Searching For Access Logs With Updatable Objects as the source or destination

[Steven_Lucas]

Been using a lot of updatable objects, and they work great, but how does one identify these objects in SmartLog queries?

I've been trying a few "Other Fields" like src_uo_name and trying Geo-Location Objects like "Netherlands". These objects have been added and utilized in rules with hits, so I know they are working and imported. I can typically get what I need out of tracking the rule uids, but for ease of use, it'd be nice to know if these can be explicitly queried. 

[PhoneBoy]

Given these are resolved on the gateway, not on the management, I don’t believe you can query based on it.
Further, a given IP could easily be associated with a number of Updatable Objects.

[Steven_Lucas]

This makes sense. It does seem as though that the gateway is sending some of that information over in the log. I noticed that when querying "Netherlands" for example, it did return log entries for traffic to IPs belonging to the updateable Geo-Location object. The log entry did reference it as an updatable object, so it is somewhat part of the log.

I can definitely see how the logging server wouldn't know what the gateway is currently using for that object at the present moment, given its nature. 

[PhoneBoy · Accepted solution]

Geographies are resolved on the management, albeit using a different mechanism than the Updatable Objects mechanism.
This can create some issues when you're looking at your logs and you see things that look like they should have been blocked.
Refer to: https://community.checkpoint.com/t5/General-Topics/Updatable-objects-with-geo-policy/m-p/97434#M191...
On the management, you need to periodically update the mappings using something like: https://community.checkpoint.com/t5/API-CLI-Discussion-and-Samples/One-liner-to-update-IpToCountry-...