- play_arrow JSA Risk Manager
- play_arrow JSA Risk Manager configuration
- play_arrow Network Device Management
- play_arrow Network Device Management
- Device Discovery Process
- Discovering Devices in your Network
- Importing Multiple Devices from a CSV File
- Adding a Network Device to JSA Risk Manager
- Deleting a Device from JSA Risk Manager
- Finding Network Devices in the Device List
- Adding Device Information to the Topology
- Collecting Neighbor Data to Update the Topology
- Configuring the Discovery Schedule to Populate Device Information
- play_arrow Device Configuration Backup Jobs
- play_arrow Network Connections Overview
- play_arrow Network Connections Overview
- play_arrow Firewall Rule Event Counts of Check Point Devices
- play_arrow Network Topology
- play_arrow Network Topology
- play_arrow Network Risk Assessment
- play_arrow Network Risk Assessment
- play_arrow Policy Monitor Question Parameters
- play_arrow Searching for Assets in your Network
- play_arrow Policy Monitor Question Backup
- play_arrow Integration with JSA Vulnerability Manager
- play_arrow CIS Benchmark Scans
- play_arrow Network Simulations in JSA Risk Manager
- play_arrow Network Simulations in JSA Risk Manager
- Simulation Tests
- Creating a Simulation
- Duplicating a Simulation
- Manually Running a Simulation
- play_arrow Network Configuration Change Simulation
- Simulating an Attack on an SSH Protocol
- Viewing Simulation Results
- Approving Simulation Results
- Revoking a Simulation Approval
- Assigning Simulations to Group for Tracking
- play_arrow Topology models
- play_arrow Reports
- play_arrow Audit Log Data
Searching Device Rules
SUMMARY In JSA Risk Manager, you can search for rules that changed on the devices in your topology. You can also discover rule changes that occur between device configuration backups.
The results that are returned for a rule search are based on the configuration source management backup of your device. To ensure that rule searches provide up-to-date information, you can schedule device backups in your firewall policy update page.
- Click the Risks tab.
- In the navigation pane, click Configuration Monitor.
- Double-click a device from the Configuration Monitor page.
- On the Rules pane toolbar, click .
- In the Search Criteria area, click a time range.
- To search your device rules, choose from the following options:
Search filter Description Shadowed, Deleted, or Other rule status Click a status option. By default, all status options are enabled. To search for shadow rules only, clear the Deleted and Other options.
Access control list (ACL) Type in the List field. Order number Type a numeric value in the Entry field. Source or destination Type an IP address, CIDR address, hostname, or object group reference. Ports or object group references Type in the Service field. The service can include port ranges, such as 100-200, or port expressions, such as 80(TCP). If the port is negated, the port information also includes an exclamation mark and might be surrounded by parenthesis. For example, the negated port information might look like !(100-200) or !80(TCP).
Vulnerability rule information For information defined by the IPS device, type in the Signature field. Applications by adapter Click Select Applications, then type an adapter or application name. - Click Search.
