Is there a command line batch change a large list of IPS protections to prevent?

[Jin_Zhou]

Is there a way to change a list of IPS protections in .csv file from current state to prevent or detect with a command batch mode like adding network objects in batch? We are on R80.10. Thanks.

[Vincent_Bacher]

Maybe using API and overrides? 

For instance (from api reference)

mgmt_cli - r true mgmt set threat-protection name "FTP Commands" overrides.1.profile "New Profile 1" overrides.1.action "prevent "

[Jin_Zhou]

It looks very promising. But I got the following error when running it:

code: "generic_err_command_not_found"
message: "Requested API command: [mgmt] not found"

Do you have document URL on this? Thanks.

[Tomer_Sole]

Yes, there are many documents 

The API reference is here: Check Point - Management API reference 

it seems that you tried to run the Gaia Shell option in the SmartConsole CLI window. In the reference link (above) it will explain the differences for running each API call.

I also recommend on the rather long but step-by-step guide webinar Leveraging the R80.10 API to Automate and Streamline Security Operations 

[Jin_Zhou]

The command worked. I had to add -d option. In our case I tested in Global domain.

mgmt_cli set threat-protection name "Adobe PageMaker Key Strings Stack Buffer Overflow" overrides.1.profile "g_Optimized_test" overrides.1.action "detect" -r true -d Global

Thank both of you!

[Tomer_Sole]

glad we could help! The Excel trick may look like a hack but it's actually common to see people using it for that

you could also add -domain Global during login and then save the -d Global part for each row.

[Jin_Zhou]

Thanks. I tested in our lab. It works with batch but very slow, slower than I do it manually. But it is at least more error-proof when you do  hundreds of them, I hope. The follow up question is how do I show and confirm the result in command line or better yet, batch mode. From the reference manual, I figured out the following command:

 mgmt_cli show threat-protection -r true  -d Global name "Squid Proxy strHdrAcptLangGetItem Value Denial of Service"

It shows  the detail of the signature for all profiles. How can I show just one profile or even better if I can limit the output to only action field--prevent, detect or inactive? Tried -p option and did not work.

[Tomer_Sole]

I have a question on this - where are the decided protections to activate/deactivate coming from? If they come from some 3rd party vulnerability assessment tool, perhaps it's better to tune your IPS Profile and activate/deactivate all protections associated to specific tags - based on OS/protocol/vendor. See https://community.checkpoint.com/thread/5565-automating-ips 

Let me know if this use-case fits as usually the request to change protections doesn't come from nowhere

[Jin_Zhou]

Thanks. Unfortunately the use-case does not help me here.The list comes from our internal review. Currently I have to change them manually through SmartConsole one by one.

[Tomer_Sole]

you can also ctrl+select as long as you don't do that to over 200 protections at the same time.

but it's probably smarter to edit your CSV in Excel and add a calculated column that creates an API command.

In this example let's say you're at line 4 and you put protection name at column A, profile name at column C and desired new action at column B:

=CONCATENATE("set threat-protection name \""",A4,"\"" overrides.add.1.profile \""",C4,"\"" overrides.1.add.action ",B4)

the calculated API call in this cell, and the other cells below it, can then be copied and pasted into the SmartConsole command-line window.

what do you think?

[Jin_Zhou]

Thanks. I will try batch mode on mgmt.-cli batch mode with csv like I did in adding hosts.

[Huseyin_Rencber]

You can import snort signatures and each time you can delete all snort signatures then import the bulk change signature set easily. Without snort signatures maybe API will help like Vincent Bacher said