Detect Checkpoint FW action changes

[splunkreal]

Hello,

I'm trying to detect action changes (src/dst/action switching from drop to accept). Checkpoint FW addon is installed.

I thought about this query but it's way too long :

index=xxx action=drop earliest=-7d@d latest=@d sourcetype=opsec | eval src_drop=src | eval dst_drop=dst| eval service_drop=service | dedup src,dst,service | table src,dst,service,action | join src,dst,service [search index=xxx sourcetype=opsec action=accept earliest=@d latest=now | eval src_acc=src | eval dst_acc=dst | eval service_acc=service | eval acc_time=strftime(_time,"%y/%m/%d %H:%M") | dedup src,dst,service | table src,dst,service,action] | where src_drop=src_acc AND dst_drop=dst_acc AND service_drop=service_acc | table src,dst,service,action

Thanks.

[rgreenwell]

How about a query from the audit log?

index=xxx product=SmartDashboard sourcetype=opsec_audit Operation="Modify Object"

[splunkreal]

Yes I thought about it but it won't give me src/dst/service table but thanks anyway.

[rgreenwell]

How about something from the audit log? index=xxx product=SmartDashboard sourcetype=opsec_audit Operation="Modify Object"