SmartConsole Extension - Easy deletion of unused rules

[HeikoAnkenbrand]

Since deleting unused rules always annoyed me, I created a SmarteConsole plugin.
It does the following:

- Shows all rules in SmartConsole that have not been used (hit counter = 0).
- Lets you select any of the unused rules you want to delete.
- Generates the CLI commands for the Management Server to delete those rules.
   You only need to copy and paste the output into an SSH session on the SMS.
   

I deliberately did not automate the deletion directly in SmartConsole, to avoid accidental rule removal if the tool is misused.

Install Smart Console Extension:
https://www.checkpoint.tips/ex/delete.json

PS:

I quickly created the SmartConsole extension during the last two days of my vacation.
When I have a bit more time, I’ll build a nicer version and make it available in the tools section.

Versions:

1.0                   Basic version                                                                                       08/20/2025
1.1                   Public community version                                                                 08/27/2025
1.2                   Add layers and autoload                                                                    09/01/2025                                   

Demo video

Install SmartConsole Extension

To install SmartConsole Extensions, you can watch this video:

[the_rock]

I should have clarified...I meant does not work on INLINE layers, but does on ordered ones.

[Vincent_Bacher]

I was afraid of that. 😞

[the_rock]

Im sure it will come in new version.

[HeikoAnkenbrand]

The challenge with inline layers is that they are not integrated into the regular rule framework but are instead referenced within the internal database. As a result, a parser would be required to index the database for inline layers. This is particularly difficult when developing SmartConsole plugins, because every interaction with the API triggers a confirmation prompt—a security feature of Check Point—which would lead to an excessive number of confirmations. From my perspective, this approach is not practical.

For several years, I have hoped that Check Point would introduce an alternative mechanism, such as a signing key for trusted SmartConsole application developers. Unfortunately, such a solution does not exist.

Maybe I should apply to Check Point as a programmer. 😀

[PhoneBoy]

It might make more sense for the CLI commands to be ones you can copy/paste to the Command Line available in SmartConsole.
Or maybe it can be an option, just a thought.

[majkel]

Would be nice to maybe add column "last change date" in show rules section ?

[Maja_B]

That's a good suggestion. I would add the "creation date", as well, as most of the times we don't want to remove the rules that are created or modified recently (probably in order to facilitate for some traffic that is expected in the future).

[the_rock]

Gave this to few clients, they all LOVED it, really useful.

Andy

[satish_Puri]

Hi HeikoAnkenbrand, 

Sorry to bother you, But would be better if you can pass the instructions "How to inject this plugin" in Smart Console.

[_Val_]

@satish_Puri see the interactive guide here: https://support.checkpoint.com/results/sk/sk171436#Extension

Or see here: https://community.checkpoint.com/t5/Management/How-to-extend-and-enhance-SmartConsole/td-p/41429

[Ingard]

[the_rock]

Just follow what @_Val_ and @Ingard provided.

Andy

[the_rock]

Keep these extensions coming, Heiko...BRILLIANT!

Andy

[HeikoAnkenbrand]

Demo video