SmartTasks

Use Case:

A company policy dictates that the publish operation must be used with a service request number as a prefix to the session name before saving any changes to the database, so the administrators can see what the rationale for changing the security policy Collection of rules that control network traffic and enforce organization guidelines for data protection and access to resources with packet inspection. was.

Procedure:

Add the Validate Session Name Prefix to the Scripts Repository.

1. Save the script in the repository.

   Instructions

   1. Click Gateways & Servers > Scripts > Scripts Repository > New ()

   2. Give the script a name.

   3. In the Content text box, paste the script code below.

   4. Click OK to save the script in the repository.

   Copy

   Script Code

   #!/bin/bash
   JQ=${CPDIR}/jq/jq
   data=`echo $1 | base64 --decode -i`
   
   # Extracting the required session name prefix for the session name based on the input JSON
   sessionNamePrefix=`echo $data | $JQ -r  .\"custom-data\".\"session-name-prefix\"`
   
   # If there's no input session name prefix, publish is allowed
   if [[ $sessionNamePrefix = "null" ]] || [[ -z "$sessionNamePrefix" ]]; then
       printf '{"result":"success"}\n'
       exit 0
   fi
   
   # Extracting the actual session name
   sessionName=`echo $data | $JQ -r .session.\"session-name\"`
   
   # Abort the publish if the session doesn't contain a name at all
   if [[ $sessionName = "null" ]]; then
       m1="Corporate Policy requires you to use a service request number for the session's name prefix."
       m2="For example: ${sessionNamePrefix}######"
       m3="Session name is missing. Please change your session's name to meet the requirements and try to publish again."
       printf '{"result":"failure","message":"%s %s %s"}\n' "$m1" "$m2" "$m3"
       exit 0
   fi
   
   # Abort the publish if the session name doesn't match the expected prefix
   if [[ ! $sessionName == $sessionNamePrefix* ]]; then
       m1="Corporate Policy requires you to use a ticket number as the session's name."
       m2="For example: ${sessionNamePrefix}###### "
       m2=${m2//\"/\\\"}
       m3="Please change your session's name to meet the requirements and publish again." 
       printf '{"result":"failure","message":"%s %s %s"}\n' "$m1" "$m2" "$m3"
       exit 0
   else
       # Session name matches the expected prefix, publish is allowed
       printf '{"result":"success"}\n'
       exit 0
   fi

2. Create a SmartTask to run the session validation script.

   Instructions

   1. Go to Manage & Settings > Tasks > SmartTasks > New ().

   2. Give the new SmartTask a name (you can call it "Validate Session Name Before Publish")

   3. In the Trigger and Action section, select from the drop down menu:

      Before Publish and Run Script.

   4. In the Select script from repository drop down, select the script saved in Step 1.

   5. In the Custom Data field, enter this string:

      {"session-name-prefix": "CR"}

      Note - The variable "session-name-prefix" correlates to the variable used at the beginning of the script in Step 1. If these are not identical, this script cannot work and the process fails.

   

3. Publish the SmartConsole Check Point GUI application used to manage a Check Point environment - configure Security Policies, configure devices, monitor products and events, install updates, and so on. session.

4. Add a network object.

5. Publish the changes using the required prefix.

   Note - If you publish the session without using the prefix, the process fails.