topic Re: checkpoint Firewall audit for configuration change via API in Firewall and Security Management

checkpoint Firewall audit for configuration change via API

MaxNC — Thu, 09 May 2024 08:06:27 GMT

Hi ,
How to do audit for Firewall configuration changes done through API.
Suppose if any firewall engineer performs changes via API, and i want to know API client logged in to firewall and what changes has been done via API.

Re: checkpoint Firewall audit for configuration change via API

PhoneBoy — Thu, 09 May 2024 15:11:35 GMT

These changes can be reviewed in the Audit logs in SmartConsole.

Re: checkpoint Firewall audit for configuration change via API

MaxNC — Mon, 13 May 2024 08:40:41 GMT

Hi PhoneBoy,

Do i need enable anything? Because i check the audit log in smartConsole is nothing event relate to API action.

Re: checkpoint Firewall audit for configuration change via API

PhoneBoy — Mon, 13 May 2024 16:20:02 GMT

No.
Here's an example from my lab:

I performed the following steps using mgmt_cli (which is an API client):

Login
Create the host "foobar" with ipv4-address 4.3.2.1
Publish the changes

There are log entries for each one of these actions (as user phoneboy).
Double-click on them to see more details:

If you cannot see such log entries, I suggest a TAC case: https://help.checkpoint.com