Custom Report for Unused Policies

[jambulo]

Anyone have any tips on how to create a report to list unused policies?

[HULK]

I don't see a direct option to generate report for only unused rule:

How to Identify Unused Policies on a Palo Alto Networks Device

[ssharma]

Hi jambulo ,

The unused rule counter is based off the dataplane since the last restart. That means once the device is up and running and one of the rule is never triggered, then that is considered unused rule. Currently there is no way to generate a custom report based on that as it will never generate any report. You can view it on security policy only. Hope this helps. Thank you.

[panos]

Look for used rules related to your log capacity,if you have panorama it'll be better.it will give an idea about unused rules.

[hshah]

Hi Jambulo,

Custom report will not help to determine unused rules. Only following document will help for that.

How to Identify Unused Policies on a Palo Alto Networks Device

Custom report is something used to get daily update of aggregated logs, You need information about unused policy just once. Hence you can use above document.

Regards,

Hardik Shah

[panos]

Hi Hardik,

so if the rule is not listed here

https://live.paloaltonetworks.com/docs/DOC-4229

it is also maybe used at selected time(if I select 1 year) at once you mean ?

I need that info also

Thanks