Rule creation/modification dates

ekenda2 — Wed, 04 Oct 2017 20:38:41 GMT

I'm writing a script to alert when a new MAC address is seen for an IP address that's listed in an Internet-facing rule. I have it working pretty well, but I want to avoid alerting on rules that are themselves new. I'm calling the API via /config/devices/entry/vsys/entry/rulebase/security/rules, but the data I get back doesn't include any creation/modification date information. Is there a way to get that information via the API? Thanks.

Re: Rule creation/modification dates

nigelswift — Wed, 04 Oct 2017 20:52:48 GMT

From my understanding, the only way to glean this information would be from the config audit versions (/api/?type=op&cmd=<show><config><audit></audit></config></show>). However, looping through each of these every time would add a lot of complexity to your script, and you may not have the config version where the last change to the firewall was made.

Have you considered writing the creation/modification dates to the description field and then using logic to base rules to alert on on the description field?

topic Re: Rule creation/modification dates in Automation/API Discussions

Rule creation/modification dates

Re: Rule creation/modification dates