https://community.checkpoint.com/t5/Scripts/TP-blades-info-script/m-p/268944#M1414 <P>This script would give info on threat prevention blades enabled on the firewall. As always, please run dos2unix and chmod 777 before running it.</P> <P>Lab example:</P> <P><BR />[Expert@CP-GW:0]# ./tp_blades.sh<BR />============================================================<BR />Threat Prevention Blade Audit Report<BR />============================================================<BR />Host: CP-GW<BR />Time: 2026-01-28_073408<BR />User: admin<BR />Shell: /bin/bash</P> <P>============================================================<BR />System / Version Context<BR />============================================================</P> <P>---- OS / Kernel ----<BR />$ uname -a<BR />Linux CP-GW 4.18.0-372.9.1cpx86_64 #1 SMP Mon Nov 24 18:58:32 IST 2025 x86_64 x86_64 x86_64 GNU/Linux</P> <P>---- Firewall version (fw ver) ----<BR />$ fw ver 2&gt;/dev/null || echo 'fw command not found'<BR />This is Check Point's software version R82 - Build 013</P> <P>---- cpstat availability check ----<BR />$ cpstat 2&gt;/dev/null | head -n 40 || echo 'cpstat not available'<BR />============================================================<BR />Enabled Blades (best-effort)<BR />============================================================</P> <P>---- enabled_blades ----<BR />$ enabled_blades<BR />fw vpn cvpn urlf av appi ips identityServer mon<BR />============================================================<BR />Policy / Install Context (useful when correlating TP behavior)<BR />============================================================</P> <P>---- Firewall policy info ----<BR />$ cpstat fw -f policy 2&gt;/dev/null || echo 'cpstat fw -f policy not available'</P> <P>Product name: Firewall<BR />Policy name: LAB-POLICY-Andy<BR />Policy install time: Tue Jan 27 12:32:38 2026<BR />Num. connections: 17<BR />Peak num. connections: 528<BR />Connections capacity limit: 0<BR />Total accepted packets: 22868016<BR />Total dropped packets: 806147<BR />Total rejected packets: 0<BR />Total accepted bytes: 3245183015<BR />Total dropped bytes: 46392024<BR />Total rejected bytes: 0<BR />Total logged: 12624</P> <P><BR />Interface table<BR />----------------------------------------<BR />|Name |Dir|Accept |Drop|Reject|Log |<BR />----------------------------------------<BR />|eth0 |in |11526670| 17| 0| 517|<BR />|eth0 |out|11296980| 22| 0|7859|<BR />|eth1 |in | 22183| 0| 0| 690|<BR />|eth1 |out| 0| 0| 0| 0|<BR />|eth2 |in | 22183| 0| 0| 690|<BR />|eth2 |out| 0| 0| 0| 0|<BR />|eth2.100|in | 0| 0| 0| 0|<BR />|eth2.100|out| 0| 0| 0| 0|<BR />----------------------------------------<BR />| | |22868016| 39| 0|9756|<BR />----------------------------------------</P> <P>&nbsp;</P> <P>Interface table (64-bit)<BR />----------------------------------------<BR />|Name |Dir|Accept |Drop|Reject|Log |<BR />----------------------------------------<BR />|eth0 |in |11526670| 17| 0| 517|<BR />|eth0 |out|11296980| 22| 0|7859|<BR />|eth1 |in | 22183| 0| 0| 690|<BR />|eth1 |out| 0| 0| 0| 0|<BR />|eth2 |in | 22183| 0| 0| 690|<BR />|eth2 |out| 0| 0| 0| 0|<BR />|eth2.100|in | 0| 0| 0| 0|<BR />|eth2.100|out| 0| 0| 0| 0|<BR />----------------------------------------<BR />| | |22868016| 39| 0|9756|<BR />----------------------------------------</P> <P><BR />============================================================<BR />Threat Prevention: IPS<BR />============================================================</P> <P>---- IPS status (ips stat) ----<BR />$ ips stat<BR />IPS Status: Enabled<BR />Active Profiles:<BR />Optimized<BR />IPS Update Version: 635260635<BR />Global Detect: Off<BR />Bypass Under Load: Off</P> <P>---- IPS statistics via cpstat (if available) ----<BR />$ cpstat ips 2&gt;/dev/null || echo 'cpstat ips not available'<BR />cpstat ips not available<BR />============================================================<BR />Threat Prevention: Anti-Bot / Anti-Virus (AntiMalware)<BR />============================================================</P> <P>---- AntiMalware update status (cpstat antimalware -f update_status) ----<BR />$ cpstat antimalware -f update_status 2&gt;/dev/null || echo 'cpstat antimalware -f update_status not available'</P> <P>AB Update status: up-to-date<BR />AB Update description: Gateway is up to date. Database version: 2601111138. Package date: Sun Jan 11 03:00:00 2026<BR />.<BR />AB Next update description: The next update will be run as scheduled.<BR />AB DB version: 2601111138<BR />AV Update status: up-to-date<BR />AV Update description: Gateway is up to date. Database version: 2601280904. Package date: Wed Jan 28 03:00:00 2026<BR />.<BR />AV Next update description: The next update will be run as scheduled.<BR />AV DB version: 2601280904</P> <P><BR />---- AntiMalware general stats (cpstat antimalware) ----<BR />$ cpstat antimalware 2&gt;/dev/null || echo 'cpstat antimalware not available'</P> <P>Status: 0<BR />Status short description:<BR />Status long description:</P> <P>============================================================<BR />Threat Prevention: Threat Emulation (TE)<BR />============================================================</P> <P>---- TE status (tecli) ----<BR />$ tecli<BR />daemon did not respond or not running!</P> <P>---- TE statistics (tecli show statistics) ----<BR />$ tecli show statistics 2&gt;/dev/null || echo 'tecli show statistics not available'<BR />daemon did not respond or not running!<BR />============================================================<BR />Threat Prevention: Threat Extraction (TEX) / Content Disarm &amp; Reconstruction<BR />============================================================<BR />Attempting discovery of TEX-related cpstat application flags (best-effort).</P> <P>[INFO] Listing cpstat application flags that match: extraction|tex|threat<BR />[INFO] No TEX/threat/extraction-related cpstat flags found in this environment.<BR />============================================================<BR />Running Processes (TP-relevant daemons)<BR />============================================================</P> <P>---- cpwd_admin list ----<BR />$ cpwd_admin list<BR />APP PID STAT #START START_TIME MON COMMAND<BR />FWK_FORKER 11464 E 1 [16:38:18] 23/1/2026 N fwk_forker<BR />FWK_WD 11473 E 1 [16:38:18] 23/1/2026 N fwk_wd -i 6 -i6 0<BR />CPVIEWD 12032 E 1 [16:38:22] 23/1/2026 N cpviewd<BR />CVIEWAPIS 12053 E 1 [16:38:22] 23/1/2026 N cpview_api_service<BR />CPVIEWS 12058 E 1 [16:38:22] 23/1/2026 N cpview_services<BR />SXL_STATD 12066 E 1 [16:38:22] 23/1/2026 N sxl_statd<BR />MSGD 12095 E 1 [16:38:22] 23/1/2026 Y msgd<BR />CPD 12188 E 1 [16:38:22] 23/1/2026 Y cpd<BR />MPDAEMON 12199 E 1 [16:38:22] 23/1/2026 N mpdaemon /opt/CPshrd-R82/log/mpdaemon.elg /opt/CPshrd-R82/conf/mpdaemon.conf<BR />TP_CONF_SERVICE 12236 E 1 [16:38:23] 23/1/2026 N tp_conf_service --conf=tp_conf.json --log=info<BR />CI_CLEANUP 12387 E 1 [16:38:24] 23/1/2026 N avi_del_tmp_files<BR />CIHS 12392 E 1 [16:38:24] 23/1/2026 N ci_http_server -j -f /opt/CPsuite-R82/fw1/conf/cihs.conf<BR />FWD 12461 E 1 [16:38:24] 23/1/2026 N fwd<BR />SPIKE_DETECTIVE 12491 E 1 [16:38:24] 23/1/2026 N spike_detective<BR />LPD 13171 E 1 [16:38:30] 23/1/2026 N lpd<BR />RAD 13183 E 1 [16:38:30] 23/1/2026 N rad<BR />WSDNSD 14141 E 1 [16:39:30] 23/1/2026 Y wsdnsd<BR />DLPU_0 14152 E 1 [16:39:30] 23/1/2026 Y dlpu -i4 0 1 -i6 -1 -1<BR />DLPU_1 14155 E 1 [16:39:30] 23/1/2026 Y dlpu -i4 2 3 -i6 -1 -1<BR />DLPU_2 14158 E 1 [16:39:30] 23/1/2026 Y dlpu -i4 4 5 -i6 -1 -1<BR />TOPOD 14783 E 1 [16:39:37] 23/1/2026 Y topod<BR />UPRD 14788 E 1 [16:39:37] 23/1/2026 Y uprd<BR />MFDEMUXER 14933 E 1 [16:39:38] 23/1/2026 N /opt/CPcvpn-R82/bin/MoveFileDemuxer /opt/CPcvpn-R82/log/MFDemux.log /opt/CPcvpn-R82/conf/mfdemuxer.C<BR />DBWRITER 14941 E 1 [16:39:38] 23/1/2026 N dbwriter /opt/CPcvpn-R82/log/dbwriter.elg /opt/CPcvpn-R82/conf/dbwriter.C<BR />CVPNPROC 14946 E 1 [16:39:38] 23/1/2026 N cvpnproc /opt/CPcvpn-R82/log/cvpnproc.elg /opt/CPcvpn-R82/conf/cvpnproc.C<BR />MFSERVER 14953 E 1 [16:39:38] 23/1/2026 N /opt/CPcvpn-R82/bin/MoveFileServer /opt/CPcvpn-R82/log/MFServer.log /opt/CPcvpn-R82/conf/mfserver.C<BR />CVPNUMD 14956 E 1 [16:39:38] 23/1/2026 N /opt/CPcvpn-R82/bin/CvpnUMD<BR />PINGER 14959 E 1 [16:39:38] 23/1/2026 N /opt/CPcvpn-R82/bin/Pinger /opt/CPcvpn-R82/log/Pinger.log /opt/CPcvpn-R82/conf/Pinger.C<BR />IDLEPINGER 14962 E 1 [16:39:38] 23/1/2026 N /opt/CPcvpn-R82/bin/IdlePinger /opt/CPcvpn-R82/log/IdlePinger.log /opt/CPcvpn-R82/conf/IdlePinger.C<BR />CVPNANALYTICS 14966 E 1 [16:39:38] 23/1/2026 N /opt/CPcvpn-R82/bin/CvpnAnalytics<BR />CVPND 14978 E 1 [16:39:38] 23/1/2026 N cvpnd /opt/CPcvpn-R82/log/cvpnd.elg /opt/CPcvpn-R82/conf/cvpnd.C<BR />GUACDISPATCHER 15006 E 1 [16:39:39] 23/1/2026 N /opt/CPcvpn-R82/bin/GuacDispatcher /opt/CPcvpn-R82/log/GuacDispatcher.log /opt/CPcvpn-R82/conf/GuacDispatcher.C<BR />RTMD 19736 E 1 [16:40:57] 23/1/2026 N rtmd<BR />DASERVICE 19808 E 1 [16:40:58] 23/1/2026 N DAService_script<BR />AUTOUPDATER 19822 E 1 [16:40:58] 23/1/2026 N AutoUpdaterService.sh<BR />PROBEMOND 19836 E 1 [16:40:58] 23/1/2026 N probemond<BR />============================================================<BR />Raw cpstat Catalog (for troubleshooting / completeness)<BR />============================================================</P> <P>---- cpstat (no args) - available apps/flavors ----<BR />$ cpstat 2&gt;/dev/null || echo 'cpstat not available'<BR />cpstat not available</P> <P>============================================================<BR />End of Report<BR />============================================================</P> <P>Report saved to: ./TP_AUDIT_CP-GW_2026-01-28_073408.txt<BR />[Expert@CP-GW:0]# ls</P> Mon, 16 Mar 2026 13:21:02 GMT the_rock 2026-03-16T13:21:02Z https://community.checkpoint.com/t5/Scripts/TP-blades-info-script/m-p/268944#M1414 2 Mon, 16 Mar 2026 13:21:02 GMT https://community.checkpoint.com/t5/Scripts/TP-blades-info-script/m-p/268944#M1414 the_rock 2026-03-16T13:21:02Z https://community.checkpoint.com/t5/Scripts/TP-blades-info-script/m-p/268945#M1415 <P>I attached example output file you get at the end of the script.</P> Wed, 28 Jan 2026 12:40:57 GMT https://community.checkpoint.com/t5/Scripts/TP-blades-info-script/m-p/268945#M1415 the_rock 2026-01-28T12:40:57Z