topic Re: hitcounter per object? in General Topics

hitcounter per object?

S_E_ — Tue, 11 Nov 2025 07:37:55 GMT

Hi,
not sure if this was already on a roadmap.

Are there any plans to display hitcounters based on object rather on rules?
It is somehow difficult ecspecially when you have netsted groups and a large rulebase.
Splitting up the rules in 'individual single' hosts/service blow up the rulebase, disproportionate.

Is there any better approach?
cpview top connections sk167903 does not really help in this case.

Regards

Re: hitcounter per object?

Shyy — Tue, 11 Nov 2025 09:12:01 GMT

Seems like a feature that should have been added a long time ago.
I don't think you have any other way to actually approach this better at the moment other then spliting the rules,
or leveraging logs with filters (just need to be really specific).

Re: hitcounter per object?

Don_Paterson — Tue, 11 Nov 2025 12:21:45 GMT

Have you been using the Tops pane in the Logs tab (LOGS & MONITORING / LOGS & EVENTS (R82)) to do any of that type of analysis?

API options for that too (https://sc1.checkpoint.com/documents/latest/APIs/#cli/show-logs~v2.0.1%20)

Maybe not relevant but there have been enhancements in that area recently:

https://community.checkpoint.com/t5/Management/This-Month-s-Spotlight-3-Features-You-Should-Start-Using-Today/m-p/257991#M42836

From that post (see that post for screenshot and more):

"1. Top Matched Access Rules

What it is

SmartConsole now surfaces Top Matched Access Rules (and Top Log Types) as built-in statistics, so you can quickly see which rules are doing the most work - right where you manage policy and logs.
This feature was also added to the Management API: the show-logs command now returns statistics for Top Matched Access Control Rules and Top Log Types. This makes it easy to identify rules that generate a high volume of logs, both in SmartConsole and via automation.

Use cases

Rulebase cleanup & optimization: Quickly spot the busiest rules (“heavy hitters”) and decide whether to move them up, narrow their scope, or split overly broad rules.
Find unused or shadowed rules: Identify rules with no hits, which may be redundant or hidden behind broader rules.
Validate recent changes: After a policy update, check that the right rules are being triggered and that traffic flow hasn’t shifted unexpectedly.

Why you’ll love it

Clear visibility: See the busiest and least-used rules directly in SmartConsole, without switching to external reports.
Smarter policy decisions: Use real hit data to fine-tune your rulebase, improve performance, and reduce risk.
Confidence in changes: Validate that policy edits had the intended effect, backed by measurable statistics.
Built-in automation: Access the same data through the Logs API to integrate checks into CI/CD pipelines or scheduled reviews.

Availability: R82.10, or R82 with Jumbo Take 36+."

Re: hitcounter per object?

the_rock — Tue, 11 Nov 2025 12:34:46 GMT

That is an excellent idea. I will say though, for now, cpview and tops pane @Don_Paterson mentioned are your best bet. I, personally, cant think of anything else at the moment.

Re: hitcounter per object?

the_rock — Tue, 11 Nov 2025 12:38:40 GMT

I also checked smart event in my lab, but dont see any option for hit count when I create custom report. O well : - (

Re: hitcounter per object?

S_E_ — Tue, 11 Nov 2025 12:46:52 GMT

@Don_Paterson wrote:

Have you been using the Tops pane in the Logs tab (LOGS & MONITORING / LOGS & EVENTS (R82)) to do any of that type of analysis?

hi,

no, I was not aware of that inside SmartConsole, only formerly in https://mgmt/smartview.

Yes with Tops, even with MDS R81.20, I can see top-talker. However not exactly that what I was looking for.

My goal was to find unused or shadowed objects, not rules:

Thanks a lot

Regards

Re: hitcounter per object?

the_rock — Tue, 11 Nov 2025 12:49:22 GMT

You can find unused in the object explorer from the top left menu, then choose unused.

Re: hitcounter per object?

Don_Paterson — Tue, 11 Nov 2025 17:33:21 GMT

Hey Andy,

I think it is more about objects that are actually used in the rules (no unused) but the rules that those objects are in are not matched specifically for that objects.

The objects are obviously not alone in the SRC or DST cell and are in a group or along with multiple other objects.

Regards,

Don

Re: hitcounter per object?

the_rock — Tue, 11 Nov 2025 17:35:14 GMT

I see what you mean! Btw, I did check in the lab in regards to tops tab in logs and monitor, but does not appear to give anything hit count related for the objects.

Re: hitcounter per object?

Don_Paterson — Tue, 11 Nov 2025 17:49:44 GMT

Yeah, its a good one.

One thing you might like to look at:

In the Logs tab (SmartLog) click the options button (top right - at the end of the query bar) --> Tools --> Query Settings

In the Query Settings window you can change the Maximum to 50.

Then OK and go back to the Tops tab and expand Top Destinations.

It's not a lot, 50, and doesn't solve the problem but can help in some cases.

Also try this: query service:https (All Time) and then look at top destinations. As an example.

Re: hitcounter per object?

the_rock — Tue, 11 Nov 2025 17:53:56 GMT

Hey Don,

Yes, I did that this morning, but still does not show any hit count per object, unless Im missing something?

Re: hitcounter per object?

the_rock — Tue, 11 Nov 2025 20:37:47 GMT

FWIW, I also played around with mgmt_cli commands in my mgmt lab, but appears flag show-hits only works with rule command, NOT object. Maybe someone from CP can confirm this for sure, but thats what it seems like to me.

Re: hitcounter per object?

PhoneBoy — Tue, 11 Nov 2025 23:55:37 GMT

We only track hit count on rules, not objects.

Re: hitcounter per object?

the_rock — Tue, 11 Nov 2025 23:59:28 GMT

I figured as well that had to be the case, though definitely good idea, but sounds like a candidate for an RFE.

Re: hitcounter per object?

S_E_ — Wed, 12 Nov 2025 08:25:14 GMT

hi,

Thanks,

RFE has been created and submitted.

Re: hitcounter per object?

the_rock — Wed, 12 Nov 2025 11:45:45 GMT

Definitely best option for now.

Re: hitcounter per object?

Henrik_Noerr1 — Wed, 12 Nov 2025 12:48:29 GMT

this is on the roadmap for Policy Insights for 2026. It's a paid feature by the way.

Re: hitcounter per object?

the_rock — Wed, 12 Nov 2025 12:51:50 GMT

Wont be free?

Re: hitcounter per object?

Henrik_Noerr1 — Wed, 12 Nov 2025 13:57:40 GMT

No, licensed under the SKU -COMPLETE

So you have:

CPSM-NGSM10-COMPLETE

CPSM-NGSM10-PREMIUM

CPSM-NGSM10

complete provides the usage per object in a rule (When implemented according to roadmap)

This also required uploading rulebase and telemetry to the cloud for analysis.

/Henrik

Re: hitcounter per object?

the_rock — Wed, 12 Nov 2025 14:00:27 GMT

Ah, got it, thank you!