topic Re: How to filter out "unused" Address objects and Group objects if they are listed on an unused rule in Expedition Discussions

How to filter out "unused" Address objects and Group objects if they are listed on an unused rule

ChrisC2 — Fri, 26 Jan 2024 10:22:51 GMT

When I used the "Unused" objects filter, it lists objects that are defined in rules and groups if there is no traffic, as well as objects that aren't used at all.

We have some rules that are not used very often, but are still required, so the rules are listed as "unused" only because there has been no traffic for 30 days.

Because of this, the filter lists way more "unused" objects than there really are.

Is there any way to filter the list so it only lists address objects and groups that are not attached to any rules?

Thanks

Re: How to filter out "unused" Address objects and Group objects if they are listed on an unused rule

dpuigdomenec — Fri, 26 Jan 2024 13:14:01 GMT

Hi @ChrisC2 ,

I wanted to inform you that the default filter for unused objects is functioning as you expect. The filter is applied statically to the configuration, regardless of the number of hits per rule. As a result, if an object is marked as unused, it means that Expedition did not detect any usage in the loaded configuration (policies).

Please note that on the tools tab, you have the option to search for usages. If you select an object, you can see where it is being used.

If your Expedition is not functioning as described, please let me know, and I will request an export of your project to debug the issue.

For any further clarification, please contact fwmigrate@paloaltonetworks.com.

Thank you in advance,

David

Re: How to filter out "unused" Address objects and Group objects if they are listed on an unused rule

ChrisC2 — Wed, 31 Jan 2024 17:30:07 GMT

Thank you for the quick reply.

Interesting, maybe I was reading something wrong.

I have 600 objects to check, and I will hopefully be going through some of them carefully tomorrow, so I'll let you know the outcome!

Re: How to filter out "unused" Address objects and Group objects if they are listed on an unused rule

ChrisC2 — Tue, 13 Feb 2024 17:45:44 GMT

Thank you, you were correct, I think a colleague was just getting confused.

It is working as I was expecting.