https://community.checkpoint.com/t5/Scripts/Identity-Awareness-Client-Statistics/m-p/268234#M1351 <P>&nbsp;</P> <P>&nbsp;</P> <H2><span class="lia-unicode-emoji" title=":bar_chart:">📊</span> IDA Statistics Analyzer - Comprehensive Analysis for PDP &amp; PEP Sessions</H2> <P>I've created a Python script that analyzes Check Point Identity Awareness data from <CODE>ida_tables_util</CODE> and generates detailed statistics reports.</P> <H3><span class="lia-unicode-emoji" title=":direct_hit:">🎯</span> What it does</H3> <UL> <LI><STRONG>PDP Session Analysis</STRONG> - Organizations, domains, authentication methods, client types, IP ranges, hourly patterns</LI> <LI><STRONG>PEP Client Database Analysis</STRONG> - Session TTL, user types, geographic distribution</LI> <LI><STRONG>Demo Mode</STRONG> - Generate synthetic data for testing (no real data exposure)</LI> <LI><STRONG>Automated Reports</STRONG> - Saves results to <CODE>pdp_stats.txt</CODE> and <CODE>pep_stats.txt</CODE></LI> </UL> <H3>� Usage</H3> <H4>Help / No Parameters</H4> <PRE>python3 ida_stats.py usage: ida_stats.py [-h] [-f FILE] [--generate] [--demo] [--table {pdp,pep,both}] Analyze Check Point IDA Statistics (PDP Sessions and PEP Client Database) options: -h, --help show this help message and exit -f FILE, --file FILE Input CSV file --generate Run ida_tables_util to generate CSV file --demo Use demo data (synthetic data for demonstration) --table {pdp,pep,both} Which table to analyze (default: both) Examples: # Analyze both PDP and PEP (demo mode): python ida_stats.py --demo # Analyze specific table with file: python ida_stats.py --table pdp -f ida_tab_pdp_sessions.csv python ida_stats.py --table pep -f ida_tab_pep_client_db.csv # Generate and analyze (requires Check Point system): python ida_stats.py --table pdp --generate python ida_stats.py --table pep --generate python ida_stats.py --table both --generate </PRE> <H4>Generate Mode Example</H4> <PRE>[Expert@gateway:0]# python3 ida_stats.py --table both --generate Running: ida_tables_util -t pdp_sessions CSV file created: ida_tab_pdp_sessions.csv Parsing PDP CSV file: ida_tab_pdp_sessions.csv Found 8542 PDP sessions PDP statistics saved to: pdp_stats.txt Running: ida_tables_util -t pep_client_db CSV file created: ida_tab_pep_client_db.csv Parsing PEP CSV file: ida_tab_pep_client_db.csv Found 7891 PEP entries PEP statistics saved to: pep_stats.txt </PRE> <H4>Demo Mode (Privacy-Safe)</H4> <PRE>python ida_stats.py --demo</PRE> <H4>Analyze Existing CSV Files</H4> <PRE>python ida_stats.py --table pdp -f ida_tab_pdp_sessions.csv python ida_stats.py --table pep -f ida_tab_pep_client_db.csv</PRE> <H3><span class="lia-unicode-emoji" title=":chart_increasing:">📈</span> Sample Output</H3> <PRE>================================================================================ PDP SESSION STATISTICS ================================================================================ Total Sessions: 500 - User Sessions: 475 (95.0%) - Machine Sessions: 25 (5.0%) - Terminal Server Sessions: 120 (24.0%) --- Client Type Distribution --- Identity Agent 380 ( 76.0%) ################### Terminal Server Identity Agent 120 ( 24.0%) ###### Identity Collector 0 ( 0.0%) --- Top 15 Organizations --- 1. Global Insurance Corp 62 ############### 2. TechSecure Solutions 58 ############## 3. Finance Bank International 54 ############# 4. Manufacturing Industries Ltd 51 ############ 5. Healthcare Systems Group 48 ########### --- Domain Distribution --- company.local 285 ( 60.0%) ############ corp.internal 120 ( 25.3%) ##### enterprise.net 70 ( 14.7%) ### --- IP Address Analysis --- Internal IPs: 300 (60.0%) External IPs: 200 (40.0%) --- Connections by Hour of Day --- 07:00 - 07:59 42 ################ 08:00 - 08:59 78 #################### 09:00 - 09:59 85 #################### </PRE> <H4>Generate Fresh Data from Checkpoint System</H4> <PRE>python ida_stats.py --generate</PRE> <H3><span class="lia-unicode-emoji" title=":light_bulb:">💡</span> Key Features</H3> <UL> <LI><span class="lia-unicode-emoji" title=":white_heavy_check_mark:">✅</span> No external dependencies - uses Python standard library only</LI> <LI><span class="lia-unicode-emoji" title=":white_heavy_check_mark:">✅</span> Works with CSV output from <CODE>ida_tables_util -t pdp_sessions</CODE> and <CODE>-t pep_client_db</CODE></LI> <LI><span class="lia-unicode-emoji" title=":white_heavy_check_mark:">✅</span> Handles both active and inactive PDP/PEP services gracefully</LI> <LI><span class="lia-unicode-emoji" title=":white_heavy_check_mark:">✅</span> Generates separate reports for easier analysis</LI> <LI><span class="lia-unicode-emoji" title=":white_heavy_check_mark:">✅</span> Demo mode with synthetic data for presentations</LI> <LI><span class="lia-unicode-emoji" title=":white_heavy_check_mark:">✅</span> Cross-platform (Windows, Linux, macOS)</LI> </UL> <H3><span class="lia-unicode-emoji" title=":clipboard:">📋</span> Statistics Included</H3> <TABLE border="1" cellpadding="5"> <TBODY> <TR> <TH>PDP Sessions</TH> <TH>PEP Client Database</TH> </TR> <TR> <TD valign="top">• Session types (User/Machine)<BR />• Top organizations<BR />• Authentication domains<BR />• Client types &amp; versions<BR />• Authentication methods<BR />• PDP server distribution<BR />• IP analysis (internal/external)<BR />• Hourly connection patterns<BR />• User type analysis<BR />• Terminal Server details</TD> <TD valign="top">• Total PEP entries<BR />• Top organizations<BR />• PDP server distribution<BR />• Client IP analysis<BR />• User type classification<BR />• Session TTL statistics<BR />• Internal vs external IPs</TD> </TR> </TBODY> </TABLE> <P>&nbsp;</P> <H3><span class="lia-unicode-emoji" title=":graduation_cap:">🎓</span> Example Workflow</H3> <PRE># On Check Point Gateway [Expert@gateway]# python3 ida_stats.py --demo # Output ============================================================ PDP DEMO MODE - Using synthetic data ============================================================ Generating demo data... Generated 500 demo sessions Found 500 PDP sessions PDP statistics saved to: pdp_stats.txt ============================================================ PEP DEMO MODE - Using synthetic data ============================================================ Generating PEP demo data... Generated 400 PEP demo entries Found 400 PEP entries PEP statistics saved to: pep_stats.txt </PRE> <H3><span class="lia-unicode-emoji" title=":warning:">⚠️</span> Notes</H3> <UL> <LI>All status messages go to stderr, statistics go to files - no console clutter</LI> <LI>Use <CODE>--demo</CODE> mode when sharing examples publicly (synthetic data only)</LI> <LI>Reports use ASCII characters for maximum compatibility</LI> <LI>Handles large datasets efficiently (tested with 13,000+ sessions)</LI> </UL> <P><STRONG>Questions? Feedback? Let me know!</STRONG></P> <HR /> <P><EM>Tested on Check Point R82 with Python 3.13</EM></P> Tue, 24 Feb 2026 16:20:54 GMT Vincent_Bacher 2026-02-24T16:20:54Z https://community.checkpoint.com/t5/Scripts/Identity-Awareness-Client-Statistics/m-p/268234#M1351 4 Tue, 24 Feb 2026 16:20:54 GMT https://community.checkpoint.com/t5/Scripts/Identity-Awareness-Client-Statistics/m-p/268234#M1351 Vincent_Bacher 2026-02-24T16:20:54Z https://community.checkpoint.com/t5/Scripts/Identity-Awareness-Client-Statistics/m-p/268352#M1363 <P>Will try this in the lab Friday.</P> Fri, 23 Jan 2026 02:46:15 GMT https://community.checkpoint.com/t5/Scripts/Identity-Awareness-Client-Statistics/m-p/268352#M1363 the_rock 2026-01-23T02:46:15Z https://community.checkpoint.com/t5/Scripts/Identity-Awareness-Client-Statistics/m-p/268465#M1376 <P>Just tried it, no issues!</P> Fri, 23 Jan 2026 18:10:08 GMT https://community.checkpoint.com/t5/Scripts/Identity-Awareness-Client-Statistics/m-p/268465#M1376 the_rock 2026-01-23T18:10:08Z https://community.checkpoint.com/t5/Scripts/Identity-Awareness-Client-Statistics/m-p/268466#M1377 <P>Thanks!</P> <P>bV</P> Fri, 23 Jan 2026 18:11:49 GMT https://community.checkpoint.com/t5/Scripts/Identity-Awareness-Client-Statistics/m-p/268466#M1377 Vincent_Bacher 2026-01-23T18:11:49Z