topic API I/O in API / CLI Discussion

API I/O

cosmos — Tue, 30 Aug 2022 06:47:00 GMT

I'm looking for a way to clone an object group from one R80 SMS to another with minimal effort, and no access to a proper shell. In this environment, I don't have access to another system I could run jq or python or any other code for that matter.

Ideally, I would show group name <object> in the "Command Line" version of the API published in SmartConsole on the source manager, take the output and throw it in the same place on the target manager, with some minor edits to avoid duplicates.

Reality is, unfortunately, far from my imagination. I haven't found a simple way to do this with any output produced by the API without drastically transforming it and building entirely new calls in Postman, because the Output != Input.

There must be a better way?

Re: API I/O

_Val_ — Tue, 30 Aug 2022 07:10:59 GMT

Run a very simple script when output is saved to a file, and then target domain API calls just read it.

Re: API I/O

cosmos — Wed, 31 Aug 2022 01:08:08 GMT

Hi Val

Not sure if I made it clear, there is no access to a proper shell or other system to run jq, python or any other code. Like a well architected, secure environment, the tools that access the controls are locked down and don't have the ability to share clipboards or exfil data for external manipulation, or the ability to run scripts locally (e.g. powershell).

If one could export the contents of a group from the UI it could be imported on the target in SmartConsole OR the API published in the console. We can export the results of a search in Object Explorer, not the contents of a group.

Manually copying the data was the path of least resistance 🙂

Re: API I/O

_Val_ — Wed, 31 Aug 2022 06:40:51 GMT

You lost me completely here. You still should be able to run scripts on the MDS itself, in the expert mode.

Re: API I/O

cosmos — Wed, 31 Aug 2022 22:53:09 GMT

Principle of least privilege. Especially true for contractors, who must often jump through flaming loops of fire to gain access to an elevated shell like bash on an MDS, by sanctioned means anyway 🙂

I was looking for a quick way to get the job done with the tools I had, which are often limited. Since the API is exposed through SmartConsole CLI, it would be great if the output could be readily transposed between systems without running additional code to transform it into a useable format.

Re: API I/O

_Val_ — Thu, 01 Sep 2022 07:23:37 GMT

I understand the notion, but I still do not understand why you are trying to achieve the task the wrong way. Here are some questions:

Do you have admin rights with the SmartConsole?
Do you have admin rights on the laptop where SC is installed?
Is that laptop defined as API client?

Re: API I/O

PhoneBoy — Thu, 01 Sep 2022 16:16:27 GMT

To be clear: what you're asking for isn't necessarily a feature from the API, but rather an implementation of a tool that uses the API (namely the API CLI in SmartConsole).
That said, I am aware that there are some instances where you cannot take the API-level output and re-import it without modifications.

I'm guessing what you want is an RFE and would encourage you to reach out to your local Check Point office with the precise requirements.