certego / fw1-loggrabber

FW1-Loggrabber is a command-line tool to grab logfiles from remote Checkpoint devices using OPSEC LEA (Log Export API)
GNU General Public License v2.0
52 stars 35 forks source link

The options for product filter argument does not cover all the products #29

Open hzhzhang opened 7 years ago

hzhzhang commented 7 years ago

The filter product argument is hardcoded as follow:

if (!((strcmp (argumentsinglevalue, "VPN-1 & FireWall-1") == 0)
                   || (strcmp (argumentsinglevalue, "SmartDefense") == 0)
                   || (strcmp (argumentsinglevalue, "URL Filtering") == 0)
                   || (strcmp (argumentsinglevalue, "Identity Awareness") == 0)
                   || (strcmp (argumentsinglevalue, "Identity Logging") == 0)
                   || (strcmp (argumentsinglevalue, "New Anti Virus") == 0)
                   || (strcmp (argumentsinglevalue, "FDE") == 0)
                   || (strcmp (argumentsinglevalue, "Anti Malware") == 0)
                   || (strcmp (argumentsinglevalue, "Application Control") == 0)
                   || (strcmp (argumentsinglevalue, "Application Control(+)URL Filtering") == 0)
                   || (strcmp (argumentsinglevalue, "Connectra") == 0)
                   || (strcmp (argumentsinglevalue, "ESOD") == 0)
                   || (strcmp (argumentsinglevalue, "Linux OS") == 0)
                   || (strcmp (argumentsinglevalue, "Policy Server") == 0)
                   || (strcmp (argumentsinglevalue, "Security Gateway/Management") == 0)
                   || (strcmp (argumentsinglevalue, "Syslog") == 0)
                   || (strcmp (argumentsinglevalue, "Threat Emulation") == 0)
                   || (strcmp (argumentsinglevalue, "Threat Extraction") == 0))

It does not cover all the products, for example: System Monitor, HTTPS Inspection which are not included in the acceptable options. This issue exist both in audit and non_audit logs.

adepasquale commented 7 years ago

Hello, thanks for reporting. This issue is similar to #13. Do you have a list of products to add?

hzhzhang commented 7 years ago

I don't have the full list of products. Maybe we can reach CheckPoint side to get the full list.

adepasquale commented 7 years ago

Or we can simply remove the condition which checks if the filter is valid against a whitelist.