How to filter out "unused" Address objects and Group objects if they are listed on an unused rule

[ChrisC2]

When I used the "Unused" objects filter, it lists objects that are defined in rules and groups if there is no traffic, as well as objects that aren't used at all.

We have some rules that are not used very often, but are still required, so the rules are listed as "unused" only because there has been no traffic for 30 days.

Because of this, the filter lists way more "unused" objects than there really are.

Is there any way to filter the list so it only lists address objects and groups that are not attached to any rules?

Thanks

[dpuigdomenec · Accepted solution]

Hi @ChrisC2 ,

I wanted to inform you that the default filter for unused objects is functioning as you expect. The filter is applied statically to the configuration, regardless of the number of hits per rule. As a result, if an object is marked as unused, it means that Expedition did not detect any usage in the loaded configuration (policies).

Please note that on the tools tab, you have the option to search for usages. If you select an object, you can see where it is being used.

If your Expedition is not functioning as described, please let me know, and I will request an export of your project to debug the issue.

For any further clarification, please contact fwmigrate@paloaltonetworks.com.

Thank you in advance,

David

[ChrisC2]

Thank you for the quick reply.

Interesting, maybe I was reading something wrong.

I have 600 objects to check, and I will hopefully be going through some of them carefully tomorrow, so I'll let you know the outcome!

[ChrisC2]

Thank you,  you were correct, I think a colleague was just getting confused.

It is working as I was expecting.