topic Re: Firewall logs in Firewall and Security Management

Firewall logs

checkpointer — Mon, 06 Sep 2021 11:44:33 GMT

Hello,

I would like to fetch all security policies with hit count, first hit , last hit details included in a report and also sort the rules in descending order of last used.

There is no way to do this in SmartConsole, anyone have any ideas about how I can go about this?

Regards,

Checkpointer

Re: Firewall logs

PhoneBoy — Mon, 06 Sep 2021 16:29:58 GMT

The show access-rulebase API command, when used with show-hits true, will show the first and last hit date.
However, not aware of a way to sort by last hit date short of writing a script.
In R81.10, the export to CSV from SmartConsole includes some info about hits, but don’t believe it includes the dates: https://community.checkpoint.com/t5/Management/Export-of-rules-with-zero-hits-in-dashboard/m-p/120552#M26931
This might also help (or not): https://supportcenter.checkpoint.com/supportcenter/portal?action=portlets.SearchResultMainAction&eventSubmit_doGoviewsolutiondetails=&solutionid=sk135212

Bottom line: to get this, some assembly will be required.

Re: Firewall logs

the_rock — Mon, 06 Sep 2021 17:24:16 GMT

That was my post not so long ago, totally remember that 🙂