Who rated this post

Hi @M.Albisser ,

Hit counts aren’t returned when retrieving the rulebase through the configuration API. They are runtime counters maintained by the dataplane, so they need to be queried through the operational API (type=op) instead.

You can retrieve them using an operational command similar to the following:

<show>
  <rule-hit-count>
    <vsys>
      <vsys-name>
        <entry name="vsys1">
          <rule-base>
            <entry name="security">
              <rules>
                <all/>
              </rules>
            </entry>
          </rule-base>
        </entry>
      </vsys-name>
    </vsys>
  </rule-hit-count>
</show>

**FYI, I tested this against a ngfw where I don't have multi-vsys enabled.

You can experiment with the request via FW API browser, which will generate the XML structure for the operational command. From there you should be able to incorporate the request into your API call from SNOW. 

Hope this helps! Please let us know if you are able to get this operational.