topic Will drafting be logged? in General Topics

Will drafting be logged?

GeorgeF — Mon, 04 Nov 2024 01:15:16 GMT

Hi Experts,

Our company is using SmartConsole and we have some administrators, the version is 81.20 HF T26.

We have restrict policy that doesn't allow making any changes during business hours to avoid any possible outage.

My doubt is, if I just did some drafting, like creating or modifying some objects/rules, or discarding the changes, I didn't publish or install, will it be logged in the audit logs?

I have read the https://sc1.checkpoint.com/documents/R81.20/WebAdminGuides/EN/CP_R81.20_LoggingAndMonitoring_AdminGuide/CP_R81.20_LoggingAndMonitoring_AdminGuide.pdf

But it didn't have more details about the audit logs.

I remember that our last version is R80.40, it will record some 0 changes audit logs, but it looks in current version, it didn't generate any audit logs if I discard the drafts and didn't publish it.

The purpose it to edit during the business hours,(discard if don't really need it), so after hours I can just publish and install, and testing.(that will save much time).

I think drafting won't make any actual changes, or impact anything, and it shouldn't be logged/audited, is it?

Thanks

Re: Will drafting be logged?

the_rock — Mon, 04 Nov 2024 01:54:27 GMT

Im pretty positive that is the case, because I tested that in R81 base, R81.10, R81.20 and even in R82 and every time I made changes, discarded them, checked audit logs, there was no record of anything I discarded.

Andy

Re: Will drafting be logged?

Tal_Paz-Fridman — Mon, 04 Nov 2024 07:01:29 GMT

Audit Logs are created when the session is published.

BTW consider using SmartWorkflow for creating a session with changes and sending for approval:

https://sc1.checkpoint.com/documents/R82/WebAdminGuides/EN/CP_R82_SecurityManagement_AdminGuide/Content/Topics-SECMG/Session-flow-for-Administrators.htm#ApprovalCycle

Re: Will drafting be logged?

PhoneBoy — Mon, 04 Nov 2024 17:39:43 GMT

The only change a session makes prior to publish is that any rules or objects modified as a result of the session are locked.
Specifically, this means those rules/objects cannot be modified until the session is published or discarded.
As @Tal_Paz-Fridman said, only published sessions show in the Audit logs.