topic Re: MDS/SMS User login string from SID in Firewall and Security Management

MDS/SMS User login string from SID

FGBrollo — Fri, 25 Jun 2021 15:16:03 GMT

Hello everyone,

I was wondering if there is a way to get the user login from an API SID (x-chkp-sid) ?

The format of the SID in the api.elg file does not file the "ID" field of the Audit Log:

Does any of you knows where I could find the link between an SID and a user login ?

Any help would be appreciated.

Re: MDS/SMS User login string from SID

PhoneBoy — Fri, 25 Jun 2021 15:27:37 GMT

The session ID is generated as a result of a login action, meaning it's unique for that session for that user.
If you want to see who is associated with a given session, use the show-session API call.

Re: MDS/SMS User login string from SID

FGBrollo — Fri, 25 Jun 2021 15:58:05 GMT

Thank you for the quick reply.

I just checked the API Documentation for show-session (https://sc1.checkpoint.com/documents/latest/APIs/index.html#web/show-session~v1.1%20)

I does not state if this would show me the details of a previous (logged out) session ?
Do you know if this is the case ?

[Edit:] A quick test show me the reply:
"Invalid parameter for [uid]. The invalid value: [00000000000000000000000000000]"

Re: MDS/SMS User login string from SID

PhoneBoy — Fri, 25 Jun 2021 21:40:24 GMT

I'm guessing this is because SIDs are ephemeral and used only while the session is active.
And looking at the API more closely, the API only supports looking up by session UID (different from the SID).
You can look up the session by the session UID, which is listed in the log card for the Log Out entry.

Curious: given the ephemeral nature of SIDs, why is lookup by SID interesting?

Re: MDS/SMS User login string from SID

FGBrollo — Mon, 28 Jun 2021 07:23:49 GMT

Thank you for the pointers.
I've been looking up by SID because that's what is showing in the API logs.

We got a lot of admin accounts, some tools like algosec and a few scripts doing regular query on the API.

It would have been neat for me to have a way to identify user activity directly from the api.elg file in order for me to contact a software admin, a user, or a team in charge of a script/software in order to show them ways to improve their workflow (eg: too many calls on a short period of time, unescessary non-filtered requests, wrong timing because it's telescoping with another script etc...)

Re: MDS/SMS User login string from SID

PhoneBoy — Mon, 28 Jun 2021 19:52:07 GMT

@Omer_Kleinstern maybe we can add more information to api.elg for troubleshooting?

Re: MDS/SMS User login string from SID

Omer_Kleinstern — Tue, 29 Jun 2021 06:43:31 GMT

Hi @FGBrollo ,

You can add a user agent header in the API calls to identify user activity in API logs (--user-agent in mgmt_cli).

Algosec will add a user agent header to their API calls in their next version.

Thanks,

Omer