topic Re: Show changes from session => from a single session in API / CLI Discussion

Show changes from session => from a single session

Maik — Wed, 27 Mar 2019 14:48:42 GMT

Hello guys,

I want to write a small script that lists all the created, deleted and modified rules and host objects for a given session/revision uid. The management API reference guide includes two possible commands that should do the job:

- show session uid <session_uid>

>> This lists all the general details of a session like e.g. the user, the change sum, the description, the application that has been used in order to publish the given session etc. Here everything is working as expected

- show changes from-session <session_uid> to-session <session_uid>

>> This command lists all changes in a given time or session frame... so this means I can use the above mentioned "from-session" => "two-sessions" arguments or the "from-date" => "to-date" arguments. However it seems like that it is not possible to list all changes from just one single session. The seemingly required arguments have default values if no UIDs for the sessions are specified:

from-session

string
Default: The session before to-session

to-session

string
Default: The last published session

But here lays another problem - as the from-session defaults to "the session before to-session" while the to-session argument defaults to "the last published session", this leads to the result that the command gives you the last two sessions if you do not specify any arguments. Still, it does not allow you to just see the changes from a single session. My idea was to give the from and to argument the same session uid, but this results in the following error:

> show changes from-session <my_session_uid1> to-session <my_session_uid1>

---------------------------------------------
Time: [15:43:07] 27/3/2019
---------------------------------------------
"Show Changes"  failed  (100%)  
tasks: 
- task-id: "abcdef01-2345-6789-b58a-3559264bf1dc"
  task-name: "Show Changes"
  status: "failed"
  progress-percentage: 100
  progress-description: "Diff operation failed: Unable to build the diff reply."
  suppressed: false

So the command requires a diff in between both parameters while a simple "show changes from-uid" or "show changes uid" does not exist. Do I miss something or is there really no possibility to track the changes of a given single session?

Regards,

Maik

Re: Show changes from session => from a single session

Adam_Forester — Wed, 27 Mar 2019 16:46:19 GMT

Maik,

if you just run 'show changes' it will compare the last published session vs the session prior to it. Which would show you the changes of the last published session. I just tested it after adding a single network and publishing;

mgmt_cli -r true show changes

---------------------------------------------

Time: [07:25:43] 27/3/2019

---------------------------------------------

"Show Changes" succeeded (100%)

tasks:

- task-id: "abcdef01-2345-6789-81ad-4d56c2e27f11"

task-name: "Show Changes"

status: "succeeded"

progress-percentage: 100

progress-description: "Operation Complete"

suppressed: false

task-details:

- limit: 10

offset: 0

from: 1

to: 2

total: 2

changes:

- session:

session-uid: "5ca78a82-4e2b-4315-ab73-7fede5598e81"

user-name: "WEB_API"

publish-time:

posix: 1553689514200

iso-8601: "2019-03-27T07:25-0500"

domain-info:

uid: "41e821a0-3720-11e3-aa6e-0800200c9fde"

domain-type: "domain"

operations:

added-objects:

- uid: "3f8fde7a-077b-4ab3-ae45-cac29e36a20a"

type: "network"

domain:

uid: "41e821a0-3720-11e3-aa6e-0800200c9fde"

domain-type: "domain"

subnet4: "1.1.1.0"

mask-length4: 24

subnet-mask: "255.255.255.0"

modified-objects: []

deleted-objects: []

Re: Show changes from session => from a single session

Maik — Wed, 27 Mar 2019 17:48:39 GMT

Hello Adam,

Thanks for your reply and suggestion. But this still does not allow me to view the changes of a specific given session - it just lists the last one. This is a step in the direction that I am aiming for but still not the actual goal.

Maybe some background; I have created a script that validates some management CLI strings and gives you feedback on found errors or just says that the string is okay to push if no errors are found. In the end you will receive a list of all created objects (access rules + their related policies to be pricise) as well as a string and the revision id that can be copy pasted into a change ticket that is linked to the changes. Now I want to create an additional script that should allow an "easy review" of a given change by just giving the session (or revision) uid as a parameter in order to do a "four eyes check" of the changes via the cli and not the smartconsole. Thats why I require the change uid of not the latest session, or of multiple sessions but just one specific one.

Best regards,

Maik

Re: Show changes from session => from a single session

PhoneBoy — Thu, 28 Mar 2019 01:19:23 GMT

What you're describing might be better accomplished with SmartTasks, a feature we are launching later this year.
You'll be able to trigger an action when someone attempts to publish a session.(e.g. Run a script).

Re: Show changes from session => from a single session

Adam_Forester — Thu, 28 Mar 2019 19:55:25 GMT

Got ya. PhoneBoy is right on the task piece. Saw that at CPX and it was very very nice. But I get what you are trying to do, let me chew on that this weekend and get back to you

Re: Show changes from session => from a single session

Maik — Thu, 28 Mar 2019 20:06:14 GMT

Thanks PhoneBoy and Adam 🙂

Especially for thinking over it again on the weekend. Would be great to find a solution - even if it will be a little bit more trickier to achieve than with just running one api call. Have a great weekend and looking forward to hearing from you.

By the way, as it is possible to paste a session uid into the audit log in order to receive all required objects it should be possible with the api as well I guess? Maybe I could use the generic object api somehow... but I need to dig deeper into the usage of it as I have zero experience regarding generic api call so far.

Re: Show changes from session => from a single session

Adam_Forester — Fri, 29 Mar 2019 13:49:04 GMT

I think I got it... I tested a few different session in the lab this morning and it did what I think you want.

If you run: mgmt_cli show changes to-session UID

Then it will compare the session to the previously published session right before it. I know it seems really backwards but if you read the API guide it is oddly worded that way. If you don't specify the 'from-session' then it defaults: The session before to-session

Make sure to set your details-level to get the detail you want

Re: Show changes from session => from a single session

Ron_Izraeli — Sat, 30 Mar 2019 17:33:59 GMT

Following the upcoming release of R80.30, we will publish the 'Changes Report' SmartConsole extension which uses the show-changes API command to visualize single session (private/published) changes.

The extension source code would be published as well in our GitHub repository post its release.

Check out How to extend and enhance SmartConsole?

Re: Show changes from session => from a single session

Ivan_Eriksen — Tue, 21 Jan 2020 08:05:59 GMT

The smartconsole extension looks very interesting - R80.30 has been out for some time now, is there any chance you could release the code for this extension?

Re: Show changes from session => from a single session

Simon_Macpherso — Wed, 01 Apr 2020 02:06:19 GMT

Hi, when will this be published on the GitHub repository?

Re: Show changes from session => from a single session

PhoneBoy — Wed, 01 Apr 2020 02:29:57 GMT

From what I can tell (at least on the link I have), this report only shows changes you've made in the current unpublished session and NOT, say, the delta between one session and another.
Not sure if that was the final GA version, though, I will have to check.

Re: Show changes from session => from a single session

Simon_Macpherso — Wed, 01 Apr 2020 02:46:21 GMT

I would be needing to view the delta changes between the most recent and last published session.

Regards,

Simon

Re: Show changes from session => from a single session

JozkoMrkvicka — Wed, 01 Apr 2020 06:07:41 GMT

or, even better, to show all changes between 2 selected time period.

Like all changes (NOT done only by me, instead by all admins (maybe report the name of admin) ) performed from 30.3.2020 10:00 till 1.4.2020 08:00. This makes the idea perfectly fit, also for auditing purposes.

Re: Show changes from session => from a single session

Timothy_Hall — Wed, 01 Apr 2020 13:27:39 GMT

There is no succinct report that will show all changes between two published sessions. However what you can do is look at the individual Audit Logs for all sessions published between two particular sessions. This is described in Part 3 of my article R80+ Change Control: A Visual Guide.

Another thing you could try is bringing up the raw Audit Log as described in Part 4, then implement a date range filter spanning the time period between the two sessions you want to compare. Once again this would just be looking at individual Audit Logs and not a nice report as shown earlier in this thread.

Re: Show changes from session => from a single session

Nurit_Gr — Thu, 02 Apr 2020 07:54:39 GMT

Hi Maik, everyone,

We haven't released Changes Report extension officially yet since we are creasing out a few last issues.

In the meantime you are invited to start using it and provide us with your feedback.

In order to install it, please follow the below instructions:

1. On SmartConsole, got to Manage & Settings > Preferences > SmartConsole Extensions > +.

The “Import SmartConsole Extension…” window opens.

Enter the web-service manifest URL for the manifest file:

https://extensions.checkpoint.com/changes-report/extension.json

Click ‘OK’.

2. A verification message will pop-up – press ‘OK’.

The extension is now installed.

“Changes” button will appear at:

The upper toolbar in Security Policies tab and in Gateways and Servers tab - showing changes performed in the current private session
The upper toolbar in Manage & Settings > Sessions > Session view - showing the changes performed in the selected session
A “Changes” menu will appear at the upper toolbar in Manage & Settings > Sessions > Revisions view. It allows you to compare the selected revision with its previous, or with the current revision.

The extension is supported on top of R80.30 and up.

Let me know what you think 🙂

Re: Show changes from session => from a single session

Kevin_Orrison — Wed, 22 Apr 2020 14:36:46 GMT

I just installed the extension. I make a few changes in policy, then click the "Changes" button and the page that comes up is blank. Am I missing something? R80.30

Re: Show changes from session => from a single session

Nurit_Gr — Wed, 22 Apr 2020 15:25:10 GMT

Hi,

We are currently having an issue with the latest update of the extension.

I'll update once it will be resolved.

Sorry for the inconvenience.

Re: Show changes from session => from a single session

Nurit_Gr — Mon, 27 Apr 2020 08:48:33 GMT

Hi,

Issue is now resolved.

Please contact me if you have additional issues.

Sorry for the inconvenience.

Re: Show changes from session => from a single session

Kevin_Orrison — Mon, 27 Apr 2020 14:40:22 GMT

It looks like it tries to load, but then I get this: "Error: Unable to retrieve read-only session"

Re: Show changes from session => from a single session

Nurit_Gr — Mon, 27 Apr 2020 15:04:07 GMT

Hi,

Are you using a standalone environment? extensions are not supported on it.

If not, please verify that the correct ip is configured on your management object.

Also try to login to SmartConsole using the server ip instead of name.

If all of the above doesn't help - please send me SmartConsole and server logs (cpm, fwm and api) so that we can investigate.