Fetching PCAP via API in R80.30 JHF 111

[Tim_Otis]

Howdy. 

With JHF 111 for R80.30 we can now fetch pcaps associated to threat prevention alerts (IPS/AB/etc) via API!

Handy for SOCs and IR teams.

Basically:
1. Log Exporter was modified to send an Attachment ID.
2. That Attachment ID can be leveraged via the get-attachment API call to fetch the goods.

Wanted to share the attached python script (in .7z + screenshot) as an example.

Tim Otis - Check Point Incident Response Team

[Kim_Moberg]

Pretty need. Thanks for sharing

[Jon_Goldman]

Nice!

[Norbert_Anderss]

Hi

I'm using a MDM-MLM setup.

If a pcap file must be fetched via an API, will the pcap request go to a particular CMA or a CLM?

/Norbert

[Tim_Otis]

Hi, It will be an API connection to the management server.

[Tomas_Vobruba]

Hello Tim, could you  specify on which version of python it is working? Thank you

[Lithin_Mathew]

Hi @Tim_Otis ,

Thanks for sharing this script.

Could you confirm how would I get the "LOG_ATTACHMENT_UID".

[PhoneBoy]

Believe it's in the log entry itself.