Hit count on https inspection policy rules

[the_rock]

Hey guys,

Just curious, though Im 99.99% sure this is not possible, but customer asked me last week if there was any way to get hit count on https inspection rules? If not possible currently, any plans to implement it in future releases?

Cheers and tx as always for the help.

[Danny]

It's neither available yet in SmartConsole nor an option via SmartEvent (I tried very hard).

However, there is a quick workaround:

• Manually create a table of all the HTTPS inspection rules
• copy each rules' name and UID into the table
• quick-check if there is any logs for these UIDs shown in the log viewer and fill the column "Hit Count" with your findings, zero hits means the rule can be marked for deletion (i.e. disabled).

Sample result:

#	Hit Count	Name	Rule UID
1	High	BestPracticeBypass	1c1a0fb7-c0d5-4350-9817-a551d67cf356
2	Medium	Webinars	8faba360-5846-413a-8415-2bb8573dece7
3	0	Banking	9f7df107-b81d-4216-866c-082d9e355731

[the_rock]

Thanks Danny! 🙌

[the_rock]

@Danny ...I dont care what anyone says, you are by far the BEST scripter out there, so if anyone can write a script for this, its you 👌

[the_rock]

I sent email to Ilya Yusupov from Israel office, as he helped me out big time with weird ISP redundancy issue for a customer few months back. Lets see what he says and will update ; - )

[RobertoQ]

If you have the Compliance Blade you can try something like this in order to get hit count reports.

 

[the_rock]

Thanks guys, appreciated. @RobertoQ and @Danny , grateful for your responses. Customer just wanted to know if it was possible to simply see the hits number, like you can for NAT and regular rules, but since not, its really not a big deal ; - 

tx again!

Andy

[the_rock · Accepted solution]

Got an email confirmation from @Ilya_Yusupov that this indeed is not supported yet, but might be in future releases. Thanks to Ilya for always such fast responses, greatly appreciated.