topic Re: Automatic rule coding using OPSEC in General Topics

Automatic rule coding using OPSEC

Kishorilal_CJ — Wed, 24 Jan 2018 12:51:05 GMT

Hello

we are well aware that R80.10 has got API to perform multiple automation stuffs, whereas we are looking for something in R77.30 , since it takes sometime for us to upgrade the version to R80.10 and I just wanted to check if any possibilities of adding the policy rules from Tufin tool(as one of the approved OPSEC product), to check point policy database, when communication from checkpoint to tufin is possible

thanks in adavnce

Re: Automatic rule coding using OPSEC

PhoneBoy — Sat, 27 Jan 2018 06:25:56 GMT

The OPSEC API does have ways to modify the rulebase.

Heck, I wrote scripts to modify the rulebase with dbedit

I believe Tufin can do this, but you should check with them on the specifics.

Re: Automatic rule coding using OPSEC

Kishorilal_CJ — Mon, 29 Jan 2018 05:22:15 GMT

Thank you for your comments.. would you please share the script link

Re: Automatic rule coding using OPSEC

PhoneBoy — Mon, 29 Jan 2018 05:45:49 GMT

The scripts I wrote were for specific customers.

Most of the specific are covered in the R77 CLI Guide: Command Line Interface R77 Reference Guide

Keep in mind that while modifying existing rules with dbedit is relatively straightforward, adding a new rule is not since it requires multiple delete/add operations.

The R80 APIs have significantly improved APIs for rulebase manipulation.

Re: Automatic rule coding using OPSEC

JozkoMrkvicka — Fri, 21 Jun 2019 09:12:49 GMT

Hi Dameon Welch-Abernathy‌,

Do you remember if the script you wrote using dbedit included also LDAP user groups ? I am struggling how can I add new LDAP group to the existing rule via dbedit (R77.30).

https://community.checkpoint.com/message/35147-r7730-adding-ldap-group-to-the-existing-rule-using-dbedit

Re: Automatic rule coding using OPSEC

PhoneBoy — Fri, 25 Jan 2019 01:27:54 GMT

I did not do that in any of my scripts, but will see if I can get someone from R&D to help on the thread you pointed me at.

Re: Automatic rule coding using OPSEC

JozkoMrkvicka — Fri, 25 Jan 2019 08:43:26 GMT

Thank you very much