topic Script that collects specific rules and exports them into csv/xml (R80.20) in API / CLI Discussion

Script that collects specific rules and exports them into csv/xml (R80.20)

Arthur_Nadaryan — Fri, 02 Aug 2019 09:48:23 GMT

I'm trying to make a script that collects rules with time objects and outputs them into an xml/csv file. The file must contain: the access policy package name the rules are behind and rules that have a time object. The rules with time objects will be listed if the rules are going to expire in 1 to 7 days (if a temporal rule expires in 8 days then it won't be listed, if it's 7 or less days then it will). What kind of info is shown about the rule when it's being exported? Number, Name, Source, Destination, VPN, Services & Applications, Time and Comments

Re: Script that collects specific policies into csv/xml (R80.20)

Adam_Forester — Mon, 29 Jul 2019 15:44:19 GMT

How is your time expiration objects built? Do you name them by their expiration date?

Re: Script that collects specific policies into csv/xml (R80.20)

Arthur_Nadaryan — Mon, 29 Jul 2019 15:56:13 GMT

Yes, all time objects have a date as a name (numbers) and the format is day-month-year (29.07.2019).

Re: Script that collects specific policies into csv/xml (R80.20)

Adam_Forester — Mon, 29 Jul 2019 16:11:58 GMT

You can run a filter based on the time object.

mgmt_cli -r true show access-rulebase name "POLICY NAME" details-level "standard" use-object-dictionary true filter "TIME Object Name" --format json

You can then use JQ to export csv once you format the JSON to your needs.

Re: Script that collects specific policies into csv/xml (R80.20)

Adam_Forester — Mon, 29 Jul 2019 16:21:40 GMT

Wrote a quick sample bash script. It will search the object database for time objects that are +7 days from the current system date, you can change that easily by changing the +X date. Then it will filter the rulebase for those objects and output the in json. It's interactive to play with but you can hardset the variables. Should give you a starting point;

Script is expiring-rules.sh

https://github.com/WadesWeaponShed/Rulebase-Audit

Re: Script that collects specific policies into csv/xml (R80.20)

Arthur_Nadaryan — Mon, 05 Aug 2019 10:11:10 GMT

Thanks for the help but I have one question. The script outputs a lot of info about a specific rule. I'm having mixed results with jq and I would like to know how to filter the output to only show the following: Policy name, rule number, source, destination, service/applications, action, time and comments. ipv4-addresses included for src and dst. Comments for me appear as null. Trying to get other information will result in an error. Bellow is a basic sample that finds rules with "01.01.2020" that are behind a specific policy/FW. The output gives one result but there are 2 rules that contain "01.01.2020". mgmt_cli -r true show access-rulebase name "Policy-Name-Here" details-level "standard" use-object-dictionary true filter "01.01.2020" --format json | jq '{name: .name}' >>TEMPORALS.txt

Re: Script that collects specific policies into csv/xml (R80.20)

Adam_Forester — Mon, 05 Aug 2019 13:58:24 GMT

I updated on github, should give you a start. Show access-rulebase uses UID for objects and references the object tree so I changed it to take the UID of the rule and do show access-rule to get the detail then spit them out. Should give you a good start, If I get more time this week I'll look at it more to get better detail of what you are asking for, but I hope this is something you can start work with and tweak.

Re: Script that collects specific policies into csv/xml (R80.20)

Arthur_Nadaryan — Sat, 10 Aug 2019 17:38:49 GMT

So far I've managed to write a script that lists rules that contain a time object along with other minor details (requirements changed).

Currently the "rule will expire in X days" part isn't done.