- Products
- Learn
- Local User Groups
- Partners
- More
Check Point Jump-Start Online Training
Now Available on CheckMates for Beginners!
Why do Hackers Love IoT Devices so Much?
Join our TechTalk on Aug 17, at 5PM CET | 11AM EST
Welcome to Maestro Masters!
Talk to Masters, Engage with Masters, Be a Maestro Master!
ZTNA Buyer’s Guide
Zero Trust essentials for your most valuable assets
The SMB Cyber Master
Boost your knowledge on Quantum Spark SMB gateways!
As YOU DESERVE THE BEST SECURITY
Upgrade to our latest GA Jumbo
CheckFlix!
All Videos In One Space
Hi,
Prior to R80.10 you could find every rule with zero hits right from the search bar. For instance, in R77.30 you could see only the rules with no hits this way:
Now in R80.10 I can't find the way to do that search. In "Searching a Rule Base" page in SmartConsole R80.10 Help there are no clues about it.
Is there a way to do this search?
Greetings.
Hi,
This is a limitation of R80.10 and R80.20.
We plan to have it back in our next releases.
No need for RFE on a thing that we had before.
The short-term alternative is using the API. But we are aware that isn't ideal.
Thank you for this feedback.
Hii Jose..
Yes in you can search 0 hit rules in R 80.10 & 20 as well. follow the below instruction.
Right click on rule number >> Expand the Hit count tab >>again expand the time frame >> then select the required time duration ie; 3 month or 1 month.
Now come on the top tab ie; source or destination and right click and check the Hits tab. you will be able to see all 0 hits policies.
Thanks.
You can script the disabling or deletion of said rules with the API.
See: Disable/Delete Rules with a Zero Hit Count (MDS or SMS)
Thanks. This can be a very useful script (and a nice starting point to work with advanced CLI commands) but it's not what I need, a way of search visually those rules as it was in previous versions.
I'm not aware of a way to do it visually with SmartConsole.
I'm guessing it's because there's no way currently to query the rulebase based on hit count in the API.
The API can return the hits associated with a given rule, which is what the script I referred to actually does.
Possible RFE Tomer Sole?
Hey - how exactly do you do that ?
hey,
how exactly do you do that ?
kr
Zeljko
Hi,
This is a limitation of R80.10 and R80.20.
We plan to have it back in our next releases.
No need for RFE on a thing that we had before.
The short-term alternative is using the API. But we are aware that isn't ideal.
Thank you for this feedback.
Hi,
This was 2018! Can you tell me in which version the feature is added? Or will be added?
Thanks,
Frank
Any news? Feature seems still not available in R80.30... 😶
When is it coming?
any news?
Please do bring this back!
🙂
Thanks
Jamie
In these unprecedented times it would be nice if this worked.
Just a reminder. Feature still missing in R80.40. 😳
Hi all, thanks for heads up, we're working to bring this back to SmartConsole, stay tuned...
But rulebase analysis and cleanup can be done today. we have awesome tool called PolicyCleanUp which allows automatic cleanup of your policy based on hits count.
The tool runs on a policy and a domain that you named. If a rule was not hit for the number of days that you configured, the rule is a candidate to be disabled.
If a rule is disabled for the number of days that you configured, the rule is a candidate to be deleted.
You can adjust the code according to your organization’s policy / needs. This tool can be executed on Management Server / Multi-Domain servers of version of R80.10 and up.
Hi,
searching/sorting hit counters is also interesting while troubleshooting, not only for deleting cleanup rules. Not sure why there is always a need to install/add scripts to bring back several features from R77 back to R80. (e.g. clone admin account;revision control; workflow)
b.t.w. the feature is also not visible in R81 public EA
Best Regards
While you may think the tool is awesome I have never worked anywhere where policy could be deleted without review usually by a second party. After two years adding it must be a very low priority.
Hi, Any news? Feature seems still not available in R80.40...
It's not available in R81...or R81.10 either from what I can tell.
Dear Check Point,
3 years have gone by and several versions later still no sign of the return of the Zero Hits function. Should we request a RFE after all to get it done? Or is any progress to report?
I recommend engaging your local office with this requirement.
Is this a veiled reference to the Check Point Solutions Center Dameon?
That's ultimately where the request will end up, yes.
However, customers can't engage with Solution Center directly, thus going through the local Check Point office.
4 years later still no 0 hit search function... =(
It will be very useful if the new release will also include this view in the Export (csv) report.
Hii Jose..
Yes in you can search 0 hit rules in R 80.10 & 20 as well. follow the below instruction.
Right click on rule number >> Expand the Hit count tab >>again expand the time frame >> then select the required time duration ie; 3 month or 1 month.
Now come on the top tab ie; source or destination and right click and check the Hits tab. you will be able to see all 0 hits policies.
Thanks.
Hello,
I'm not sure why you report this as solution, this still doesn't work in R80.40 ..
If it does, pls explain in more detail, maybe with a screenshot how you are doing that. I can't verify what you mean with "the top tab ie; source or destination and right click and check the Hits tab"
thx, kr
Zeljko
I dont understand it either.
About CheckMates
Learn Check Point
Advanced Learning
YOU DESERVE THE BEST SECURITY