I have a problem with the Check Point API that for some reason does not show me all the information that is in logic change, specifically when a rule is created in the Firewall in the SmartConsole application it shows me that I created the rule and I see that it was configured in the new rule as Source Address, Destination, VPN, ActionSettings.action.
This is what appears in SmartConsole
Logic Changes:
And This is what I get with the CheckPoint API to see the logs
{
"session_name": "micasita@17/6/2024",
"subject": "Object Manipulation",
"session_uid": "bd5711c1-fb22-4dec-84ee-1aee2d7076ac",
"sendtotrackerasadvancedauditlog": "0",
"type": "Audit",
"orig_log_server_attr": [
{
"isCHKPObject": "true",
"uuid": "58888ca8-4ac6-0f4a-9a6b-90aa1e32969c",
"resolved": "BI-DC"
}
],
"uid": "1c5a3310-a212-49d9-9393-93a44a634089",
"administrator": "micasita",
"client_ip": "192.168.1.1",
"id": "0a01641e-6f9c-670e-6670-484e00130001",
"objecttype": "Access Control Rule",
"fieldschanges": [
"Policy Names: 'Policies_BI'",
"Layer Name: 'Network'"
],
"logic_changes": [
"TrackSettings.useLogPerConnection: Changed from 'Disable' to 'Enable'",
"TrackSettings.track: Changed from '29e53e3d-23bf-48fe-b6b1-d59bd88036f9' to '598ead32-aa42-4615-90ed-f51a5928d41d'"
],
"severity": "Informational",
"product_family": "Network",
"product": "SmartConsole",
"sequencenum": "2",
"objectname": "CONFIGURATION",
"operation": "Create Rule"
}
As you can see in logic_changes in JSON format not all changes are shown, it only shows me two and the rest are not sent through the API for some reason.
Can anyone tell me why this happens and how I can get all the complete audit logs through the API?
Thank you and have a nice day.