topic Re: Rule base export with zero hit count in API / CLI Discussion

Rule base export with zero hit count

Arun66 — Thu, 07 Feb 2019 08:42:26 GMT

I am trying to export the rules with zero hit count for past three months using API to do a rule base clean up.

Is there a way to filter only the rules with zero counts to be exported using show access-rulebase command

My commnad as follows

Thanks & Regards

Arun

Re: Rule base export with zero hit count

Joshua_Hatter — Fri, 08 Feb 2019 12:59:50 GMT

The API team has actually recently released a script to accomplish something very similar. It might work directly for you or maybe you can draw inspiration from it.

GitHub - CheckPointSW/PolicyCleanUp

Re: Rule base export with zero hit count

Kannan_R — Sun, 10 Feb 2019 04:39:03 GMT

Hi Arun,

You may try this.

mgmt_cli show access-rulebase offset 0 limit 20 name "Network" details-level "standard" use-object-dictionary true show-hits true hits-settings.from-date "2019-01-01" hits-settings.to-date "2019-01-30" hits-settings.target "XXX" --format json -u XXX -p XXX |jq -r '.rulebase[].rulebase[]|select(.hits.value == 0)| [."rule-number", ."name", ."comments", ."enabled" ]|@csv' > Unusedrules.csv

HTH,

Kannan

Re: Rule base export with zero hit count

sudhir_mirajkar — Mon, 04 Nov 2019 15:41:51 GMT

Hi,

i am new to this so wanted your help

what does XXX mean? where should i mention the server name?

can you please guide me

thanks,

Sudhir Mirajkar

Re: Rule base export with zero hit count

venudevannagari — Mon, 06 Apr 2020 06:28:30 GMT

Hi I have tried this I am able to get the output for "mgmt_cli show access-rulebase offset 0 limit 20 name "Network" details-level "standard" use-object-dictionary true show-hits true hits-settings.from-date "2019-01-01" hits-settings.to-date "2019-01-30" hits-settings.target "XXX" --format json -u XXX -p XXX "

but after enter to jq I am unable to get the output

I am getting the below output

" mgmt show access-rulebase name "xxxx" details-level "xxxx" show-hits true hits-settings.from-date "2020-01-01" hits-settings.to-date "2020-04-03" hits-settings.target "xxxx" --format json -u ."json" -p ."json"|jq -r '.rulebase[].rulebase[]|select(.hits.value == 0)| [."rule-number", ."name", ."comments", ."enabled" ]|@csv'

MGMT9000 Invalid value [.rulebase[].rulebase[]|select(.hits.value == 0)| [."rule-number", ."name", ."comments", ."enabled" ]|@csv] of parameter [ $▒▒▒X▒▒▒x▒- x▒- y▒- x▒- ▒- x▒- ▒▒▒, $▒▒▒X▒▒▒x▒- x▒- y▒- x▒- (▒- x▒- ▒▒▒]
Checkpoint>"

Can some one help me to get rid of this problem

Thanks,

Venu.

Re: Rule base export with zero hit count

cem82 — Thu, 16 Apr 2020 22:26:45 GMT

Hi Joshua

That looks to be an awesome tool and could save us a lot of time 🙂 One bit of enhancement that I think would be great is to include an option where you can exclude rules that were created or modified within X period of time as well. That would save not taking action on a lot of recently added rules.

Re: Rule base export with zero hit count

James_ONeill1 — Sat, 18 Apr 2020 21:16:03 GMT

Hi Sudhir, All the information you seek can be found in the Management API Reference Guide 😉

Re: Rule base export with zero hit count

Hugo_Zhao — Sun, 26 Apr 2020 06:54:53 GMT

Hi Joshua,

I just downloaded the package , but seems the script can not run in SMC , it requires dependancy to install pip , setuptools and so on.

May I know how we move forward this ?

Re: Rule base export with zero hit count

Casey_Mullarkey — Thu, 08 Oct 2020 15:37:21 GMT

Is this still the case? Do we need to install pip, setuptools, etc?