AWS makes it easier to spot firewall rules that have gone quiet
AWS Network Firewall added rule hit counts for stateful rules, letting teams identify unused rules and validate control effectiveness at no added cost.
AWS Network Firewall's rule hit count capability gives security teams visibility into which stateful firewall rules are matching traffic, helping identify unused or redundant rules and validate controls for compliance frameworks like PCI DSS 4.0 and DORA. The feature covers stateful rules in custom and managed rule groups, is enabled by default at no additional Network Firewall cost, and is available in all supported Regions except UAE and Bahrain. Data is surfaced in the Network Firewall dashboard's Top Rule Hits view and can be queried via CloudWatch Logs Insights or Amazon Athena.
- Hit counts cover stateful rules in custom and managed rule groups; stateless rules unsupported.
- Enabled by default at no additional cost in all supported Regions except UAE and Bahrain.
- Top Rule Hits dashboard view shows most-triggered rules, hit share, and last occurrence.
- Supports compliance evidence for PCI DSS 4.0 and DORA control effectiveness.
- Vendors
- AWS
From the original article
2 min read at helpnetsecurity.com
AWS Network Firewall’s rule hit count capability gives security teams visibility into which stateful firewall rules are matching traffic, helping them identify unused or redundant rules and validate whether security controls are working as intended. The capability covers stateful rules in both custom and managed rule groups, while stateless rules are not supported.
By @helpnetsecurity · helpnetsecurity.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.