty, but it appears to work. I guess I have a checkpoint-syslog-fw, so I had to change the decoder's name and update it in the rules too.
<decoder name="checkpoint-syslog"> <prematch>^Checkpoint \d\d:\d\d:\d\d</prematch> </decoder> <decoder name="checkpoint-syslog-fw2"> <parent>checkpoint-syslog</parent> <use_own_name>true</use_own_name> <prematch offset="after_parent">^\s+drop|^\s+accept|^\s+reject</prematch> <regex offset="after_parent">^\s+(\S+)\s+\.+src: (\d+.\d+.\d+.\d+); dst: (\d+.\d+.\d+.\d+); proto: (\S+);</regex> <order>action,srcip,dstip,protocol</order> </decoder> <decoder name="checkpoint-syslog-vpn"> <parent>checkpoint-syslog</parent> <use_own_name>true</use_own_name> <prematch offset="after_parent">^\s+encrypt|^\s+decrypt</prematch> <regex offset="after_parent">^\s+(\S+)\s+\.+src: (\d+.\d+.\d+.\d+); dst: (\d+.\d+.\d+.\d+); proto: (\S+);</regex> <order>action,srcip,dstip,protocol</order> </decoder>
