topic Re: Find status of IPS based on CVE identifiers? in API / CLI Discussion

Find status of IPS based on CVE identifiers?

Hugo_vd_Kooij — Mon, 21 Mar 2022 13:48:45 GMT

I have a re-occuring need to use the API to find the status of a particular CVE protection and find it for many customers.

But from the API manuals I have not been able to find a way to obtain that information. Am I missing something in the manual or is it not implemented in the API?

What would be the best way to find the status of CVE-2021-44228 with the API for example?

Regards, Hugo.

Re: Find status of IPS based on CVE identifiers?

G_W_Albrecht — Mon, 21 Mar 2022 15:55:51 GMT

You can show protections with name or uid as reference only:

mgmt_cli show threat-protection name "FTP Commands"

listing the details like

protection-type: "Core"

follow-up: false

industry-reference:

- "CAN-2002-0610"

- "CAN-2001-0755"

- "CAN-2002-0606"

- "CAN-2001-0263"

You would have to cycle thru all UIDs and build a list...

Re: Find status of IPS based on CVE identifiers?

Timothy_Hall — Mon, 21 Mar 2022 18:41:35 GMT

As noted in my IPS/AV/ABOT Immersion class below, certain IPS Protection fields are not searchable from the SmartConsole, which almost certainly means they are not searchable through the API either. Unfortunately you'd have to iterate through all the protections like Gunter mentioned to search for the CVE that way.

Re: Find status of IPS based on CVE identifiers?

Art_Zalenekas — Mon, 21 Mar 2022 19:38:12 GMT

It depends what you want to look at, but starting MGMT API version 1.6 (R80.40) you can use filter parameter. This call will show you all that you need to know. Take out the show-ips-additional-properties and/or show-profiles parameters if you don't need their outputs. E.g.:

https://sc1.checkpoint.com/documents/latest/APIs/#cli/show-threat-protections~v1.6%20

# mgmt_cli -r true show threat-protections filter 'CVE-2021-44228' limit 1 details-level full show-ips-additional-properties true show-profiles true -f json

Good luck!

Re: Find status of IPS based on CVE identifiers?

Hugo_vd_Kooij — Wed, 23 Mar 2022 16:10:05 GMT

I found the cause. I used login seperatly but on the wrong domain. Took the wrong script as template and forgot all about the domain in the login. (It was the script to add all of our employees that need access to the list of administrators. But that is no the domain you usualy work in.

So I need to do some clever scripting now to fecth the right list and parse them for a loop.

Re: Find status of IPS based on CVE identifiers?

Timothy_Hall — Sat, 22 Apr 2023 16:51:03 GMT

Just to follow up on this old thread, for IPS Protections the "Industry Reference" field which normally contains CVE numbers is now searchable in the latest versions of the R81.10 SmartConsole and R81.20 GA. Date-related fields such as Release Date, Update Date, and Threat Year are still not searchable.