Create a Post
cancel
Showing results for 
Search instead for 
Did you mean: 
Hugo_vd_Kooij
Advisor

Find status of IPS based on CVE identifiers?

I have a re-occuring need to use the API to find the status of a particular CVE protection and find it for many customers.

But from the API manuals I have not been able to find a way to obtain that information. Am I missing something in the manual or is it not implemented in the API?

What would be the best way to find the status of CVE-2021-44228 with the API for example?

Regards, Hugo.

<< We make miracles happen while you wait. The impossible jobs take just a wee bit longer. >>
0 Kudos
4 Replies
G_W_Albrecht
Legend
Legend

You can show protections with name or uid as reference only:

mgmt_cli show threat-protection name "FTP Commands"

listing the details like

protection-type: "Core"

follow-up: false

industry-reference: 

- "CAN-2002-0610"

- "CAN-2001-0755"

- "CAN-2002-0606"

- "CAN-2001-0263"

You would have to cycle thru all UIDs and build a list...

CCSE CCTE CCSM SMB Specialist
0 Kudos
Timothy_Hall
Champion
Champion

As noted in my IPS/AV/ABOT Immersion class below, certain IPS Protection fields are not searchable from the SmartConsole, which almost certainly means they are not searchable through the API either.  Unfortunately you'd have to iterate through all the protections like Gunter mentioned to search for the CVE that way.

cve_search.png

Watch My 2023 CPX360 Speech Titled "Max Power
Reloaded: R81+ Gateway Performance Innovations"
0 Kudos
Art_Zalenekas
Employee
Employee

It depends what you want to look at, but starting MGMT API version 1.6 (R80.40) you can use filter parameter. This call will show you all that you need to know. Take out the show-ips-additional-properties and/or show-profiles parameters if you don't need their outputs. E.g.:

https://sc1.checkpoint.com/documents/latest/APIs/#cli/show-threat-protections~v1.6%20

# mgmt_cli -r true show threat-protections filter 'CVE-2021-44228' limit 1 details-level full show-ips-additional-properties true show-profiles true -f json

Good luck!

 

 

 

 

0 Kudos
Hugo_vd_Kooij
Advisor

I found the cause. I used login seperatly but on the wrong domain. Took the wrong script as template and forgot all about the domain in the login. (It was the script to add all of our employees that need access to the list of administrators. But that is no the domain you usualy work in.

So I need to do some clever scripting now to fecth the right list and parse them for a loop.

<< We make miracles happen while you wait. The impossible jobs take just a wee bit longer. >>
0 Kudos