Searching zero hits rules in R80.10

[Jose_Ramon_Rodr]

Hi,

Prior to R80.10 you could find every rule with zero hits right from the search bar. For instance, in R77.30 you could see only the rules with no hits this way:

Now in R80.10 I can't find the way to do that search. In "Searching a Rule Base" page in SmartConsole R80.10 Help there are no clues about it.

Is there a way to do this search?

Greetings.

[PhoneBoy]

You can script the disabling or deletion of said rules with the API.

See: Disable/Delete Rules with a Zero Hit Count (MDS or SMS)‌

[Jose_Ramon_Rodr]

Thanks. This can be a very useful script (and a nice starting point to work with advanced CLI commands) but it's not what I need, a way of search visually those rules as it was in previous versions.

[PhoneBoy]

I'm not aware of a way to do it visually with SmartConsole.

I'm guessing it's because there's no way currently to query the rulebase based on hit count in the API.

The API can return the hits associated with a given rule, which is what the script I referred to actually does.

Possible RFE Tomer Sole‌?

[Abhishek_Kumar1]

Hi -

You can enable hit option on top.

then type the disable list in search tab, it will see your all disable rules.

Regards

Abhishek

[Zeljko]

Hey - how exactly do you do that ?

[Zeljko]

hey,
how exactly do you do that ?
kr
Zeljko

[Tomer_Sole · Accepted solution]

Hi,

This is a limitation of R80.10 and R80.20.

We plan to have it back in our next releases.

No need for RFE on a thing that we had before.

The short-term alternative is using the API. But we are aware that isn't ideal.

Thank you for this feedback.

[Frank_Faber00]

Hi,

This was 2018! Can you tell me in which version the feature is added? Or will be added?

Thanks,

Frank

[rloureiro]

Hi all,

I have two questions:

1. Will this feature be added in future versions?
2. The API only disables/deletes rules with 0 hits or also lists before which it will disable/delete? In my case I just want to list the rules with 0 hits and decide for myself which ones to disable/delete.

Thank you in advance.

Regards.

[dj0Nz]

Any news? Feature seems still not available in R80.30... 😶

[Christian_Wagen]

When is it coming?

[Sulaman_Tapiree]

any news?

[stallwoodj]

Please do bring this back!

🙂

Thanks

Jamie

[Will_H]

In these unprecedented times it would be nice if this worked. 

[dj0Nz]

Just a reminder. Feature still missing in R80.40. 😳

[Dima_M]

Hi all, thanks for heads up, we're working to bring this back to SmartConsole, stay tuned...

But rulebase analysis and cleanup can be done today. we have awesome tool called PolicyCleanUp  which allows automatic cleanup of your policy based on hits count.

The tool runs on a policy and a domain that you named. If a rule was not hit for the number of days that you configured, the rule is a candidate to be disabled.
If a rule is disabled for the number of days that you configured, the rule is a candidate to be deleted.
You can adjust the code according to your organization’s policy / needs. This tool can be executed on Management Server / Multi-Domain servers of version of R80.10 and up.

[S_E_]

Hi,

searching/sorting hit counters is also interesting while troubleshooting, not only for deleting cleanup rules. Not sure why there is always a need to install/add scripts to bring back several features from R77 back to R80.  (e.g. clone admin account;revision control; workflow)

b.t.w. the feature is also not visible in R81 public EA

Best Regards

[Jim_Fessler]

While you may think the tool is awesome I have never worked anywhere where policy could be deleted without review usually by a second party. After two years adding it must be a very low priority. 

[ssaglauskas]

Hi, Any news? Feature seems still not available in R80.40...

[PhoneBoy]

It's not available in R81...or R81.10 either from what I can tell.

[Frank_Faber00]

Dear Check Point,

3 years have gone by and several versions later still no sign of the return of the Zero Hits function. Should we request a RFE after all to get it done? Or is any progress to report?

[PhoneBoy]

I recommend engaging your local office with this requirement.

[Timothy_Hall]

Is this a veiled reference to the Check Point Solutions Center Dameon?

[PhoneBoy]

That's ultimately where the request will end up, yes.
However, customers can't engage with Solution Center directly, thus going through the local Check Point office. 

[James_Frederick]

4 years later still no 0 hit search function... =(

[Manuel_Graft]

It will be very useful if the new release will also include this view in the Export (csv) report.

[Firoj · Accepted solution]

Hii Jose..

Yes in you can search 0 hit rules in R 80.10 & 20 as well. follow the below instruction.

Right click on rule number >> Expand the Hit count tab  >>again expand the time frame >> then select the required time duration ie; 3 month or 1 month. 

Now come on the top tab ie;  source or destination and right click and check the Hits tab. you will be able to see all 0 hits policies.  

Thanks.

[Zeljko]

Hello,

I'm not sure why you report this as solution, this still doesn't work in R80.40 ..
If it does, pls explain in more detail, maybe with a screenshot how you are doing that. I can't verify what you mean with "the top tab ie;  source or destination and right click and check the Hits tab"

thx, kr
Zeljko

[Martin_Raska]

I dont understand it either.