Rule Usage Filtering

Filter rule usage to identify and delete unused rules to improve your Security posture.
Over-provisioned access on the firewall can be exploited by attacks so administrators need to periodically check for outdated and unused rules. View policy rule usage to simplify your rule lifecycle management to find and delete unused rules to maintain an up-to-date rulebase and improve your Security posture. In PAN-OS 9.0, Rule Usage Filtering enables you to quickly filter the selected rulebase according to rule usage data as well as additional rule data (such as Created and Modified dates) within a customizable time frame.
Additionally, use the Rule Usage Filter to Migrate Port-Based to App-ID Based Security Policy Rules. By migrating to app-based rules, administrators can reduce the attack surface and gain visibility into, inspect, and safely enable applications on your network.
  1. Select
    Device
    Setup
    Management
    and navigate to the Policy Rulebase Settings to verify that
    Policy Rule Hit Count
    is enabled.
  2. Select
    Policies
    and then select the policy rulebase to filter.
  3. In the Policy Optimizer dialog, view the
    Rule Usage
    filter.
  4. Filter rules in the selected rulebase.
    1. Select the
      Timeframe
      you want to filter on or specify a
      Custom
      time frame.
    2. Select the rule
      Usage
      on which to filter.
    3. (
      Optional
      ) If you have reset the rule usage data for any rules, check for
      Exclude rules reset during the last _ days
      and decide when to exclude a rule based on the number of days you specify since the rule was reset. Only rules that were reset before your specified number of days are included in the filtered results.
    4. (
      Optional
      ) Specify search filters based on rule datarule usage.
      1. Hover your cursor over the column header and select
        Columns
        .
      2. Add any additional columns you want to display or use for filtering.
      3. Hover your cursor over the column data that you would like to use for filtering and select
        Filter
        . For data that contains dates, select whether to filter using
        This date
        ,
        This date or earlier
        , or
        This date or later
        .
      4. Apply Filter
        .

Related Documentation