Create a Post
cancel
Showing results for 
Search instead for 
Did you mean: 
BAZUERO
Explorer

Problems with the API when obtaining audit logs

I have a problem with the Check Point API that for some reason does not show me all the information that is in logic change, specifically when a rule is created in the Firewall in the SmartConsole application it shows me that I created the rule and I see that it was configured in the new rule as Source Address, Destination, VPN, ActionSettings.action.
This is what appears in SmartConsole

Logic Changes:

 
 

smartconsole.PNGapi.PNG

And This is what I get with the CheckPoint API to see the logs
{
"session_name": "micasita@17/6/2024",
"subject": "Object Manipulation",
"session_uid": "bd5711c1-fb22-4dec-84ee-1aee2d7076ac",
"sendtotrackerasadvancedauditlog": "0",
"type": "Audit",
"orig_log_server_attr": [
{
"isCHKPObject": "true",
"uuid": "58888ca8-4ac6-0f4a-9a6b-90aa1e32969c",
"resolved": "BI-DC"
}
],
"uid": "1c5a3310-a212-49d9-9393-93a44a634089",
"administrator": "micasita",
"client_ip": "192.168.1.1",
"id": "0a01641e-6f9c-670e-6670-484e00130001",
"objecttype": "Access Control Rule",
"fieldschanges": [
"Policy Names: 'Policies_BI'",
"Layer Name: 'Network'"
],
"logic_changes": [
"TrackSettings.useLogPerConnection: Changed from 'Disable' to 'Enable'",
"TrackSettings.track: Changed from '29e53e3d-23bf-48fe-b6b1-d59bd88036f9' to '598ead32-aa42-4615-90ed-f51a5928d41d'"
],
"severity": "Informational",
"product_family": "Network",
"product": "SmartConsole",
"sequencenum": "2",
"objectname": "CONFIGURATION",
"operation": "Create Rule"
}
As you can see in logic_changes in JSON format not all changes are shown, it only shows me two and the rest are not sent through the API for some reason.
Can anyone tell me why this happens and how I can get all the complete audit logs through the API?
Thank you and have a nice day.

0 Kudos
4 Replies
PhoneBoy
Admin
Admin

@Omer_Kleinstern?
I also suggest a TAC case: https://help.checkpoint.com 

0 Kudos
Omer_Kleinstern
Employee
Employee

Paging @Nitzan_Massad 

0 Kudos
Nitzan_Massad
Employee
Employee

this is a problem that we have encountered recently.

the management api show-logs will sometimes have problems with multivalued fields

@mahmods has led the solution to this problem 
I will let him add the details on when the solution will arrive in the field  

0 Kudos
Undel
Explorer

+1, same problem

0 Kudos

Leaderboard

Epsum factorial non deposit quid pro quo hic escorol.

Upcoming Events

    CheckMates Events