Script to delete a specific tag from all objects

[Christopher_Ric]

Is there any sort of script in R80.10 to delete a specific tag out of all objects?

[PhoneBoy]

Not sure anyone has created such a script.
You could iterate through the various object types and remove a specific tag from them, but I don’t believe it’s a single API call.

[Maik]

The calls that you need to do in order to achieve the described deletion are nearly the same for all kinds of objects. However, it won't be trivial as you'd still need to specify the object types that should get checked and deleted. If you, for example, just want to check rules, hosts, networks, services this could be done quiet easily. I'd recommend the official Check Point Python SDK package in order to do this as it contains lots of prewritten functions that help you even more. For example, there is one function ("api_query"), that automatically checks all existing objects if more than the default value matches. Therefore you would not need to care regarding the overall return sum etc.

If you are not familiar with python yet you can also take a look at the pre written scripts, that are also placed in the same repository and adjust them for your needs. As far as I remember the script documentation is quite nice, so that you should get the meaning behind each line at ease.

[Tal_Paz-Fridman]

Hi Christopher,

What if you just delete the Tag itself?

Tal

[Maik]

Oh **bleep**, seems like I misunderstood the question, I thought the objects that a specific tag is attached to should get deleted.

[JozkoMrkvicka]

Looks like there is no way how to find which objects have a specific tag assigned (via CLI).
API commands "show tag" nor "show tags" with details-level full are not helpful in this case.

You can check it via SmartConsole -> Manage and Settings ->Tags -> right click on Tag -> Where Used...

[Christopher_Ric]

I get an error some weird error when trying to delete the tag.  Essentially I used smartmove in this scenario and it added a tag to every object I imported into management and I then want to eventually export this package via a python script, but you can't import objects with this python script if it has tags.  If there is a way to specify delete tag for other network groups, service groups and hosts, that would be great.

[Tal_Paz-Fridman]

Can you add a screenshot of the error? it sounds as something that we should look at to see if it's a bug.

Thanks

Tal

[Adam_Forester]

Can you post the error when you try to delete the tag?

[Adam_Forester · Accepted solution]

Agree on let's see the error. But I threw together a script that will search for a tag name and then generate a set remove on the object type.

https://github.com/WadesWeaponShed/Globally-Remove-Object-Tags

[Christopher_Ric]

Below is the error message I receive when attempting to delete the tag.  I'll attempt the script you provided and let you know the results.  Thanks.

[Adam_Forester]

A lot of times that will pop up because a change has been done to an object and then not published. May want to do a publish before attempting the delete tag, and check if your other admins have unpublished changes.

[Christopher_Ric]

There were no pending changes to publish and I'm the only admin of this particular environment.  In the process of running this provided script.  Unfortunately it looks like it runs a command for each object and then publishes it, so it's probably going to take a while, but better then having to double click every object manually.

[Adam_Forester]

Shoot my bad... I will fix that if you want to cancel out of it. Give me 5 min.

[Christopher_Ric]

Ok, thanks.

[Adam_Forester]

Done. I updated on GitHub. Will do it all within a single session now. Sorry about that...