{"resources":{"checkpoint":{"id":"checkpoint","name":"checkpoint","fields":{"cluster":{"name":"cluster","type":"\u001bcheckpoint.cluster","title":"Check Point gateway cluster","desc":"High-availability or load-sharing group of gateways acting as one logical firewall for redundancy or throughput, as returned by show-gateways-and-servers and enriched from show-simple-cluster. Exposes the cluster mode, the member gateways, the shared interfaces, and the enabled software blades. Use it to audit cluster redundancy and SIC health, for example `checkpoint.clusters.where(clusterMode == \"High Availability\")` or members with broken trust via `checkpoint.clusters { members.where(sicState != \"communicating\") }`.","is_private":true,"provider":"go.mondoo.com/cnquery/providers/checkpoint","is_implicit_resource":true},"clusters":{"name":"clusters","type":"\u0019\u001bcheckpoint.cluster","title":"Gateway clusters (high-availability or load-sharing groups)","desc":"The cluster and gateway-cluster objects from the gateways-and-servers inventory, each grouping two or more gateway members that share a virtual IP for failover (high availability) or connection distribution (load sharing).","provider":"go.mondoo.com/cnquery/providers/checkpoint"},"gateway":{"name":"gateway","type":"\u001bcheckpoint.gateway","title":"Check Point Security Gateway","desc":"Security Gateway (firewall) managed by the management server, as returned by show-gateways-and-servers and enriched from show-simple-gateway. Exposes addressing, software version, operating system, hardware platform, Secure Internal Communication (SIC) trust state, the configured network interfaces, and the enabled software blades. This resource is both an element of checkpoint.gateways and the singular root resource of a gateway asset. Use it to audit fleet posture, for example finding gateways whose SIC trust is broken with `checkpoint.gateways.where(sicState != \"communicating\")` or old versions with `checkpoint.gateways.where(version \u003c \"R81\")`.","is_private":true,"provider":"go.mondoo.com/cnquery/providers/checkpoint","is_implicit_resource":true},"gateways":{"name":"gateways","type":"\u0019\u001bcheckpoint.gateway","title":"Security Gateways and servers known to the management server","desc":"Every object returned by show-gateways-and-servers: the managed firewalls, clusters, and management servers, each with its version, platform, software blades, interfaces, and Secure Internal Communication (SIC) trust state.","provider":"go.mondoo.com/cnquery/providers/checkpoint"},"management":{"name":"management","type":"\u001bcheckpoint.management","title":"Management plane (administrators, profiles, trusted clients, API settings, sessions)","desc":"Administrative surface of the Security Management Server: administrator accounts, the permission profiles bound to them, the trusted-clients list, the Management API access configuration, and the sessions currently open.","provider":"go.mondoo.com/cnquery/providers/checkpoint"},"nat":{"name":"nat","type":"\u001bcheckpoint.nat","is_private":true,"provider":"go.mondoo.com/cnquery/providers/checkpoint","is_implicit_resource":true},"natRules":{"name":"natRules","type":"\u0019\u001bcheckpoint.nat.rule","title":"NAT rules flattened across all policy packages","desc":"Every enabled and disabled NAT rule from each policy package's NAT rulebase, including the automatically generated object (automatic) NAT rules and the manually authored ones, flattened out of any NAT sections. Use it to audit source and destination address translation across the whole estate.","provider":"go.mondoo.com/cnquery/providers/checkpoint"},"virtualSystems":{"name":"virtualSystems","type":"\u0019\u001bcheckpoint.gateway","title":"VSX virtual systems","desc":"Virtual firewalls hosted on a VSX gateway. The Management API has no dedicated virtual-system list command, so these are the show-gateways-and-servers entries whose object type denotes a virtual system, exposed as gateway resources.","provider":"go.mondoo.com/cnquery/providers/checkpoint"},"vpn":{"name":"vpn","type":"\u001bcheckpoint.vpn","title":"Site-to-site VPN topology (encryption communities and their members)","desc":"The star and mesh VPN communities configured on the management server and the gateways participating in each, for auditing which sites are tunneled together and how.","provider":"go.mondoo.com/cnquery/providers/checkpoint"}},"title":"Check Point Security Management","desc":"Root of the Check Point provider, backed by the Security Management Server Web Management (SmartConsole) API. The management plane exposes the administrator accounts, permission profiles, trusted-clients list, Management API access settings, and currently open sessions through management. The data plane exposes the Security Gateways and servers returned by show-gateways-and-servers through gateways, their high-availability or load-sharing clusters through clusters, the VSX virtual systems filtered from that same inventory through virtualSystems, the site-to-site encryption communities and their gateway members through vpn, and every NAT rule from every policy package's NAT rulebase through natRules. Use it to audit the firewall estate centrally: which gateways run which software blades, who can administer the management server and from where, and how traffic is translated and tunneled.","provider":"go.mondoo.com/cnquery/providers/checkpoint"},"checkpoint.cluster":{"id":"checkpoint.cluster","name":"checkpoint.cluster","fields":{"blades":{"name":"blades","type":"\u001bcheckpoint.gateway.blades","title":"Enabled software blades on the cluster","provider":"go.mondoo.com/cnquery/providers/checkpoint"},"clusterMode":{"name":"clusterMode","type":"\u0007","is_mandatory":true,"title":"Cluster mode","desc":"How members share traffic and fail over. Values include High Availability (one active member, the rest on standby), Load Sharing (all members process traffic in parallel, in Multicast or Unicast variants), and VRRP (Gaia VRRP high availability).","provider":"go.mondoo.com/cnquery/providers/checkpoint"},"comments":{"name":"comments","type":"\u0007","is_mandatory":true,"title":"Free-form administrator comments on the cluster object","provider":"go.mondoo.com/cnquery/providers/checkpoint"},"hardware":{"name":"hardware","type":"\u0007","is_mandatory":true,"title":"Hardware platform (appliance model or \"Open server\" for software installs)","provider":"go.mondoo.com/cnquery/providers/checkpoint"},"interfaces":{"name":"interfaces","type":"\u0019\u001bcheckpoint.gateway.interface","title":"Network interfaces shared by the cluster","provider":"go.mondoo.com/cnquery/providers/checkpoint"},"ipv4Address":{"name":"ipv4Address","type":"\u0007","is_mandatory":true,"title":"Main IPv4 address (cluster virtual IP)","provider":"go.mondoo.com/cnquery/providers/checkpoint"},"ipv6Address":{"name":"ipv6Address","type":"\u0007","is_mandatory":true,"title":"Main IPv6 address (cluster virtual IP), or empty when IPv6 is not configured","provider":"go.mondoo.com/cnquery/providers/checkpoint"},"member":{"name":"member","type":"\u001bcheckpoint.cluster.member","title":"Member of a Check Point gateway cluster","desc":"Physical gateway that participates in a cluster, read from the cluster-members list of show-simple-cluster. Exposes the member address and its Secure Internal Communication trust state with the management server. Use it to confirm every member has established SIC trust, for example `checkpoint.clusters { members.where(sicState != \"communicating\") }`.","is_private":true,"provider":"go.mondoo.com/cnquery/providers/checkpoint","is_implicit_resource":true},"members":{"name":"members","type":"\u0019\u001bcheckpoint.cluster.member","title":"Cluster members (the physical gateways backing the cluster)","provider":"go.mondoo.com/cnquery/providers/checkpoint"},"name":{"name":"name","type":"\u0007","is_mandatory":true,"title":"Cluster object name as shown in SmartConsole","provider":"go.mondoo.com/cnquery/providers/checkpoint"},"osName":{"name":"osName","type":"\u0007","is_mandatory":true,"title":"Operating system name (for example: Gaia)","provider":"go.mondoo.com/cnquery/providers/checkpoint"},"sicName":{"name":"sicName","type":"\u0007","is_mandatory":true,"title":"Secure Internal Communication (SIC) name of the cluster object","provider":"go.mondoo.com/cnquery/providers/checkpoint"},"sicState":{"name":"sicState","type":"\u0007","is_mandatory":true,"title":"SIC trust state (communicating when trust is established)","provider":"go.mondoo.com/cnquery/providers/checkpoint"},"type":{"name":"type","type":"\u0007","is_mandatory":true,"title":"Object type (for example: CpmiGatewayCluster or CpmiVsxClusterNetobj)","provider":"go.mondoo.com/cnquery/providers/checkpoint"},"uid":{"name":"uid","type":"\u0007","is_mandatory":true,"title":"Unique identifier (UID) assigned by the management server","provider":"go.mondoo.com/cnquery/providers/checkpoint"},"version":{"name":"version","type":"\u0007","is_mandatory":true,"title":"Software version (for example: R81.20)","provider":"go.mondoo.com/cnquery/providers/checkpoint"}},"init":{"args":[{"name":"name","type":"\u0007"}]},"title":"Check Point gateway cluster","desc":"High-availability or load-sharing group of gateways acting as one logical firewall for redundancy or throughput, as returned by show-gateways-and-servers and enriched from show-simple-cluster. Exposes the cluster mode, the member gateways, the shared interfaces, and the enabled software blades. Use it to audit cluster redundancy and SIC health, for example `checkpoint.clusters.where(clusterMode == \"High Availability\")` or members with broken trust via `checkpoint.clusters { members.where(sicState != \"communicating\") }`.","private":true,"defaults":"name ipv4Address version","provider":"go.mondoo.com/cnquery/providers/checkpoint"},"checkpoint.cluster.member":{"id":"checkpoint.cluster.member","name":"checkpoint.cluster.member","fields":{"ipv4Address":{"name":"ipv4Address","type":"\u0007","is_mandatory":true,"title":"Main IPv4 address of the member gateway","provider":"go.mondoo.com/cnquery/providers/checkpoint"},"name":{"name":"name","type":"\u0007","is_mandatory":true,"title":"Member gateway name","provider":"go.mondoo.com/cnquery/providers/checkpoint"},"sicName":{"name":"sicName","type":"\u0007","is_mandatory":true,"title":"Secure Internal Communication (SIC) name of the member","provider":"go.mondoo.com/cnquery/providers/checkpoint"},"sicState":{"name":"sicState","type":"\u0007","is_mandatory":true,"title":"SIC trust state (communicating when trust is established)","provider":"go.mondoo.com/cnquery/providers/checkpoint"}},"init":{"args":[{"name":"name","type":"\u0007"}]},"title":"Member of a Check Point gateway cluster","desc":"Physical gateway that participates in a cluster, read from the cluster-members list of show-simple-cluster. Exposes the member address and its Secure Internal Communication trust state with the management server. Use it to confirm every member has established SIC trust, for example `checkpoint.clusters { members.where(sicState != \"communicating\") }`.","private":true,"defaults":"name ipv4Address","provider":"go.mondoo.com/cnquery/providers/checkpoint"},"checkpoint.gateway":{"id":"checkpoint.gateway","name":"checkpoint.gateway","fields":{"blades":{"name":"blades","type":"\u001bcheckpoint.gateway.blades","title":"Enabled software blades (firewall, IPS, VPN, threat prevention, and more)","provider":"go.mondoo.com/cnquery/providers/checkpoint"},"comments":{"name":"comments","type":"\u0007","is_mandatory":true,"title":"Free-form administrator comments on the gateway object","provider":"go.mondoo.com/cnquery/providers/checkpoint"},"hardware":{"name":"hardware","type":"\u0007","is_mandatory":true,"title":"Hardware platform (appliance model such as 6200, or \"Open server\" for software installs)","provider":"go.mondoo.com/cnquery/providers/checkpoint"},"interface":{"name":"interface","type":"\u001bcheckpoint.gateway.interface","title":"Check Point gateway network interface","desc":"Network interface on a gateway or cluster: its addressing, anti-spoofing enforcement, topology classification, and security zone. Use it to audit anti-spoofing coverage on external interfaces, for example `checkpoint.gateway.interfaces.where(topology == \"external\" \u0026\u0026 antiSpoofing == false)`.","is_private":true,"provider":"go.mondoo.com/cnquery/providers/checkpoint","is_implicit_resource":true},"interfaces":{"name":"interfaces","type":"\u0019\u001bcheckpoint.gateway.interface","title":"Network interfaces configured on the gateway","desc":"Interface list with addressing, anti-spoofing, topology, and security zone, read from show-simple-gateway. Populated only for simple-gateway objects; empty for clusters, VSX, and host object types that carry no interface detail in this call.","provider":"go.mondoo.com/cnquery/providers/checkpoint"},"ipv4Address":{"name":"ipv4Address","type":"\u0007","is_mandatory":true,"title":"Main IPv4 address of the gateway","provider":"go.mondoo.com/cnquery/providers/checkpoint"},"ipv6Address":{"name":"ipv6Address","type":"\u0007","is_mandatory":true,"title":"Main IPv6 address of the gateway, or empty when IPv6 is not configured","provider":"go.mondoo.com/cnquery/providers/checkpoint"},"name":{"name":"name","type":"\u0007","is_mandatory":true,"title":"Gateway object name as shown in SmartConsole","provider":"go.mondoo.com/cnquery/providers/checkpoint"},"osName":{"name":"osName","type":"\u0007","is_mandatory":true,"title":"Operating system name","desc":"Operating system the gateway runs, for example Gaia. Read from the operating-system field, falling back to os-name for object types that report it under the older key.","provider":"go.mondoo.com/cnquery/providers/checkpoint"},"sicName":{"name":"sicName","type":"\u0007","is_mandatory":true,"title":"Secure Internal Communication (SIC) name","desc":"Distinguished name identifying the gateway in the SIC trust relationship with the management server (for example CN=cp_mgmt,O=...).","provider":"go.mondoo.com/cnquery/providers/checkpoint"},"sicState":{"name":"sicState","type":"\u0007","is_mandatory":true,"title":"SIC trust state","desc":"State of the Secure Internal Communication trust with the management server. Common values are communicating (trust established and working), uninitialized (SIC not yet set up), unknown (no connection to the gateway), and no communication (contact possible but SIC could not be established, usually with an accompanying error). Anything other than communicating indicates a broken or pending trust.","provider":"go.mondoo.com/cnquery/providers/checkpoint"},"type":{"name":"type","type":"\u0007","is_mandatory":true,"title":"Object type","desc":"Management object kind reported by show-gateways-and-servers, for example simple-gateway (a standalone gateway), CpmiGatewayCluster or CpmiClusterMember (cluster objects), CpmiVsxClusterNetobj (VSX), or checkpoint-host (a management or log server host).","provider":"go.mondoo.com/cnquery/providers/checkpoint"},"uid":{"name":"uid","type":"\u0007","is_mandatory":true,"title":"Unique identifier (UID) assigned by the management server","provider":"go.mondoo.com/cnquery/providers/checkpoint"},"version":{"name":"version","type":"\u0007","is_mandatory":true,"title":"Software version (for example: R81.20)","provider":"go.mondoo.com/cnquery/providers/checkpoint"}},"init":{"args":[{"name":"name","type":"\u0007"}]},"title":"Check Point Security Gateway","desc":"Security Gateway (firewall) managed by the management server, as returned by show-gateways-and-servers and enriched from show-simple-gateway. Exposes addressing, software version, operating system, hardware platform, Secure Internal Communication (SIC) trust state, the configured network interfaces, and the enabled software blades. This resource is both an element of checkpoint.gateways and the singular root resource of a gateway asset. Use it to audit fleet posture, for example finding gateways whose SIC trust is broken with `checkpoint.gateways.where(sicState != \"communicating\")` or old versions with `checkpoint.gateways.where(version \u003c \"R81\")`.","private":true,"defaults":"name ipv4Address version","provider":"go.mondoo.com/cnquery/providers/checkpoint"},"checkpoint.gateway.blades":{"id":"checkpoint.gateway.blades","name":"checkpoint.gateway.blades","fields":{"antiBot":{"name":"antiBot","type":"\u0004","is_mandatory":true,"title":"Whether the Anti-Bot blade (botnet command-and-control detection) is enabled","provider":"go.mondoo.com/cnquery/providers/checkpoint"},"antiVirus":{"name":"antiVirus","type":"\u0004","is_mandatory":true,"title":"Whether the Anti-Virus blade is enabled","provider":"go.mondoo.com/cnquery/providers/checkpoint"},"applicationControl":{"name":"applicationControl","type":"\u0004","is_mandatory":true,"title":"Whether the Application Control blade is enabled","provider":"go.mondoo.com/cnquery/providers/checkpoint"},"contentAwareness":{"name":"contentAwareness","type":"\u0004","is_mandatory":true,"title":"Whether the Content Awareness blade (data-type inspection) is enabled","provider":"go.mondoo.com/cnquery/providers/checkpoint"},"firewall":{"name":"firewall","type":"\u0004","is_mandatory":true,"title":"Whether the Firewall blade (stateful access control) is enabled","provider":"go.mondoo.com/cnquery/providers/checkpoint"},"httpsInspection":{"name":"httpsInspection","type":"\u0004","is_mandatory":true,"title":"Whether HTTPS Inspection (TLS decryption for policy enforcement) is enabled","provider":"go.mondoo.com/cnquery/providers/checkpoint"},"identityAwareness":{"name":"identityAwareness","type":"\u0004","is_mandatory":true,"title":"Whether the Identity Awareness blade (user and machine identity) is enabled","provider":"go.mondoo.com/cnquery/providers/checkpoint"},"ips":{"name":"ips","type":"\u0004","is_mandatory":true,"title":"Whether the Intrusion Prevention System (IPS) blade is enabled","provider":"go.mondoo.com/cnquery/providers/checkpoint"},"threatEmulation":{"name":"threatEmulation","type":"\u0004","is_mandatory":true,"title":"Whether the Threat Emulation blade (sandbox detonation) is enabled","provider":"go.mondoo.com/cnquery/providers/checkpoint"},"threatExtraction":{"name":"threatExtraction","type":"\u0004","is_mandatory":true,"title":"Whether the Threat Extraction blade (content sanitization) is enabled","provider":"go.mondoo.com/cnquery/providers/checkpoint"},"urlFiltering":{"name":"urlFiltering","type":"\u0004","is_mandatory":true,"title":"Whether the URL Filtering blade is enabled","provider":"go.mondoo.com/cnquery/providers/checkpoint"},"vpn":{"name":"vpn","type":"\u0004","is_mandatory":true,"title":"Whether the IPSec VPN blade (site-to-site and remote-access tunnels) is enabled","provider":"go.mondoo.com/cnquery/providers/checkpoint"}},"title":"Enabled software blades on a Check Point gateway","desc":"Software blades (feature modules) active on a gateway or cluster, read from show-simple-gateway or show-simple-cluster. Each field is true when the blade is enabled. Covers firewalling, VPN, intrusion prevention, application and URL control, threat prevention, identity awareness, and HTTPS inspection. Use it to audit that expected protections are turned on, for example `checkpoint.gateways.where(blades.ips == false)`.","private":true,"provider":"go.mondoo.com/cnquery/providers/checkpoint"},"checkpoint.gateway.interface":{"id":"checkpoint.gateway.interface","name":"checkpoint.gateway.interface","fields":{"antiSpoofing":{"name":"antiSpoofing","type":"\u0004","is_mandatory":true,"title":"Whether anti-spoofing enforcement is enabled on the interface","provider":"go.mondoo.com/cnquery/providers/checkpoint"},"antiSpoofingAction":{"name":"antiSpoofingAction","type":"\u0007","is_mandatory":true,"title":"Anti-spoofing action when spoofing is detected","desc":"Enforcement mode applied to spoofed packets: prevent (reject and drop the packet) or detect (log only, for topology learning without blocking). Read from anti-spoofing-settings.action; empty when anti-spoofing is not configured.","provider":"go.mondoo.com/cnquery/providers/checkpoint"},"ipv4Address":{"name":"ipv4Address","type":"\u0007","is_mandatory":true,"title":"IPv4 address assigned to the interface","provider":"go.mondoo.com/cnquery/providers/checkpoint"},"ipv4MaskLength":{"name":"ipv4MaskLength","type":"\u0005","is_mandatory":true,"title":"IPv4 network mask length (prefix bits, for example: 24)","provider":"go.mondoo.com/cnquery/providers/checkpoint"},"ipv6Address":{"name":"ipv6Address","type":"\u0007","is_mandatory":true,"title":"IPv6 address assigned to the interface, or empty when none is set","provider":"go.mondoo.com/cnquery/providers/checkpoint"},"name":{"name":"name","type":"\u0007","is_mandatory":true,"title":"Interface name (for example: eth0)","provider":"go.mondoo.com/cnquery/providers/checkpoint"},"securityZoneName":{"name":"securityZoneName","type":"\u0007","is_mandatory":true,"title":"Security zone name","desc":"Name of the security zone assigned to the interface, read from security-zone-settings.specific-zone, or empty when no zone is set. This is the raw zone name; a securityZone accessor is reserved for when checkpoint.securityZone is modeled (see the provider tracking issue).","provider":"go.mondoo.com/cnquery/providers/checkpoint"},"topology":{"name":"topology","type":"\u0007","is_mandatory":true,"title":"Topology classification","desc":"How the interface faces the network, defining the direction anti-spoofing protects. Values are external (faces the Internet or untrusted networks), internal (faces trusted networks), and automatic (the gateway calculates the interface topology from its routes).","provider":"go.mondoo.com/cnquery/providers/checkpoint"}},"title":"Check Point gateway network interface","desc":"Network interface on a gateway or cluster: its addressing, anti-spoofing enforcement, topology classification, and security zone. Use it to audit anti-spoofing coverage on external interfaces, for example `checkpoint.gateway.interfaces.where(topology == \"external\" \u0026\u0026 antiSpoofing == false)`.","private":true,"defaults":"name ipv4Address","provider":"go.mondoo.com/cnquery/providers/checkpoint"},"checkpoint.management":{"id":"checkpoint.management","name":"checkpoint.management","fields":{"administrator":{"name":"administrator","type":"\u001bcheckpoint.management.administrator","title":"Check Point administrator account","desc":"Administrator account on the Security Management Server. Exposes the login name, the authentication method, whether a password change is forced at next login, the account expiration, and the permission profile that determines what the administrator may do. Select by name, for example `checkpoint.management.administrator(name: \"admin\")`. Use it to audit for weak authentication methods or over-privileged accounts, for example `checkpoint.management.administrators.where(authMethod == \"check-point-password\")`.","is_private":true,"provider":"go.mondoo.com/cnquery/providers/checkpoint","is_implicit_resource":true},"administrators":{"name":"administrators","type":"\u0019\u001bcheckpoint.management.administrator","title":"Administrator accounts defined on the management server","provider":"go.mondoo.com/cnquery/providers/checkpoint"},"apiSettings":{"name":"apiSettings","type":"\u001bcheckpoint.management.apiSettings","title":"Management API access configuration (who may call the API, autostart)","provider":"go.mondoo.com/cnquery/providers/checkpoint"},"permissionProfile":{"name":"permissionProfile","type":"\u001bcheckpoint.management.permissionProfile","title":"Check Point permission profile","desc":"Named set of administrative permissions that can be assigned to administrators to govern which management features and policy layers they may read or modify. Select by name, for example `checkpoint.management.permissionProfile(name: \"read-only\")`.","is_private":true,"provider":"go.mondoo.com/cnquery/providers/checkpoint","is_implicit_resource":true},"permissionProfiles":{"name":"permissionProfiles","type":"\u0019\u001bcheckpoint.management.permissionProfile","title":"Permission profiles that grant administrators their capabilities","provider":"go.mondoo.com/cnquery/providers/checkpoint"},"server":{"name":"server","type":"\u001bcheckpoint.management.server","title":"Management server identity (hostname, API version, targeted domain)","provider":"go.mondoo.com/cnquery/providers/checkpoint"},"session":{"name":"session","type":"\u001bcheckpoint.management.session","title":"Open administrator session on the management server","desc":"Session currently open against the Security Management Server. Exposes the owning application, the count of uncommitted changes and locked objects, and whether the session has work in progress. Select by uid. Use it to spot long-lived sessions holding uncommitted policy edits, for example `checkpoint.management.sessions.where(changes \u003e 0)`.","is_private":true,"provider":"go.mondoo.com/cnquery/providers/checkpoint","is_implicit_resource":true},"sessions":{"name":"sessions","type":"\u0019\u001bcheckpoint.management.session","title":"Administrator sessions currently open on the management server","provider":"go.mondoo.com/cnquery/providers/checkpoint"},"trustedClient":{"name":"trustedClient","type":"\u001bcheckpoint.management.trustedClient","title":"Host permitted to connect to the management server","desc":"Entry in the Security Management Server's trusted-clients list, restricting which hosts may open a management connection. Exposes the match type and the address or address range it covers. Select by name. Use it to audit for overly broad entries, for example `checkpoint.management.trustedClients.where(type == \"any\")`.","is_private":true,"provider":"go.mondoo.com/cnquery/providers/checkpoint","is_implicit_resource":true},"trustedClients":{"name":"trustedClients","type":"\u0019\u001bcheckpoint.management.trustedClient","title":"Hosts permitted to connect to the management server","provider":"go.mondoo.com/cnquery/providers/checkpoint"}},"title":"Check Point management plane (SmartConsole / Security Management Server)","desc":"Administrative surface of the Security Management Server: the server identity, the administrator accounts and the permission profiles bound to them, the hosts trusted to connect, the Management API access configuration, and the sessions currently open. Use it to audit who can change firewall policy and from where.","private":true,"provider":"go.mondoo.com/cnquery/providers/checkpoint"},"checkpoint.management.administrator":{"id":"checkpoint.management.administrator","name":"checkpoint.management.administrator","fields":{"authMethod":{"name":"authMethod","type":"\u0007","is_mandatory":true,"title":"Authentication method","desc":"How the administrator authenticates, for example check-point-password (local password), radius, tacacs, securid, or undefined.","provider":"go.mondoo.com/cnquery/providers/checkpoint"},"expiration":{"name":"expiration","type":"\u0007","is_mandatory":true,"title":"Account expiration timestamp (ISO 8601), or empty when the account never expires","provider":"go.mondoo.com/cnquery/providers/checkpoint"},"mustChangePassword":{"name":"mustChangePassword","type":"\u0004","is_mandatory":true,"title":"Whether the administrator must change the password at next login","provider":"go.mondoo.com/cnquery/providers/checkpoint"},"name":{"name":"name","type":"\u0007","is_mandatory":true,"title":"Administrator login name","provider":"go.mondoo.com/cnquery/providers/checkpoint"},"permissionProfile":{"name":"permissionProfile","type":"\u001bcheckpoint.management.permissionProfile","title":"Permission profile assigned to this administrator","desc":"Permission profile that grants this administrator its capabilities. Unset for accounts without an assigned profile (such as super users).","provider":"go.mondoo.com/cnquery/providers/checkpoint"},"uid":{"name":"uid","type":"\u0007","is_mandatory":true,"title":"Unique identifier","provider":"go.mondoo.com/cnquery/providers/checkpoint"}},"init":{"args":[{"name":"name","type":"\u0007"}]},"title":"Check Point administrator account","desc":"Administrator account on the Security Management Server. Exposes the login name, the authentication method, whether a password change is forced at next login, the account expiration, and the permission profile that determines what the administrator may do. Select by name, for example `checkpoint.management.administrator(name: \"admin\")`. Use it to audit for weak authentication methods or over-privileged accounts, for example `checkpoint.management.administrators.where(authMethod == \"check-point-password\")`.","private":true,"defaults":"name authMethod","provider":"go.mondoo.com/cnquery/providers/checkpoint"},"checkpoint.management.apiSettings":{"id":"checkpoint.management.apiSettings","name":"checkpoint.management.apiSettings","fields":{"accessibleFrom":{"name":"accessibleFrom","type":"\u0007","is_mandatory":true,"title":"Clients permitted to call the Management API","desc":"Scope of hosts accepted by the API, for example all (any IP), gui-clients (only configured SmartConsole clients), or localhost (only the management server itself).","provider":"go.mondoo.com/cnquery/providers/checkpoint"},"automaticStart":{"name":"automaticStart","type":"\u0004","is_mandatory":true,"title":"Whether the API server starts automatically with the management server","provider":"go.mondoo.com/cnquery/providers/checkpoint"}},"title":"Management API access configuration","desc":"Access policy for the Security Management Server's web API: which clients may invoke it and whether the API server starts automatically. Restricting API access and disabling unnecessary autostart are common hardening checks.","private":true,"defaults":"accessibleFrom","provider":"go.mondoo.com/cnquery/providers/checkpoint"},"checkpoint.management.permissionProfile":{"id":"checkpoint.management.permissionProfile","name":"checkpoint.management.permissionProfile","fields":{"name":{"name":"name","type":"\u0007","is_mandatory":true,"title":"Profile name","provider":"go.mondoo.com/cnquery/providers/checkpoint"},"uid":{"name":"uid","type":"\u0007","is_mandatory":true,"title":"Unique identifier","provider":"go.mondoo.com/cnquery/providers/checkpoint"}},"init":{"args":[{"name":"name","type":"\u0007"}]},"title":"Check Point permission profile","desc":"Named set of administrative permissions that can be assigned to administrators to govern which management features and policy layers they may read or modify. Select by name, for example `checkpoint.management.permissionProfile(name: \"read-only\")`.","private":true,"defaults":"name","provider":"go.mondoo.com/cnquery/providers/checkpoint"},"checkpoint.management.server":{"id":"checkpoint.management.server","name":"checkpoint.management.server","fields":{"apiVersion":{"name":"apiVersion","type":"\u0007","is_mandatory":true,"title":"Management API version negotiated for the connection (for example: 1.9)","provider":"go.mondoo.com/cnquery/providers/checkpoint"},"domain":{"name":"domain","type":"\u0007","is_mandatory":true,"title":"Targeted management domain","desc":"Domain name on a Multi-Domain Security Management server, or empty for a standalone Security Management Server.","provider":"go.mondoo.com/cnquery/providers/checkpoint"},"name":{"name":"name","type":"\u0007","is_mandatory":true,"title":"Server hostname or IP address the scan connected to","provider":"go.mondoo.com/cnquery/providers/checkpoint"}},"title":"Check Point management server identity","desc":"Identity of the Security Management Server this scan connected to: its hostname or IP, the Management API version in use, and the administrative domain being targeted.","private":true,"defaults":"name apiVersion","provider":"go.mondoo.com/cnquery/providers/checkpoint"},"checkpoint.management.session":{"id":"checkpoint.management.session","name":"checkpoint.management.session","fields":{"administrator":{"name":"administrator","type":"\u001bcheckpoint.management.administrator","title":"Administrator that owns this session","desc":"Administrator account that opened the session. Unset for automation or API-key sessions whose owner is not a managed administrator.","provider":"go.mondoo.com/cnquery/providers/checkpoint"},"application":{"name":"application","type":"\u0007","is_mandatory":true,"title":"Application that opened the session","desc":"Client that established the session, for example SmartConsole, WEB_API, or WEB_MGMT_API.","provider":"go.mondoo.com/cnquery/providers/checkpoint"},"changes":{"name":"changes","type":"\u0005","is_mandatory":true,"title":"Number of uncommitted changes staged in this session","provider":"go.mondoo.com/cnquery/providers/checkpoint"},"inWork":{"name":"inWork","type":"\u0004","is_mandatory":true,"title":"Whether the session currently has work in progress (uncommitted edits or held locks)","provider":"go.mondoo.com/cnquery/providers/checkpoint"},"locks":{"name":"locks","type":"\u0005","is_mandatory":true,"title":"Number of objects locked by this session","provider":"go.mondoo.com/cnquery/providers/checkpoint"},"name":{"name":"name","type":"\u0007","is_mandatory":true,"title":"Session name","provider":"go.mondoo.com/cnquery/providers/checkpoint"},"uid":{"name":"uid","type":"\u0007","is_mandatory":true,"title":"Unique identifier","provider":"go.mondoo.com/cnquery/providers/checkpoint"}},"init":{"args":[{"name":"uid","type":"\u0007"}]},"title":"Open administrator session on the management server","desc":"Session currently open against the Security Management Server. Exposes the owning application, the count of uncommitted changes and locked objects, and whether the session has work in progress. Select by uid. Use it to spot long-lived sessions holding uncommitted policy edits, for example `checkpoint.management.sessions.where(changes \u003e 0)`.","private":true,"defaults":"name application","provider":"go.mondoo.com/cnquery/providers/checkpoint"},"checkpoint.management.trustedClient":{"id":"checkpoint.management.trustedClient","name":"checkpoint.management.trustedClient","fields":{"ipv4Address":{"name":"ipv4Address","type":"\u0007","is_mandatory":true,"title":"IPv4 address matched, for single-address types","provider":"go.mondoo.com/cnquery/providers/checkpoint"},"ipv4AddressFirst":{"name":"ipv4AddressFirst","type":"\u0007","is_mandatory":true,"title":"First IPv4 address of the matched range, for range types","provider":"go.mondoo.com/cnquery/providers/checkpoint"},"ipv4AddressLast":{"name":"ipv4AddressLast","type":"\u0007","is_mandatory":true,"title":"Last IPv4 address of the matched range, for range types","provider":"go.mondoo.com/cnquery/providers/checkpoint"},"name":{"name":"name","type":"\u0007","is_mandatory":true,"title":"Trusted client name","provider":"go.mondoo.com/cnquery/providers/checkpoint"},"type":{"name":"type","type":"\u0007","is_mandatory":true,"title":"Match type","desc":"How the entry matches connecting hosts, for example any (any host), ipv4-address (a single address), ipv4-address-range, or domain.","provider":"go.mondoo.com/cnquery/providers/checkpoint"},"uid":{"name":"uid","type":"\u0007","is_mandatory":true,"title":"Unique identifier","provider":"go.mondoo.com/cnquery/providers/checkpoint"}},"init":{"args":[{"name":"name","type":"\u0007"}]},"title":"Host permitted to connect to the management server","desc":"Entry in the Security Management Server's trusted-clients list, restricting which hosts may open a management connection. Exposes the match type and the address or address range it covers. Select by name. Use it to audit for overly broad entries, for example `checkpoint.management.trustedClients.where(type == \"any\")`.","private":true,"defaults":"name type","provider":"go.mondoo.com/cnquery/providers/checkpoint"},"checkpoint.nat":{"id":"checkpoint.nat","fields":{"rule":{"name":"rule","type":"\u001bcheckpoint.nat.rule","title":"Check Point NAT rule","desc":"Single rule from a policy package's NAT rulebase (show-nat-rulebase), describing how source, destination, and service are translated. Original fields hold the matched objects; translated fields hold what they become. Automatic NAT rules generated from an object's own NAT settings and manual rulebase rules both appear here, flattened across NAT sections. Select by uid. Use it to audit address translation, for example finding disabled rules with `checkpoint.natRules.where(enabled == false)` or rules translating a specific source.","is_private":true,"provider":"go.mondoo.com/cnquery/providers/checkpoint","is_implicit_resource":true}},"is_extension":true},"checkpoint.nat.rule":{"id":"checkpoint.nat.rule","name":"checkpoint.nat.rule","fields":{"autoGenerated":{"name":"autoGenerated","type":"\u0004","is_mandatory":true,"title":"Whether the rule was generated automatically","desc":"True for object (automatic) NAT rules derived from an object's NAT settings, false for rules an administrator added to the rulebase manually.","provider":"go.mondoo.com/cnquery/providers/checkpoint"},"comments":{"name":"comments","type":"\u0007","is_mandatory":true,"title":"Free-form administrator comments on the rule","provider":"go.mondoo.com/cnquery/providers/checkpoint"},"enabled":{"name":"enabled","type":"\u0004","is_mandatory":true,"title":"Whether the rule is enabled","provider":"go.mondoo.com/cnquery/providers/checkpoint"},"originalDestinationName":{"name":"originalDestinationName","type":"\u0007","is_mandatory":true,"title":"Name of the matched (original) destination object, or empty for Any","provider":"go.mondoo.com/cnquery/providers/checkpoint"},"originalServiceName":{"name":"originalServiceName","type":"\u0007","is_mandatory":true,"title":"Name of the matched (original) service object, or empty for Any","provider":"go.mondoo.com/cnquery/providers/checkpoint"},"originalSourceName":{"name":"originalSourceName","type":"\u0007","is_mandatory":true,"title":"Name of the matched (original) source object, or empty for Any","provider":"go.mondoo.com/cnquery/providers/checkpoint"},"packageName":{"name":"packageName","type":"\u0007","is_mandatory":true,"title":"Name of the policy package whose NAT rulebase this rule belongs to","provider":"go.mondoo.com/cnquery/providers/checkpoint"},"ruleNumber":{"name":"ruleNumber","type":"\u0005","is_mandatory":true,"title":"Rule position within the package's NAT rulebase (1-based)","provider":"go.mondoo.com/cnquery/providers/checkpoint"},"translatedDestinationName":{"name":"translatedDestinationName","type":"\u0007","is_mandatory":true,"title":"Name of the destination object after translation, or empty when unchanged (Original)","provider":"go.mondoo.com/cnquery/providers/checkpoint"},"translatedServiceName":{"name":"translatedServiceName","type":"\u0007","is_mandatory":true,"title":"Name of the service object after translation, or empty when unchanged (Original)","provider":"go.mondoo.com/cnquery/providers/checkpoint"},"translatedSourceName":{"name":"translatedSourceName","type":"\u0007","is_mandatory":true,"title":"Name of the source object after translation, or empty when unchanged (Original)","provider":"go.mondoo.com/cnquery/providers/checkpoint"},"uid":{"name":"uid","type":"\u0007","is_mandatory":true,"title":"Unique identifier (UID) of the NAT rule","provider":"go.mondoo.com/cnquery/providers/checkpoint"}},"init":{"args":[{"name":"uid","type":"\u0007"}]},"title":"Check Point NAT rule","desc":"Single rule from a policy package's NAT rulebase (show-nat-rulebase), describing how source, destination, and service are translated. Original fields hold the matched objects; translated fields hold what they become. Automatic NAT rules generated from an object's own NAT settings and manual rulebase rules both appear here, flattened across NAT sections. Select by uid. Use it to audit address translation, for example finding disabled rules with `checkpoint.natRules.where(enabled == false)` or rules translating a specific source.","private":true,"defaults":"packageName ruleNumber","provider":"go.mondoo.com/cnquery/providers/checkpoint"},"checkpoint.vpn":{"id":"checkpoint.vpn","name":"checkpoint.vpn","fields":{"communities":{"name":"communities","type":"\u0019\u001bcheckpoint.vpn.community","title":"Site-to-site VPN communities (meshed and star)","provider":"go.mondoo.com/cnquery/providers/checkpoint"},"community":{"name":"community","type":"\u001bcheckpoint.vpn.community","title":"Check Point site-to-site VPN community","desc":"Group of gateways that establish encrypted tunnels according to a shared topology and encryption method, read from show-vpn-communities-meshed and show-vpn-communities-star. Exposes the topology type, the negotiated encryption method, and the participating gateways. Select by name. Use it to audit tunnels that still allow the legacy IKEv1 protocol, for example `checkpoint.vpn.communities.where(encryptionMethod != \"ikev2 only\")`.","is_private":true,"provider":"go.mondoo.com/cnquery/providers/checkpoint","is_implicit_resource":true}},"title":"Check Point VPN topology","desc":"Site-to-site VPN configuration of the management server, exposing the encryption communities (meshed and star) that define which gateways build tunnels to each other. Entry point for auditing tunnel encryption and membership across the VPN plane.","private":true,"provider":"go.mondoo.com/cnquery/providers/checkpoint"},"checkpoint.vpn.community":{"id":"checkpoint.vpn.community","name":"checkpoint.vpn.community","fields":{"encryptionMethod":{"name":"encryptionMethod","type":"\u0007","is_mandatory":true,"title":"IKE encryption method negotiated for the community","desc":"Value of the community's `encryption-method` setting. \"ikev2 only\" means IKEv2 exclusively, \"prefer ikev2 but support ikev1\" (IKEv2 when the peer supports it, else IKEv1), and \"ikev1 for ipv4 and ikev2 for ipv6 only\". Any value other than \"ikev2 only\" permits the legacy IKEv1 protocol.","provider":"go.mondoo.com/cnquery/providers/checkpoint"},"members":{"name":"members","type":"\u0019\u001bcheckpoint.gateway","title":"Participating gateways","desc":"Gateways that build tunnels in this community, resolved against the gateway list. For a meshed community these are its member gateways; for a star community this includes both central and satellite gateways.","provider":"go.mondoo.com/cnquery/providers/checkpoint"},"name":{"name":"name","type":"\u0007","is_mandatory":true,"title":"Community name","provider":"go.mondoo.com/cnquery/providers/checkpoint"},"type":{"name":"type","type":"\u0007","is_mandatory":true,"title":"Topology type","desc":"How members tunnel to each other: meshed (every gateway builds a tunnel to every other) or star (satellite gateways tunnel through central gateways). Derived from which community command returned the object.","provider":"go.mondoo.com/cnquery/providers/checkpoint"},"uid":{"name":"uid","type":"\u0007","is_mandatory":true,"title":"Unique identifier (UID) of the community","provider":"go.mondoo.com/cnquery/providers/checkpoint"}},"init":{"args":[{"name":"name","type":"\u0007"}]},"title":"Check Point site-to-site VPN community","desc":"Group of gateways that establish encrypted tunnels according to a shared topology and encryption method, read from show-vpn-communities-meshed and show-vpn-communities-star. Exposes the topology type, the negotiated encryption method, and the participating gateways. Select by name. Use it to audit tunnels that still allow the legacy IKEv1 protocol, for example `checkpoint.vpn.communities.where(encryptionMethod != \"ikev2 only\")`.","private":true,"defaults":"name type","provider":"go.mondoo.com/cnquery/providers/checkpoint"}}}