topic Extract the group members with mgmt_cli show access-rulebase in API / CLI Discussion

Extract the group members with mgmt_cli show access-rulebase

Yordan_Cvetkov — Tue, 14 Feb 2023 04:49:11 GMT

Hello Experts,

With the command below I am able to extract the members of the network groups in the source and the destination of the rule.

mgmt_cli show access-rulebase -d xxx.xxx.xxx.xxx offset 0 limit 1 name "Network" details-level "full" use-object-dictionary true show-hits true --format json

My problem is I see the members with their UIDs:

"members" : [ "eac74afb-0f30-4406-8024-4e304094d9c9", "895aed67-7011-46a7-9d42-9e78797301ed", "5ad03019-82c4-4ffb-970d-d0fa3b78adde", "5f5c1f2b-d7de-44e4-aee0-679544b0f8a2", "1b60d48f-9e2c-47e2-80bf-18529eae86d5", "cc9bc8e6-cee6-41e0-a7f9-068d47974b26", "ce76b961-6a85-479e-809b-4807e91aba94" ],

Is it possible to get more details for the members like Name, Type, IP, Subnet, etc... ?

Re: Extract the group members with mgmt_cli show access-rulebase

PhoneBoy — Tue, 14 Feb 2023 14:47:24 GMT

I believe what the UIDs translate to are in the output of the API call when you say object-dictionary true.
Even so, you may need to parse the individual "members" to get the full details you want.
You can see some discussion about this fact here: https://community.checkpoint.com/t5/API-CLI-Discussion/How-to-list-and-export-the-objects-member-from-the-network-group/m-p/76422

Re: Extract the group members with mgmt_cli show access-rulebase

Yordan_Cvetkov — Tue, 14 Feb 2023 15:34:36 GMT

Thank you @PhoneBoy for your reply.

So there is no single command to produce all I need.

Re: Extract the group members with mgmt_cli show access-rulebase

PhoneBoy — Tue, 14 Feb 2023 19:07:05 GMT

The closest thing you can do with a single command is to add show-as-ranges true to your command line argument.
This will convert the source, destination, and service to ranges (either IPs or ports).
Depending on your precise purpose, that might be exactly what you need.