MDS - Global search across CMAs (by IP)

[Adam_Forester]

I was asked to post this publicly. This is something I wrote for one of my accounts to be able to search across all CMAs for an IP address. It's a really straight forward function. The script crawls your domains and creates a search function script that it executes which then searches each CMA for that IP and outputs it to a single file in JSON format.

Depending on feedback I could easily update this to make a CSV or other format. It also would be very easy to add an option to lookup by name to the script as well.

Since this is a search by IP it will also list objects like subnets, ranges, etc that the IP can be a part of as well as group membership.

Feedback always welcome!

https://github.com/WadesWeaponShed/Global-IP-Search-MDS

[_Val_]

Nicely done, @Adam_Forester !

[Martin_Valenta]

With r77.30 there was option to search for object accross all CMA's from MDS, shouldn't it be included too on R80.x on GUI (not just via API)?

[Richie]

Hi Adam ,

I want to know if  you are use this in python with json program or different programs 

[Tomer_Noy]

Nicely done!

It's worth mentioning that this script is useful for R80.x versions. In R81 we added cross-domain search capabilities from the System domain. You can use that functionality from API or from the UI. 

You can find more details in the documentation: https://sc1.checkpoint.com/documents/R81/WebAdminGuides/EN/CP_R81_Multi-DomainSecurityManagement_Adm... 

One of the main benefits of using the built-in feature in R81 is that it's much more efficient than iterating over the domains.

[JozkoMrkvicka]

I didnt try it yet, but I have following questions/suggestions:

1. The result can be exported to CSV for better handling ?

2. Can I select which CMA(s) I would like to inspect from System domain? I mean, I dont want to search all CMAs, but only specific ones (one selected CMA, multiple selected CMAs) . Of course I can manually log into that one (or more) CMAs to search for something, but better way would be to have such an option from System domain to select CMA(s).

thank you.

[jo-xxx]

Hey Tomer, how do I use the cross-domain search with the mgmt_cli API? Which domain do I need to login to?

[Tomer_Noy]

You should run it from the System Domain.

See this from the documentation:
https://sc1.checkpoint.com/documents/latest/APIs/#cli/show-objects~v1.9%20

[jo-xxx]

Thanks, I logged in with -d "System Data" and finally managed to get results with my where-used command:

mgmt_cli where-used name "ABC" domains-to-process.1 "ALL_DOMAINS_ON_THIS_SERVER" ignore-warnings true