Auto-Updating custom URL block list

[Aaron_Rose]

I created this script a bit ago, but I thought it would be worth sharing.  At a high level the script: 

• • Runs on Check Point's GAIA (using the built in python modules)
  • Downloads a list of URLs from GitHub
  • Parses the URLs from the list and adds them to a custom application/site object
  • Pushes policy (by default it only publishes policy, but you can uncomment the lines to install as well)
  • This object can be used for dynamic allow/block lists

  Requirements

  • Python 2.7 or greater
  • Check lines 12 & 13 - be sure to download the CA bundle as instructed

  Setup

  • Clone the Python script to your host
  • Download the CA bundle (see above)
  • Modify the variables:
    • Line 15 - Add the URL of the suspicious domain list on GitHub (or similar repository) that you would like to use
    • Line 17 - Change the name of the Application/Site URL object that will be created if you wish
    • Line 20 - Change the domain if you're using this in a Multi-Domain environment
    • Line 21 - Name of your policy package if not "Standard"
    • Line 22 - Installation Targets (gateway name)
  • For unattended (cron, etc.) use:
    • Line 19 - Add your API Key
    • Uncomment line 115 and comment out lines 109 - 112

https://github.com/aaronroseio/autoupdateurls

[the_rock]

Hey Aaaron,

That looks interesting...question for you. Is there an official list or sk article about scripts available for different purposes? I ask because I know TAC has official stance that scripting is not supported.

[PhoneBoy]

Officially supported (by TAC) scripts are in SecureKnowledge.
Don't think we have a comprehensive list.

[Aaron_Rose]

Yes, you're correct.  TAC can't support all scripts, since many are made outside of R&D - so TAC would be stretched attempting to digest the technical details & flow of each script, and then trying to support something they aren't familiar with.  Officially supported scripts can be found in SecureKnowledge, as pointed out by @PhoneBoy