To reduce the attack surface, get rid of rules you don’t
use.
The migrated rulebase often contains rules
that aren’t in use because no application traffic matches those
rules. Unused rules clutter the rulebase and offer avenues of attack
to adversaries. Remove these rules to clean up the rulebase and
reduce the attack surface, or modify them so they apply to application
traffic and serve a legitimate purpose in the rulebase.
Unused
rules may exist for a number of reasons. Rules governing services
and applications that the business once used but replaced with other
applications may be in the rulebase. A rule that precedes an unused
rule may control the applications that would otherwise match the
unused rule. In some cases, unused rules are old rules created by
administrators who are no longer with the company and no current administrators
know the rule’s intent.
View rules over any Timeframe you
choose ().
Set the Usage to Unused to filter
out rules that have seen application traffic.