topic Re: How to list and export the objects member from the network group in checkpoint management server in API / CLI Discussion

How to list and export the objects member from the network group in checkpoint management server

Rabindra_Khadka — Wed, 26 Feb 2020 06:48:19 GMT

Hello everyone,

We need to list all the objects members along with the name and IP-Address from the particular network group to the CSV format. The checkpoint management server is in R80.20 version. Is there any way from commandline or others to exports the object members along with the name and ip address from the particular network group in csv format.

Please help if there is any solution.

@phoneboy

Thanks

Re: How to list and export the objects member from the network group in checkpoint management server

Vincent_Bacher — Wed, 26 Feb 2020 07:27:14 GMT

Hi,

i am not Phoneboy but nevertheless i take the liberty to answer 😊

I'd suggest to have a look at the R8x-export-import-api-scripts on GitHub.

Cheers
Vincent

Re: How to list and export the objects member from the network group in checkpoint management server

Rabindra_Khadka — Wed, 26 Feb 2020 09:27:11 GMT

thanks vincent,

but is there documents or process to follow to run this script

Re: How to list and export the objects member from the network group in checkpoint management server

Danny — Wed, 26 Feb 2020 10:52:40 GMT

Consider using JSON over CSV format for exporting group contents that can be nested (groups within groups).

Use the following command on expert mode of your SmartCenter Server to export the first 500 members of a group object:

mgmt_cli login -r true show group name [GROUP] –format json details-level full offset 0 limit 500 –port 443

Re: How to list and export the objects member from the network group in checkpoint management server

Rabindra_Khadka — Wed, 26 Feb 2020 15:35:20 GMT

Thanks Danny

let me try this one. i will update you regarding this.

Re: How to list and export the objects member from the network group in checkpoint management server

PhoneBoy — Wed, 26 Feb 2020 21:51:01 GMT

With the correct command, it's not difficult to get CSV output:

mgmt_cli -r true show-group name "groupname" --format json | jq '.members[] | [.name, ."ipv4-address"] |@csv' -r

Just to explain:

mgmt_cli -r true is how you can utilize the API from a CLI (-r true means "login as root user" which only works on the local management server)
show-group is the API command for showing a specific group specified by the name parameter.
--format json tells mgmt_cli to output the data in JSON format.
jq parses the JSON output from mgmt_cli, in this case pulling out the all the "name" and "ipv4-address" entries from members and outputting to CSV.

Re: How to list and export the objects member from the network group in checkpoint management server

Rabindra_Khadka — Thu, 27 Feb 2020 06:00:26 GMT

Thanks Phoneboy

this is what i am looking for

Re: How to list and export the objects member from the network group in checkpoint management server

Darren_Fishwick — Fri, 29 May 2020 15:29:53 GMT

Hi i have been testing this and all looks really good. However what does the @csv command do at the end

i.e. mgmt_cli -r true show-group name "groupname" --format json | jq '.members[] | [.name, ."ipv4-address"] |@csv' -r

I was expecting a csv file to be created but i cant find it

Thanks

Re: How to list and export the objects member from the network group in checkpoint management server

PhoneBoy — Fri, 29 May 2020 19:20:19 GMT

Normally jq will output results in JSON format.
@csv will convert the output to CSV.
If you want it to a file, you'll have to pipe the output from the command to a file.

Re: How to list and export the objects member from the network group in checkpoint management server

Darren_Fishwick — Mon, 01 Jun 2020 07:06:55 GMT

Thank you for the update
Regards

Re: How to list and export the objects member from the network group in checkpoint management server

JED — Wed, 24 Feb 2021 09:39:07 GMT

Hi, I'm new to checkpoint this week and have some issues with the R80.30 platform. I have a need to extract the members ( hostname and ipv4) details from certain groups ( some seem to have more than a couple of hundred entries) from specific groups. I have navigated to the respective Group and indeed a .csv is produced. The only issue is that the .csv output only contains (from memory) the last modified date with the respective user name of who made the last change. I now need a method to extract the members and have found this article. Now I have no test env to test your suggested commands. Can you confirm that these are non intrusive to any normal operations and will give me the correct outputs.

Is this command executable from the "admin" account ?

Hi Phoneboy,

I'm making some further extractions from the Db from the specific Network Group called "GP_WinUpdates_Exceptions".

I run the following and get the output shown:-

"mgmt_cli -r true show-group name "GP_WinUpdates_Exceptions" offset 500 --format json | jq '.members[] | [.name, ."ipv4-address"] |@csv' -r

I get the following error: can you please advise on what may be the issue please?

"jq: error: Cannot iterate over null"

Re: How to list and export the objects member from the network group in checkpoint management server

PhoneBoy — Wed, 18 Nov 2020 21:39:13 GMT

These are read-only commands and shouldn't cause any issues.
That said, if you want to try and rehearse this in an entirely test environment, you can do this and more using the Automation and Orchestration lab in CheckMates Labs.

One caveat: if a group has too many items in it, you may have to execute the command multiple times with different offset values.
If I recall correctly, the limit is 500 items, so to get the next 500 items, you'd do:

mgmt_cli -r true show-group name "groupname" offset 500 --format json | jq '.members[] | [.name, ."ipv4-address"] |@csv' -r

Re: How to list and export the objects member from the network group in checkpoint management server

JED — Wed, 02 Dec 2020 09:19:38 GMT

Hi PhoneBoy, The above worked great , I have a further request now which I have tried but had no success with. I need to list the Object Group and as the contained output need the results for the Service Port/ Socket id. Can you please advise on the string that I would need to extract this data. ( We have recently upgraded to R80.40 but again the CSV export from GUI seems not to be working) Your assistance is greatly appreciated. Thanks JED.

Re: How to list and export the objects member from the network group in checkpoint management server

PhoneBoy — Wed, 02 Dec 2020 17:50:46 GMT

The above is for network object groups.
Service groups are a different type, but a similar type of command is used:

mgmt_cli -r true show-service-group name "NBT" --format json | jq '.members[] | [.name, .type, .port] | @csv' -r

Re: How to list and export the objects member from the network group in checkpoint management server

eliascoranti — Wed, 10 Feb 2021 18:11:56 GMT

Is it the same for R80.10, because I can't find the CCV file. Could you please help me ?

Re: How to list and export the objects member from the network group in checkpoint management server

Sec_Boy — Fri, 12 Feb 2021 11:03:23 GMT

am getting below error while phrasing above command.

[Expert@FX:0]# mgmt_cli -r true show-group name "EXT-MOVEiT" --format json | jq '.members[] | [.name, ."ipv4-address"] |@csv' -r >EXT_MOVEiT.json
Logout failed
parse error: Invalid numeric literal at line 1, column 9

API Settings:
---------------------
Accessibility: Require all granted
Automatic Start: Enabled

Processes:

Name State PID More Information
-------------------------------------------------
API Started 31143
CPM Started 16920 Check Point Security Management Server is running and ready
FWM Started 18638
APACHE Started 3908

Port Details:
-------------------
JETTY Internal Port: 50277
APACHE Gaia Port: 4434 (a non-default port)
When running mgmt_cli commands add '--port 4434'
When using web-services, add port 4434 to the URL

--------------------------------------------
Overall API Status: Started

Re: How to list and export the objects member from the network group in checkpoint management server

Sec_Boy — Fri, 12 Feb 2021 11:04:50 GMT

am getting below error while phrasing above command.

parse error: Invalid numeric literal at line 1, column 9
Logout failed

Re: How to list and export the objects member from the network group in checkpoint management server

Kola_CP — Thu, 01 Apr 2021 07:40:27 GMT

Thank you for this.

An additional question if I may...

Is it possible to recursively do this for all the network groups where I have a large number of network groups set up?

Or alternatively to extract all the network group names passing them on to this command to extract for each network group?

Re: How to list and export the objects member from the network group in checkpoint management server

Jan_Z — Thu, 02 Sep 2021 09:21:16 GMT

I need to to the same, where you able to export all your groups?

Re: How to list and export the objects member from the network group in checkpoint management server

PhoneBoy — Mon, 06 Sep 2021 23:35:48 GMT

Sure, it's possible, but you're getting into scripting territory.

Just to explain what's going on here:

We're logging into the API once and saving the session in sid.txt, which we reuse in other commands.
We're querying the API to get all the groups, then showing each one with some specific information (object name, ipv4-address for host objects, network and mask for network objects)

Limitations of the above:

If IPv6 is in use, you will have to adjust the jq command accordingly to output the specific fields you want.
For large numbers of groups or objects in a group, you will have to make multiple calls using limit/offset calls.
This does not handle nested groups (groups inside of groups), which will require additional scripting.