r80 api notes - Revision history

Nighthawk: /* log queries */

2026-08-11T15:31:58Z

‎log queries

Nighthawk: /* log queries */

2026-08-11T15:30:28Z

‎log queries

Nighthawk: /* log queries */

2026-08-11T15:22:45Z

‎log queries

Nighthawk at 07:05, 9 June 2024

2024-06-09T07:05:30Z

Nighthawk at 07:04, 9 June 2024

2024-06-09T07:04:51Z

Nighthawk: /* jq */

2024-05-02T04:18:22Z

‎jq

Nighthawk: /* jq */

2024-05-02T04:18:00Z

‎jq

Nighthawk: /* jq */

2024-05-02T04:17:39Z

‎jq

Nighthawk: /* jq */

2024-05-02T04:17:11Z

‎jq

Nighthawk: /* jq */

2024-05-02T04:07:15Z

‎jq

@@ Line 123: / Line 123: @@
   mgmt_cli -s id.txt show-logs new-query.filter "src:10.0.0.11 and service:https" new-query.time-frame last-hour new-query.max-logs-per-request 25 --format json | jq '.logs[] | {time: .time,fw: .orig,log_server: .orig_log_server,policy: .policy_name,action: .action,source: .src,dest: .dst,service: .service}'
-  POST {{server}}/show-logs
+  POST {{10.1.1.10}}/show-logs
   Content-Type: application/json
   X-chkp-sid: {{session}}

← Older revision		Revision as of 15:30, 11 August 2026
Line 120:		Line 120:

	show-logs new-query.filter "product:IPS and action:prevent" new-query.time-frame "today" new-query.max-logs-per-request 1		show-logs new-query.filter "product:IPS and action:prevent" new-query.time-frame "today" new-query.max-logs-per-request 1
		+
		+	mgmt_cli -s id.txt show-logs new-query.filter "src:10.0.0.11 and service:https" new-query.time-frame last-hour new-query.max-logs-per-request 25 --format json \| jq '.logs[] \| {time: .time,fw: .orig,log_server: .orig_log_server,policy: .policy_name,action: .action,source: .src,dest: .dst,service: .service}'
		+
		+	POST {{server}}/show-logs
		+	Content-Type: application/json
		+	X-chkp-sid: {{session}}
		+	{
		+	"new-query":
		+	{
		+	"filter":"dst:10-.-0-.-0-.-11 or src:10-.-155-.-241-.-11 and NOT service:echo-request",
		+	"log-servers":["10.1.1.10", "10.1.1.17", "10.1.1.19" ],
		+	"time-frame":"custom", "custom-start":"2024-05-10T00:00:00Z", "custom-end":"2024-05-21T23:59:00Z"
		+	}
		+	}

	==jq==		==jq==

@@ Line 118: / Line 118: @@
    "service": "443"
+}
 ==jq==

@@ Line 119: / Line 119: @@
+}
-===jq===
+==jq==
 compound jq select using and/or (note: contains returns true/false)
@@ Line 165: / Line 165: @@
   "chkp-mgmt,checkpoint-host"
-===curl===
+==curl==
   curl -X POST -H "Content-Type: application/json" -d '{"userId": 5, "title": "Post Title", "body": "Post content."}'

@@ Line 47: / Line 47: @@
 *** details-level full will include more objects, including other stuff like type CpmiHostCkp (built in smartcenter object)
-==access rules==
+===access rules===
-===notes before you begin===
+====notes before you begin====
 when using the parameter "name" to refer to a particular package, it appears to require the following...
 <package name> <layer name>
@@ Line 64: / Line 64: @@
   | jq '.rulebase[] | .rulebase[]'
-====rule numbers====
+====show access layers?====
-−
 ===show access layers?===
   [Expert@chmkmgr1:0]# '''mgmt_cli show access-layers -s id.txt --format json | jq '."access-layers"[].name'
   "dropall Network"'''
@@ Line 73: / Line 71: @@
 where "Network" represents the default policy package Standard
-===examples===
+====examples====
 show number of rules in policy
   mgmt_cli show access-rulebase name "<layer>" -s id.txt --format json limit 1 | jq '.total'
@@ Line 91: / Line 89: @@
   mgmt_cli show access-rulebase name "Network" -s id.txt package "Standard" show-hits true --format json | jq '.rulebase[] | select (.comments | contains("haha")) | {rulenum: ."rule-number", comment: .comments}'
-===adding rules===
+====adding rules====
 mgmt_cli -s id.txt add access-rule layer xxad70c9-b4c6-4e64-9bfd-d57ac91289f3 name new_rule
@@ Line 107: / Line 105: @@
   mgmt_cli.exe -s id.txt show gateways-and-servers --format json limit 500 | jq '.objects.nat,.name,.type' | xargs -n3
-==examples==
+===log queries===
 ===jq===
 compound jq select using and/or (note: contains returns true/false)

@@ Line 139: / Line 139: @@
 without keys, change from curly {} to square [] brackets and drop key references
-  | jq '.objects[] | [.name, .type]'
+  '''| jq '.objects[] | [.name, .type]''''
+  [
    "chkp-fw",
@@ Line 150: / Line 150: @@
 print all values on the same line, comma separated
-  | jq '.objects[] | [.name, .type] | join (",")
+  '''| jq '.objects[] | [.name, .type] | join (",")'''
   "chkp-fw simple-gateway"
   "chkp-mgmt,checkpoint-host"

@@ Line 128: / Line 128: @@
 with keys...
-  | jq '.objects[] | {name: .name,type: .type}'
+  '''| jq '.objects[] | {name: .name,type: .type}''''
+  {
    "name": chkp-fw",

← Older revision		Revision as of 04:07, 2 May 2024
Line 122:		Line 122:

	\| jq -c '."installation-targets-revision"[] \| ."cluster-members-revision"[] \| ."target-name"' \| tr -d '"' \| tr '\n' ' '		\| jq -c '."installation-targets-revision"[] \| ."cluster-members-revision"[] \| ."target-name"' \| tr -d '"' \| tr '\n' ' '
		+
		+	get values without keys
		+
		+	example
		+
		+	with keys...
		+	\| jq '.objects[] \| {name: .name,type: .type}'
		+	without keys, change from curly {} to square [] brackets and drop key references
		+	\| jq '.objects[] \| [.name, .type]'
		+
		+	print all values on the same line, comma separated
		+	\| jq '.objects[] \| [.name, .type] \| join (",")
		+

	"rulenum": 1,		"rulenum": 1,