Issue with Retrieving Object Details from Checkpoint Management Server API

[Veeraselvam_man]

Hello everyone,

I would like to bring to your attention a challenge we are facing with one of our clients' Checkpoint management server. The server contains of more than 20,000 Network and Service objects. To retrieve rule details categorized by layers, we are utilizing the "show-access-rulebase" API command. The output file from this command contains the object details configured within the rules.

Additionally, we are using the "show-unused-objects" API command to identify unused objects. This means that all objects used within the rules are present in the "show-access-rulebase" API response, while objects not configured within the rules are found in the "show-unused-objects" API response.

However, in the case of this particular client, the "show-unused-objects" API response contains only 114 object details. To overcome this issue, I attempted to use the "show-objects" command within the client's setup. Unfortunately, due to API constraints, the "show-objects" API response only get a maximum of 500 object details. Also, the response indicated a total count of 23,684 objects. So, I have added the "offset" and "limit" parameters in the "show-objects" API, executing multiple calls with different offset values ranging from 0 to 47.

But, all API calls only yielded around 2000+ unique object details, with the remaining values being duplicate entries. I had expected that specifying an offset value of 47 would return only 184 unique objects, but the API response still included 500 object details. (My assumption was that an offset of 0 and a limit of 500 would return object values 1 to 500, and likewise, an offset of 46 and a limit of 500 would return object values 23001 to 23500.)

The API documentation mentions an automatic sort order by Name in ascending order. Also, I have tried including the "order" parameter with the value of "name," but unfortunately, it did not yield the desired results.

Here are the details of the API request:

POST {{server}}/show-objects
Content-Type: application/json
X-chkp-sid: {{session}}
{
"limit" : 500,
"offset" : 47,
"order" : [ {
"ASC" : "name"
} ]
}

I kindly request your assistance in resolving this issue or suggesting an alternative approach to retrieve all object details.

Thank you for your attention.

Best regards,
M. Veeraselvam

[PhoneBoy]

As constructed, your API call will return results from 47 to 547.
To get the results from 23000 to 23499, your offset needs to be 23000.

[Veeraselvam_man]

Thank you, @PhoneBoy 

If I understand correctly, the default offset value of 0 means that we can retrieve objects 1 to 500 in the first call. For the second call, I would need to set the offset value to 501 in order to retrieve objects 501 to 1000. Is my understanding correct?

Additionally, it seems that the order parameter is not required because the API automatically sorts the objects by Name in ascending order. Is that correct?

To get Objects 1 to 500:
POST {{server}}/show-objects
Content-Type: application/json
X-chkp-sid: {{session}}
{
"limit" : 500,
"offset" : 0
}

To get Objects 501 to 1000:
POST {{server}}/show-objects
Content-Type: application/json
X-chkp-sid: {{session}}
{
"limit" : 500,
"offset" : 501
}

To get Objects 23501 to 23618:
POST {{server}}/show-objects
Content-Type: application/json
X-chkp-sid: {{session}}
{
"limit" : 500,
"offset" : 23501
}

Are the above API calls correct, or did I miss anything wrong?

Best regards,
M. Veeraselvam

[Bob_Zimmerman · Accepted solution]

The offset is how many individual objects to skip ahead. It defaults to 0, which skips 0 objects. Limit 500 offset 501 would give you objects 502 through 1001. The 'from' and 'to' in the call result will confirm this for you.

You should use limit 500 offset 500, limit 500 offset 1000, and so on.

[Veeraselvam_man]

Thank you @Bob_Zimmerman , Suggested changes are working fine.

Best regards,
M. Veeraselvam

[Veeraselvam_man]

Thank you @PhoneBoy 

Best regards,
M. Veeraselvam

[Veeraselvam_man]

Does anyone know why the "show-unused-objects" API call is not returning the complete list of unused objects on GAIA OS 81.10? Are there any known issues in this version?

Best regards,
M. Veeraselvam

[Hugo_vd_Kooij]

Not sure what you are asking here. As it looks like you didn't read any of the above. So please be more clear in your question.

[Veeraselvam_man]

Sorry for the confusion @Hugo_vd_Kooij . In this thread, I have two questions. First, why does the "show-unused-objects" API command output only contain 100+ unused objects when there are actually more than 15,000 unused objects available? Second, regarding the "show-objects" API offset, I received some comments and suggested changes that are working fine in our client environment. However, I haven't received an answer for the first question yet.

Best regards,
M. Veeraselvam

[Hugo_vd_Kooij · Accepted solution]

I think that answer is given but not noted. There is a limit on the number of object returned. Throughout the API pages you will find :

limit

integer Default: 50 Description: 1-500

The maximal number of returned results.

So it seems that question was answered implicitly.