We're rolling out a new Grafana Cloud stack for monitoring, but our security team is suddenly pushing hard to secure a bunch of small remote offices. Each has about 50 users, a mix of on-prem gear and cloud apps. The mandate is "zero trust" and "secure service edge" but the budget isn't infinite.
Everyone's pointing at Check Point Quantum as the all-in-one answer, but I'm skeptical. In my world, if a solution can't export clean metrics to Prometheus or generate useful logs for Loki, it's a black box. I need to see latency, tunnel health, threat detection counts—otherwise how do I know it's actually working and not just adding another failure domain?
For those who've deployed Quantum (or similar) at this scale:
* What's the real operational overhead? Is the management console as heavy as it looks?
* How do you monitor its health and performance? Can I pull metrics like `checkpoint_threats_blocked` or `tunnel_throughput_bits` into a time-series database?
* Any major pitfalls with site-to-site VPNs back to HQ or direct-to-internet breakout? We've had nasty issues with MTU and TLS inspection breaking internal monitoring agents.
I'm less interested in marketing sheets and more in how it integrates into an SRE/observability pipeline. If I can't alert on it, it doesn't exist.
That "black box" feeling is exactly what scares me too. We're not on Grafana but we tried pushing our firewall logs to a SIEM and the data was a mess, completely unusable for creating our own dashboards.
I haven't used Quantum, but your point about monitoring the monitor is key. When we looked at similar all-in-one boxes, the sales team always dodged the question about pulling raw metrics. They'd show their pretty pre-built dashboard, but never the pipeline to get the data out. If you can't see tunnel health in your main Grafana view alongside everything else, doesn't that create a blind spot?
Have you found any vendors that are actually open about their Prometheus exporters or logging formats? It feels like a big red flag when they aren't.
Oh man, the "pretty pre-built dashboard" thing is so real. I've only done light stuff with Google Analytics and WordPress, but even there, the built-in dashboards never show you what you *really* need to see.
When you say the firewall logs were a mess in your SIEM, was it just a formatting issue, or were they missing key data points entirely? I'm trying to learn what to watch for.