Basically I would like to either utilize a regex query or create an extension that will provide the same audits included in the Stateful Inspection check, but on a setting by setting basis. For example, I would like to simply check to see if TCP OUT OF STATE is logged. That is a check on the standard Stateful Inspection check, but if that one setting is properly configured, but the TCP timeout does not match, the audit will fail, thus skewing the results.

Plan B would be to modify the Stateful Inspection check (and the other Checkpoint menu audits) to allow individual checks to be turned on/off. It would also be beneficial for any value based results (like tcptimeout) to support greater than or less than symbols.

Thanks in advance.

The stateful inspection check is looking at the first file for each config (there can be multiple). Since the file name in that position can vary depending on the device, there is not a single answer to your question. Unfortunately, the regex check targets config files only by name, not by position. This complicates what you are attempting to do.

However, there is a way to find out the name you want for each device type. When in the Device Analysis view, do the following:

select the device you want to inspect
right click on the most recent configuration
click on Properties
click on the Retrieved Files tab

You want the name of the first file in the list. Typical values I have found when testing for this value are "CheckPoint_Database" and "Standard" (for a "Check Point CMA or SmartCenter" and "Check Point Cluster Member" respectively).

Please give that a try and see if it helps any. Thanks!

Using the name listed in the first column instead of the file name worked. Thanks for your assistance Eric.