topic Re: Can I get a entries of Unused Rules with no repeat count from Custom Report? in General Topics

Can I get a entries of Unused Rules with no repeat count from Custom Report?

Retired Member — Thu, 27 Nov 2014 05:45:09 GMT

Hi guys,

I have question about PaloAlto Custom Report. I can find that document for getting used rules with counter from customer report as How to Create Custom Report to Show The Least Used Rules in Security Policies

But Customer want to know exactly UNUSED RULES WITH COUNTER from custom report. Is it possible?

Customer really want to have that custom report can show entries of rule-name with no count. If not, I want to have feature request to PaloAlto HQ.

Above is a sample of used rules with counter from custom report and that don't contain entry of unused rule with no repeat count.

Thanks.
Regards,

Roh

Re: Can I get a entries of Unused Rules with no repeat count from Custom Report?

JRussell — Thu, 27 Nov 2014 11:22:48 GMT

I am not sure about making a report to show you those unused rules. But as an administration task, once a year, I will go into the rules. Tick "Highlight unused rules" , select them all and then move them all to the bottom underneath my "drop all" rule.

That will then show all your unused rules in one easy to see location. I am assuming this is the reason the customer wants such a report?

You could then also export the rules as a CSV file to see all the rules in question. In case you wanted something printable.

Re: Can I get a entries of Unused Rules with no repeat count from Custom Report?

Retired Member — Thu, 27 Nov 2014 16:28:37 GMT

Hi JRussell,

Thanks for answer.

As you know that "Highlight unused rules" could show only Unused Rules after device started up. I and customer want to know exactly about Unused Rules for particular schedule such as 2 weeks or 1 month or custom schedule. I believe that the PaloAlto Firewall don't have feature about showing Unused Rules with particular time-frame. So it should be requested to PAN HQ as feature requesting by SE.

Thanks!

Regards,

Roh