What is the difference between an event and a log?

Events are not generated directly at the gateway - logs are generated at the gateway, and the SmartEvent server derives events from those logs through correlation.

Check Point SmartEvent distinguishes between logs (raw connection records generated by gateways) and events (correlated, meaningful security occurrences). A log entry becomes an event when the SmartEvent Correlation Unit processes it and finds a match against a rule defined in the Event Policy, triggering classification and alerting workflows based on that match.

SmartWorkflow is a separate workflow management tool for change management, not a mechanism for collecting events from trouble ticket systems.

Logs and Events are not synonyms - logs are raw data records while events are correlated security incidents derived by matching logs against defined event policies.