topic Re: Find out who created the object in Checkpoint in Firewall and Security Management

Find out who created the object in Checkpoint

neochaser5 — Tue, 05 Mar 2019 03:47:53 GMT

In Checkpoint, how do I find out who originally created the host object? Also how do I find out who edited it? Thank you in advance.

Re: Find out who created the object in Checkpoint

Danny — Tue, 05 Mar 2019 07:36:17 GMT

Just search the Audit Log and check who created it.

Re: Find out who created the object in Checkpoint

Maarten_Sjouw — Tue, 05 Mar 2019 07:42:41 GMT

In the Object Explorer (top 2nd from left Objects -> Object Explorer) you can see who last modified the object and when.

Keep in mind that after every migration all you will see is system and the migration date.

Re: Find out who created the object in Checkpoint

Ron_Izraeli — Tue, 05 Mar 2019 18:00:25 GMT

Another method is to use show-object management API command which in full details level return the creator and the last modifier (along with more meta info).

e.g.

> show object uid d3bc2c89-ca4d-43e0-8d3c-e926dec6ba9b details-level full

object:
uid: "d3bc2c89-ca4d-43e0-8d3c-e926dec6ba9b"
name: "CP_default_Office_Mode_addresses_pool"
type: "network"
.

.
meta-info:
lock: "locked by current session"
validation-state: "ok"
last-modify-time:
posix: 1550368773740
iso-8601: "2019-02-17T03:59+0200"
last-modifier: "System"
creation-time:
posix: 1550368773740
iso-8601: "2019-02-17T03:59+0200"
creator: "System"
read-only: false

Re: Find out who created the object in Checkpoint

neochaser5 — Wed, 06 Mar 2019 04:29:57 GMT

Thank you all. I am able to locate it based on your instructions above. This is really helpful. Thanks again.

Re: Find out who created the object in Checkpoint

McLovin — Wed, 10 Mar 2021 20:23:15 GMT

This is all well and good but how do you convert the Object Name to UID?

Re: Find out who created the object in Checkpoint

PhoneBoy — Wed, 10 Mar 2021 23:06:35 GMT

show object is a generic endpoint for all object types.
UID is required in this case.

If you only know the name of the object, you can get the same details by showing the type of object in question by name with details-level full.
For example, using the network object named HQ LAN:

> show network name "HQ LAN" details-level full

uid: "da1909e1-f668-4464-bc55-5ba18b1568b4"
name: "HQ LAN"
type: "network"
domain:
uid: "41e821a0-3720-11e3-aa6e-0800200c9fde"
name: "SMC User"
domain-type: "domain"
broadcast: "allow"
subnet4: "22.20.105.0"
mask-length4: 24
subnet-mask: "255.255.255.0"
nat-settings:
auto-rule: false
groups:
- uid: "90132213-0e4c-45a6-b229-07f7e95e61ce"
name: "Corporate LANs"
type: "group"
domain:
uid: "41e821a0-3720-11e3-aa6e-0800200c9fde"
name: "SMC User"
domain-type: "domain"
members:
- "da1909e1-f668-4464-bc55-5ba18b1568b4"
- "8a8f4892-84ee-4d0d-bb89-4db717894358"
- "6f0bf0bb-9cfe-427a-918c-3455370f531e"
groups: []
comments: ""
color: "black"
icon: "General/group"
tags: []
meta-info:
lock: "unlocked"
validation-state: "ok"
last-modify-time:
posix: 1602604265170
iso-8601: "2020-10-13T15:51+0000"
last-modifier: "admin"
creation-time:
posix: 1602604265170
iso-8601: "2020-10-13T15:51+0000"
creator: "admin"
read-only: false
comments: ""
color: "black"
icon: "NetworkObjects/network"
tags: []
meta-info:
lock: "unlocked"
validation-state: "ok"
last-modify-time:
posix: 1602604261254
iso-8601: "2020-10-13T15:51+0000"
last-modifier: "admin"
creation-time:
posix: 1602604261254
iso-8601: "2020-10-13T15:51+0000"
creator: "admin"
read-only: false