topic Re: Automate CloudGuard to check and upload new snort rules via API in Firewall and Security Management

Automate CloudGuard to check and upload new snort rules via API

mszastak — Mon, 19 Oct 2020 11:04:45 GMT

Hi,
I am looking for the documentation where I can be able to configure CloudGuard to have new snort rules uploaded via API. I have some TI snort rules every week and API to get new rules but I do not see any function in CloudGuard to have it automated to check, download and apply these rules from 3rd part. Thank you in advance.

Regards,
Matt

Re: Automate CloudGuard to check and upload new snort rules via API

PhoneBoy — Mon, 19 Oct 2020 13:55:03 GMT

This is covered in the Threat Prevention Admin guide: https://sc1.checkpoint.com/documents/R80.40/WebAdminGuides/EN/CP_R80.40_ThreatPrevention_AdminGuide/Content/Topics-TPG/SNORT-Signature-Support.htm?Highlight=Snort

Note we do not support all snort signature attributes (refer to manual for precise limitations).
For the signatures to take effect on the gateways, a Threat Prevention policy install will be required.

Re: Automate CloudGuard to check and upload new snort rules via API

mszastak — Wed, 21 Oct 2020 09:05:10 GMT

Thank you @PhoneBoy ! This should works I guess. One question more.

Adding a file with this text inside only should works or I need to convert it to a json?

rule.txt

alert tcp any any -> any any (msg:"Possible exploit"; content:"|90|";)