topic Re: MDS - Global search across CMAs (by IP) in API / CLI Discussion

MDS - Global search across CMAs (by IP)

Adam_Forester — Thu, 20 Feb 2020 15:13:13 GMT

I was asked to post this publicly. This is something I wrote for one of my accounts to be able to search across all CMAs for an IP address. It's a really straight forward function. The script crawls your domains and creates a search function script that it executes which then searches each CMA for that IP and outputs it to a single file in JSON format.

Depending on feedback I could easily update this to make a CSV or other format. It also would be very easy to add an option to lookup by name to the script as well.

Since this is a search by IP it will also list objects like subnets, ranges, etc that the IP can be a part of as well as group membership.

Feedback always welcome!

https://github.com/WadesWeaponShed/Global-IP-Search-MDS

Re: MDS - Global search across CMAs (by IP)

_Val_ — Thu, 20 Feb 2020 15:24:06 GMT

Nicely done, @Adam_Forester !

Re: MDS - Global search across CMAs (by IP)

Martin_Valenta — Mon, 24 Feb 2020 09:26:23 GMT

With r77.30 there was option to search for object accross all CMA's from MDS, shouldn't it be included too on R80.x on GUI (not just via API)?

Re: MDS - Global search across CMAs (by IP)

Richie — Wed, 31 Mar 2021 20:29:14 GMT

Hi Adam ,

I want to know if you are use this in python with json program or different programs

Re: MDS - Global search across CMAs (by IP)

Tomer_Noy — Thu, 01 Apr 2021 20:23:22 GMT

Nicely done!

It's worth mentioning that this script is useful for R80.x versions. In R81 we added cross-domain search capabilities from the System domain. You can use that functionality from API or from the UI.

You can find more details in the documentation: https://sc1.checkpoint.com/documents/R81/WebAdminGuides/EN/CP_R81_Multi-DomainSecurityManagement_AdminGuide/Topics-MDSG/Cross-Domain-Search.htm

One of the main benefits of using the built-in feature in R81 is that it's much more efficient than iterating over the domains.

Re: MDS - Global search across CMAs (by IP)

JozkoMrkvicka — Fri, 02 Apr 2021 07:04:14 GMT

I didnt try it yet, but I have following questions/suggestions:

1. The result can be exported to CSV for better handling ?

2. Can I select which CMA(s) I would like to inspect from System domain? I mean, I dont want to search all CMAs, but only specific ones (one selected CMA, multiple selected CMAs) . Of course I can manually log into that one (or more) CMAs to search for something, but better way would be to have such an option from System domain to select CMA(s).

thank you.

Re: MDS - Global search across CMAs (by IP)

jo-xxx — Thu, 17 Aug 2023 09:23:32 GMT

Hey Tomer, how do I use the cross-domain search with the mgmt_cli API? Which domain do I need to login to?

Re: MDS - Global search across CMAs (by IP)

Tomer_Noy — Thu, 17 Aug 2023 09:59:38 GMT

You should run it from the System Domain.

See this from the documentation:
https://sc1.checkpoint.com/documents/latest/APIs/#cli/show-objects~v1.9%20

Re: MDS - Global search across CMAs (by IP)

jo-xxx — Thu, 17 Aug 2023 11:17:27 GMT

Thanks, I logged in with -d "System Data" and finally managed to get results with my where-used command:

mgmt_cli where-used name "ABC" domains-to-process.1 "ALL_DOMAINS_ON_THIS_SERVER" ignore-warnings true