I'm just not finding references to unhiding additional fields when calling a custom correlation rule, as detailed here:
https://sc1.checkpoint.com/documents/R81/WebAdminGuides/EN/CP_R81_LoggingAndMonitoring_AdminGuide/To...
I essentially have a script which will simply log all input passed to it:
[Expert@checkpoint-management:0]# cat $RTDIR/bin/ext_commands/block_on_clearpass
#!/bin/bash
EVENT=$(cat)
echo $EVENT >> /tmp/block_on_clearpass
This in turn yields the following data being collected:
[Expert@checkpoint-management:0]# tail -n 1 /tmp/block_on_clearpass
(StartTime: 20Dec2022 11:10:26; Uuid: deadbeef-dead-beef-dead-beef00000000; rowid: ENdeadbeef-dead-beef-dead-beef00000000; id_generated_by_indexer: false; first: true; sequencenum: 1; log_id: 2000; DisplayName: IP_Block_from_DNS_Trap; Category: User Defined Events; cu_rule_id: DEADBEEF-DEAD-BEEF-DEAD-BEEFDEADBEEF; is_correlated: 1; num_of_updates: 0; is_last: 0; event_start_time: 1671534625; detection_time: 2022-12-20T09:10:26Z; time_interval: 60; max_num_count_detected: 2; cu_log_count: 2; cu_detected_by_hostname: checkpoint-management; cu_detected_by: 172.254.254.23; users_repetitions: 2; aba_customer: SMC User; source_repetitions: 2; origin_repetitions: 2; destination_repetitions: 2; service_repetitions: 2; Severity: High; type: Correlated; ProductName: VPN-1 & FireWall-1; product_family: Access; Destination: (hostname: ******; countryname: Israel; IP: 62.0.58.94; repetitions: 1) ; Origin: (IP: 0; hostname: redacted-fw01; repetitions: 1) ; Service: (port: 443; protocol: 6; servicename: https; repetitions: 1) ; Source: (user_name: ******; IP: 172.254.254.23; machine_name: ******; repetitions: 1) ; logid: 392281947) ;
PS: I understand the importance of sanitising input variables, is this possibly simply a safety mechanism so that people can be warned about the dangers?
The logs themselves do contain user identities:
![cp_correlation_rule.png cp_correlation_rule.png](https://community.checkpoint.com/t5/image/serverpage/image-id/18863iD46899CEDE4DEE68/image-size/large?v=v2&px=999)
SmartEvent is configured as follows:
![cp_correlation_rule_detail_1.png cp_correlation_rule_detail_1.png](https://community.checkpoint.com/t5/image/serverpage/image-id/18858i6DA12BFD69582A65/image-size/large?v=v2&px=999)
![cp_correlation_rule_detail_2.png cp_correlation_rule_detail_2.png](https://community.checkpoint.com/t5/image/serverpage/image-id/18859i18A756DA87C7AAFA/image-size/large?v=v2&px=999)
We did add the 'Users' event field with the 'src_user_name' field:
![cp_correlation_rule_detail_3.png cp_correlation_rule_detail_3.png](https://community.checkpoint.com/t5/image/serverpage/image-id/18860i70CDF5E715DDC32C/image-size/large?v=v2&px=999)
This then has two actions, the first to drop traffic from that source:
![cp_correlation_rule_action_1.png cp_correlation_rule_action_1.png](https://community.checkpoint.com/t5/image/serverpage/image-id/18861iDAAF3685D022A0C4/image-size/large?v=v2&px=999)
And the 2nd to stop the device being able to communicate with other devices in the same subnet. For now I'm simply calling the custom script detailed above:
![cp_correlation_rule_action_2.png cp_correlation_rule_action_2.png](https://community.checkpoint.com/t5/image/serverpage/image-id/18862iB72E2C58674ED3FC/image-size/large?v=v2&px=999)
Regards
David Herselman