topic Re: Hit count on https inspection policy rules in Firewall and Security Management

Hit count on https inspection policy rules

the_rock — Tue, 21 Feb 2023 20:09:00 GMT

Hey guys,

Just curious, though Im 99.99% sure this is not possible, but customer asked me last week if there was any way to get hit count on https inspection rules? If not possible currently, any plans to implement it in future releases?

Cheers and tx as always for the help.

Re: Hit count on https inspection policy rules

Danny — Tue, 21 Feb 2023 20:47:55 GMT

It's neither available yet in SmartConsole nor an option via SmartEvent (I tried very hard).

However, there is a quick workaround:

Manually create a table of all the HTTPS inspection rules
copy each rules' name and UID into the table
quick-check if there is any logs for these UIDs shown in the log viewer and fill the column "Hit Count" with your findings, zero hits means the rule can be marked for deletion (i.e. disabled).

Sample result:

#	Hit Count	Name	Rule UID
1	High	BestPracticeBypass	1c1a0fb7-c0d5-4350-9817-a551d67cf356
2	Medium	Webinars	8faba360-5846-413a-8415-2bb8573dece7
3	0	Banking	9f7df107-b81d-4216-866c-082d9e355731

Re: Hit count on https inspection policy rules

RobertoQ — Tue, 21 Feb 2023 23:18:35 GMT

If you have the Compliance Blade you can try something like this in order to get hit count reports.

Re: Hit count on https inspection policy rules

the_rock — Wed, 22 Feb 2023 00:55:49 GMT

Thanks guys, appreciated. @RobertoQ and @Danny , grateful for your responses. Customer just wanted to know if it was possible to simply see the hits number, like you can for NAT and regular rules, but since not, its really not a big deal ; -

tx again!

Andy

Re: Hit count on https inspection policy rules

the_rock — Wed, 22 Feb 2023 00:56:29 GMT

Thanks Danny! 🙌

Re: Hit count on https inspection policy rules

the_rock — Wed, 22 Feb 2023 02:28:48 GMT

@Danny ...I dont care what anyone says, you are by far the BEST scripter out there, so if anyone can write a script for this, its you 👌

Re: Hit count on https inspection policy rules

the_rock — Thu, 23 Feb 2023 17:19:19 GMT

I sent email to Ilya Yusupov from Israel office, as he helped me out big time with weird ISP redundancy issue for a customer few months back. Lets see what he says and will update ; - )

Re: Hit count on https inspection policy rules

the_rock — Thu, 23 Feb 2023 17:28:07 GMT

Got an email confirmation from @Ilya_Yusupov that this indeed is not supported yet, but might be in future releases. Thanks to Ilya for always such fast responses, greatly appreciated.