Security Policy "Last Hit" metric

[sellington]

Hello,

How is the "Last Hit" metric for a security policy on the firewall generated? Would the timestamp be based on the session start time or the received time of the log? Intuitively I would think the former, but I am starting to think its the latter. Does anyone definitively how this works?

Thanks

[BPry · Accepted solution]

@sellington,

When the feature was initially released I asked about this and was told it was updated whenever the rule was matched, so at the start of the session and not the end. This explanation matches my experience, so I have no reason to believe that it's wrong.