Title: Identify Enabled Management Methods on SonicWall Interfaces Description: This metric identifies which management methods (e.g., HTTP, HTTPS, SSH, Ping) are enabled on each network interface of a SonicWall firewall running SonicOS version 6. It filters out interfaces with no management methods enabled and breaks down the access methods per interface. Query: Interfaces[?ManagementFormatted != ''].{ Interface: name, ManagementMethods: ManagementFormatted, HTTP_Enabled: contains(ManagementFormatted, 'http'), HTTPS_Enabled: contains(ManagementFormatted, 'https'), SSH_Enabled: contains(ManagementFormatted, 'ssh'), Ping_Enabled: contains(ManagementFormatted, 'ping') } Purpose: To provide visibility into the management surface of each SonicWall interface. This helps MSPs and IT admins assess which interfaces may expose the firewall to potential remote access or management risks and verify that only intended protocols are allowed. How It Works: The metric: Filters the Interfaces object to include only those where at least one management method is enabled. Lists: The interface name (e.g., X0, X1) A combined string of enabled methods Boolean flags for http, https, ssh, and ping, indicating whether each method is individually enabled. Beneficiaries: Security Analysts: Gain insight into firewall management exposure points. Network Engineers: Quickly validate whether interface configurations comply with internal access policies. Compliance Teams: Use this data to audit firewall access protocols. MSPs: Enable proactive reviews of SonicWall configurations across client environments. Notes on Customization & Enhancements: Add More Management Methods: If newer methods (e.g., SNMP, Telnet) are introduced or monitored, add additional flags using contains(ManagementFormatted, 'snmp'). Add Interface Zones or IPs: Include data like interface zone or IP address for additional context by appending fields to the output. Filter Specific Interfaces: Narrow the output to include only WAN-facing interfaces or exclude internal zones using more advanced filters. Track Changes Over Time: Pair with Liongard Change Detection to alert on unauthorized changes to interface management settings. Why These Changes Might Be Valuable: Helps tailor the metric to your organization’s security posture. Supports more detailed audits and compliance reviews. Enables focused reviews on high-risk interfaces (e.g., public-facing). Increases clarity and actionability of the metric output.
