topic Re: Security Policy "Last Hit" metric in General Topics

Security Policy "Last Hit" metric

sellington — Mon, 30 Aug 2021 22:30:42 GMT

Hello,

How is the "Last Hit" metric for a security policy on the firewall generated? Would the timestamp be based on the session start time or the received time of the log? Intuitively I would think the former, but I am starting to think its the latter. Does anyone definitively how this works?

Thanks

Re: Security Policy "Last Hit" metric

BPry — Tue, 31 Aug 2021 03:30:08 GMT

@sellington,

When the feature was initially released I asked about this and was told it was updated whenever the rule was matched, so at the start of the session and not the end. This explanation matches my experience, so I have no reason to believe that it's wrong.