topic Re: Searching for rule with empty "description" field in the ruleset in General Topics

Searching for rule with empty "description" field in the ruleset

TiborNad — Thu, 20 Apr 2017 09:18:49 GMT

Dear community

I am looking for a way to filter all rules without any value in the description field. We use this filed to reference the incident number which has been raised to request a security rule. And by policy we are not allowed to have any rules in our set where there is not reference in the description field.

So i have tried to use the filter options and especially the "does not contain" option. But somehow i have failed to get the correct syntax. For example i have tried

( description does not contain 'test' )

But this does not return any results. So i am even uncertain if the operator has to be spelled "does not contain" oder "doesnotcontain". I have tried both but none seems to work.

Cheers, Tibor

Re: Searching for rule with empty "description" field in the ruleset

bradk14 — Thu, 20 Apr 2017 12:35:43 GMT

if it's possible, I haven't figured it out. best advice I can find is to add the description column so it's displayed in the policy list and just visually identify any rules that don't say 'none' in that column

Re: Searching for rule with empty "description" field in the ruleset

RobertShawver — Tue, 16 Feb 2021 20:27:18 GMT

@TiborNad @bradk14

I know this is hitting the way back machine a bit, apologies. But just in case someone comes across this, the only way I have found is by adding the column "description". Any empty description field shows up in there as 'none' and while (for some stupid reason) you still can't search on that, you can export it to a csv file and from there you can easily filter by none in that column giving you all the rules that don't have a description.

Hope this helps future someone...........

Re: Searching for rule with empty "description" field in the ruleset

BPry — Wed, 17 Feb 2021 04:10:19 GMT

@RobertShawver,

The reason you can't search on the description field unless it actually has information is really just because the field doesn't exist if you don't have a description. In the actual XML configuration file that the device reads and searches whenever you are filtering for something in the rulebase, the entire <description> is one of the fields that the firewall simply doesn't create if left empty.

The rulebase search functionality leaves a lot to be desired, but once understanding that it's really just parsing an XML file makes it make a bit more sense.

Re: Searching for rule with empty "description" field in the ruleset

RobertShawver — Wed, 17 Feb 2021 13:07:00 GMT

@BPry Yup, I was just providing a workaround for anyone who may come across the post.