- Products
- Learn
- Local User Groups
- Partners
-
More
Join Us for CPX 360
23-24 February 2021
Important certificate update to CloudGuard Controller, CME,
and Azure HA Security Gateways
How to Remediate Endpoint & VPN
Issues (in versions E81.10 or earlier)
IDC Spotlight -
Uplevel The SOC
Important! R80 and R80.10
End Of Support around the corner (May 2021)
In the REST API, there is a function called show-session that gives the details for a specific session uid. What parameter (or what logic is used) to determine if the session is 'disconnected' as seen in SmartConsole:
I originally thought it would be 'connection-mode', however, when I query the 'Disconnected' sessions, the connection-mode is 'read write'.
The api documentation says the only valid values for 'connection-mode' are: read write, read only, read write with global lock, read write with global lock
Please help me figure out which parameter or which logic is used to determine the session being in 'Disconnected' state. Thanks!
If "state" is "open" and "in-work" is "False", then the session is disconnected.
Robert.
Perhaps expired-session is equal to true?
this should be correct.
Dameon Welch Abernathy, Robert Decker, for context, the problem I am trying to solve is detailed out here...
In my attempt last week to solve this, I tried expired-session as i thought that might be it, so I wrote code that checks first if session-expired is 'False'. If 'False', I then check if either string 'write' or 'lock' exists in 'connection-mode'.
However, I've found one instance where expired-session is set to 'False', yet the session still shows as disconnected in SmartConsole. It seems to have been logged out for a couple months. Is this a bug?
Here is the json for the session object in question. It corresponds to the top line in the picture from SmartConsole in the main post above. I've removed the content of some fields and replaced them with <removed>.
{
u 'domain': {
u 'domain-type': u 'domain',
u 'uid': u '<removed>',
u 'name': u 'SMC User'
},
u 'uid': u '<removed>',
u 'color': u 'black',
u 'in-work': False,
u 'locks': 0,
u 'ip-address': u '<removed>',
u 'read-only': False,
u 'comments': u '',
u 'last-logout-time': {
u 'posix': 1529415069219,
u 'iso-8601': u '2018-06-19T09:31-0400'
},
u 'application': u 'SmartConsole',
u 'state': u 'open',
u 'session-timeout': 600,
u 'type': u 'session',
u 'email': u '',
u 'description': u '',
u 'tags': [],
u 'connection-mode': u 'read write',
u 'icon': u 'Objects/worksession',
u 'user-name': u '<removed>',
u 'last-login-time': {
u 'posix': 1529415066670,
u 'iso-8601': u '2018-06-19T09:31-0400'
},
u 'expired-session': False,
u 'meta-info': {
u 'creation-time': {
u 'posix': 1529415066702,
u 'iso-8601': u '2018-06-19T09:31-0400'
},
u 'validation-state': u 'ok',
u 'creator': u '<removed>',
u 'lock': u 'unlocked',
u 'last-modifier': u '<removed>',
u 'last-modify-time': {
u 'posix': 1529415069221,
u 'iso-8601': u '2018-06-19T09:31-0400'
}
},
u 'phone-number': u '',
u 'changes': 0
}
Phillip,
The information displayed in SmartConsole Sessions view in "Connection Mode" column is dynamic and is calculated on server side.
The information returned by API command is static from a specific database object.
I'll ask the server team guys which fields from API reply can provide the information you are looking for.
Robert.
Thanks! All I'm really trying to do is, in an automated way, determine if it is safe to do a migrate export. I appreciate your assistance.
If "state" is "open" and "in-work" is "False", then the session is disconnected.
Robert.
About CheckMates
Learn Check Point
Advanced Learning
WELCOME TO THE FUTURE OF CYBER SECURITY