How to parse $EVENT in external scripts?

[Hugo_vd_Kooij]

Hi,

Has anyone done some scripting with SmartEvent?

Like the reference in https://sc1.checkpoint.com/documents/R81/WebAdminGuides/EN/CP_R81_LoggingAndMonitoring_AdminGuide/To... where you get a $EVENT variable containing a nested set of variables.

The trick is to see how you can get the Source IP adres for example out of these events.

Anyone done anything like ths to script SAM rules?

PS: I know you can use SAM blocking directly but that will do REJECT rules and not DROP rule.

[Sorin_Gogean]

Hello Hugo,

Short answer Yess, there are some others - like me 🙂 - that worked on a process to parse "$EVENT" variable and work on the results returned from SmartEvents triggers/alerts. 

What I ended up is to create an self-contained HTTP server/service that I address from ShartEvent scripts and I parse the "$EVENT" values, split them in several pieces and treat only the pieces we're interested (like the SOURCE IP's of the traffic that was Correlated into a problem) . 

I can explain a bit more on the whole process, or I can just show the dumb process/logic of the initial splitting 🙂 .

(as an rough idea it's done in 2 - 3 steps in order to get the right things out of the WHOLE stuff )

Thank you,

PS: our trigger to get into this whole split stuff, was the fact that the SAM rules have a size limit that was quickly loaded by the number of BLOCKED IP's