Looking for audit software that can show if one object is not used in FW rule.

[WRosenberry]

Looking for software that can report if one object in a rule is unused. 

example: I have 3 destination IP's in one rule, but one might not be receiving any hits.

I recall a Consultant ran a software package during a firewall audit that could do this.

We had to configure the Firewall tp send Syslog to this package. 

This package also had an admin ID on the firewall so it could download new policy.

This package performed full time audit to see what objects were not being used.  It probably did other things like make recommendations on firewall policy order, etc.

but I can't find the name of that package now :(.

thanks

[TomYoung]

It looks like Firemon can do it.  I have never used it because it is pricey.

https://www.firemon.com/detox-step-2-remove-unused-access/

"it is possible to identify most used rules, which objects are used in a rule"

Algosec also makes a similar expensive tool.  So does Tufin.  You would have to research the features.  Google "firewall nspm".

[WRosenberry]

Thanks Tom.  I have been in touch with Firemon and it sounds like a great product.