checkpoint Firewall audit for configuration change via API

[MaxNC]

Hi ,
How to do audit for Firewall configuration changes done through API.
Suppose if any firewall engineer performs changes via API, and i want to know API client logged in to firewall and what changes has been done via API.

[PhoneBoy]

These changes can be reviewed in the Audit logs in SmartConsole.

[MaxNC]

Hi PhoneBoy,

Do i need enable anything? Because i check the audit log in smartConsole is nothing event relate to API action.

[PhoneBoy]

No.
Here's an example from my lab:

I performed the following steps using mgmt_cli (which is an API client):

• Login
• Create the host "foobar" with ipv4-address 4.3.2.1
• Publish the changes

There are log entries for each one of these actions (as user phoneboy).
Double-click on them to see more details:

If you cannot see such log entries, I suggest a TAC case: https://help.checkpoint.com