SmartConsole Extension - Easy deletion of unused rules

[HeikoAnkenbrand]

Since deleting unused rules always annoyed me, I created a SmarteConsole plugin.
It does the following:

- Shows all rules in SmartConsole that have not been used (hit counter = 0).
- Lets you select any of the unused rules you want to delete.
- Generates the CLI commands for the Management Server to delete those rules.
   You only need to copy and paste the output into an SSH session on the SMS.
   

I deliberately did not automate the deletion directly in SmartConsole, to avoid accidental rule removal if the tool is misused.

Install Smart Console Extension:
https://www.checkpoint.tips/ex/delete.json

PS:

I quickly created the SmartConsole extension during the last two days of my vacation.
When I have a bit more time, I’ll build a nicer version and make it available in the tools section.

Versions:

1.0                   Basic version                                                                                       08/20/2025
1.1                   Public community version                                                                 08/27/2025
1.2                   Add layers and autoload                                                                    09/01/2025                                   

Demo video

Install SmartConsole Extension

To install SmartConsole Extensions, you can watch this video:

[the_rock]

I should have clarified...I meant does not work on INLINE layers, but does on ordered ones.

[Vincent_Bacher]

I was afraid of that. 😞

[the_rock]

Im sure it will come in new version.

[HeikoAnkenbrand]

The challenge with inline layers is that they are not integrated into the regular rule framework but are instead referenced within the internal database. As a result, a parser would be required to index the database for inline layers. This is particularly difficult when developing SmartConsole plugins, because every interaction with the API triggers a confirmation prompt—a security feature of Check Point—which would lead to an excessive number of confirmations. From my perspective, this approach is not practical.

For several years, I have hoped that Check Point would introduce an alternative mechanism, such as a signing key for trusted SmartConsole application developers. Unfortunately, such a solution does not exist.

Maybe I should apply to Check Point as a programmer. 😀

[Vincent_Bacher]

Yes i get it. We had a script long ago (done by Val? Not sure anymore) which did same on cli and printed out list of api commands to deactivate or delete the unused policies.

If only this would work with inline layers, I could finally show a few people quite clearly how much useless stuff has accumulated in the database that should finally be gotten rid of.

[the_rock]

I still feel what I mentioned yesterday to @Matlu is at least good workaround, as it would give all the rules with 0 hits.

[Matlu]

Hello, @HeikoAnkenbrand 

I have tested the tool in a production environment, and I have the following comments.

- In MDS, what @the_rock  mentions is true; the URL is uploaded for each CMA that interests us.

- The tool works well, but with one important detail: when you have very large “policy packages” with more than 100 rules, the tool no longer works.

- I have tested it on four policy packages belonging to the same CMA, and the result is that when the policy packages have few rules, it works well, but in policy packages that, at least in my case, have more than 500 rules, the tool is unable to display data, even though there are many rules with zero hits.

- The tool does not survive reboots (if you reboot your SMS/MDS, the extension is not retained).

Is this a limitation of the tool that can be corrected?

[PhoneBoy]

This sounds like the tool is not properly parsing large rulebases, which requires multiple API calls using limit/offset parameters to get all the results.

[the_rock]

Its odd, cause I gave it to a customer with about 250 rules and worked just fine...not MDS mind you, but I dont believe it should matter.

[PhoneBoy]

It might make more sense for the CLI commands to be ones you can copy/paste to the Command Line available in SmartConsole.
Or maybe it can be an option, just a thought.

[majkel]

Would be nice to maybe add column "last change date" in show rules section ?

[Maja_B]

That's a good suggestion. I would add the "creation date", as well, as most of the times we don't want to remove the rules that are created or modified recently (probably in order to facilitate for some traffic that is expected in the future).

[the_rock]

Gave this to few clients, they all LOVED it, really useful.

Andy

[satish_Puri]

Hi HeikoAnkenbrand, 

Sorry to bother you, But would be better if you can pass the instructions "How to inject this plugin" in Smart Console.

[_Val_]

@satish_Puri see the interactive guide here: https://support.checkpoint.com/results/sk/sk171436#Extension

Or see here: https://community.checkpoint.com/t5/Management/How-to-extend-and-enhance-SmartConsole/td-p/41429

[Ingard]

[the_rock]

Just follow what @_Val_ and @Ingard provided.

Andy

[the_rock]

Keep these extensions coming, Heiko...BRILLIANT!

Andy

[HeikoAnkenbrand]

Demo video

[Matlu]

In “Heavy Policy Packages,” the tool does not display results. 😭

[the_rock]

Just to make sure, you did press "show rules"?

[Matlu]

I've tried it several times, but it doesn't show anything.
When there are “few” policies, it shows you the results, but in packages that have more than 100 rules, it doesn't show anything.

[the_rock]

Odd bro...I gave it to a customer that has almost 200 rules and worked fine for them.

[Matlu]

It's strange.
I have several policy packages, and it works well for me only on those with few policies, but on those where it doesn't work, most have more than 100, 500, or 1000, and it's on these packages that nothing is observed.

[the_rock]

So if you export those rules in csv format, how many do you see with zero hits?

[Matlu]

For example, this is another policy package, with more than 500 rules, and nothing appears.

I exported the policy package to CSV.
The package has 700 rules, but 507 rules have 0 hits.

And as you can see, at least in my case, the tool does not show me those 507 rules in SmartConsole 😭

[the_rock]

Okay...and clicking show rules, still nothing?

[Matlu]

I tried again, and it still doesn't work.
That's strange.

One question:

Is the policy package “export” file 100% reliable?
Could it be a temporary solution to rely on the 0 hits shown in the CSV?
Unfortunately, the tool is not working well in my scenario with a large number of rules.

[the_rock]

I believe it would be reliable, yes. Not sure what to tell you brother, works for me 100%.