Rarely used firewall rules

A fundamental task of firewall administration is the configuration and management of firewall rules, which ultimately results in allowed or blocked traffic flow. You might need to see your least often used firewall rules when doing the following:

• Managing firewall rules

Prerequisites 

In order to execute this procedure in your environment, the following data, services, or apps are required:

• Firewall data

Example

You want to understand which firewall rules in your organization are utilized or hit most often and which are rarely used so that you can tune them better. You also want to identify these rarely used rules as a valuable resource for understanding network traffic patterns and identifying outlier traffic.

NOTE: To optimize the search shown below, you should specify an index and a time range. In addition, this sample search uses Palo Alto Networks data. You can replace this source with any other firewall data used in your organization. 

1. Run the following search: 

tag=network tag=communicate rule=*
| rare 5 rule useother=true

Search explanation

The table provides an explanation of what each part of this search achieves. You can adjust this query based on the specifics of your environment.

Result

The search results show the rule name and the count of which rules are infrequently used. The results may be used to determine if a rule should be retired.