Get Rule Hit Count
Counts the number of times a specific rule or rules were triggered on a specific device.
External Documentation
To learn more, visit the AlgoSec Firewall Analyzer documentation.
Basic Parameters
Parameter | Description |
---|---|
Device Tree Name | Tree name of the device. Can be obtained via List Devices action. |
End Time | Count the number of hits that occurred before this time. |
Filter By | Determines whether to filter results by: - Latest Report - Use the Start Time & End Time defined in the latest report.- Custom Time Frame - Specify your own Start Time & End Time . |
Rule IDs | A comma separated or JSON list of Rule IDs for which to collect hit counts. |
Start Time | Count the number of hits that occurred after this time. |
Advanced Parameters
Parameter | Description |
---|---|
Page | Specifies the page of results to retrieve. |
Page Size | The number of results to display per page. |
Reverse Sort | If checked, the results will be sorted by rules with the least hits first. |
Example Output
{
"status": "OK",
"data": {
"deviceTreeName": "MyDevice",
"ruleIds": {
"content": [
{
"ruleId": "from_dmz_to_untrust_name_119",
"count": 11937
},
{
"ruleId": "from_untrust_to_dmz_name_153",
"count": 10371
},
{
"ruleId": "from_untrust_to_dmz_name_166",
"count": 8942
},
{
"ruleId": "from_dmz_to_untrust_name_154",
"count": 6513
},
{
"ruleId": "from_untrust_to_dmz_name_150",
"count": 73
}
],
"number": 0,
"size": 900,
"totalElements": 35,
"pageable": {
"sort": {
"sorted": false,
"unsorted": true,
"empty": true
},
"pageNumber": 0,
"pageSize": 900,
"offset": 0,
"paged": true,
"unpaged": false
},
"last": true,
"totalPages": 1,
"sort": {
"sorted": false,
"unsorted": true,
"empty": true
},
"first": true,
"numberOfElements": 35,
"empty": false
},
"startTime": 1,
"endTime": 1974667654000
},
"additionalInfo": {}
}
Workflow Library Example
Get Rule Hit Count with Algosec Firewall Analyzer and Send Results Via Email
Preview this Workflow on desktop