Viewing Rule Hit Counts

Hit count indicates the number of times a policy rule or default action has been matched to a connection. The hit count is incremented only for the first packet of a connection that matches a rule. You can use this information to identify the efficacy of your rules. Hit count information is available only for access control and prefilter rules applied to threat defense devices.

Note

The count persists through reboots and upgrades.
Counts are maintained by each unit in an HA pair or cluster separately.
You will not be able to derive the hit count information from a device when deployment or a task is in progress on the device.
You can also see rule hit count information in the device CLI using the show rule hits command.
If you have accessed the Hit Count page from the Access Control Policy page, you will not be able to view or edit prefilter rules and vice-versa.
Hit counts are not available for rules that use the Monitor action.

Before you begin

If you use custom user roles, ensure that the roles include the following privileges:

View Device, to see the hit counts.
Modify Device, to refresh the hit counts.

Procedure

Step 1

In the access control policy or prefilter policy editor , click Analyze Hit Counts on the top-right of the page.

Step 2

On the Hit Count page, select the device from the Select a device drop-down list.

If it is not the first time that you are generating hit counts for this device, the last fetched hit count information appears next to the drop-down box. Also, verify the Last Deployed time to confirm recent policy changes.

Step 3

If necessary, click Refresh ( refresh icon ) to obtain current hit count data from the selected device.

In the prefilter policy, you might need to click Fetch Current Hit Count to get initial hit count data.

You cannot refresh the hit count while deployment to the device is in progress.

Step 4

View and analyze the data.

You can do the following:

Click Prefilter or Access Control to switch between the hit counts for these policies.
Search for a specific rule by entering a search string in Filter box.
Broadly limit the list to Hit Rules or Never Hit Rules by selecting these options in the Filter by field. When viewing hit rules, you can further limit the list by selecting a time range in the In Last field (for example, in the last 1 day).

(When viewed from the access control policy.) Clear the hit counts for one or more rule by selecting the checkbox for the rule, then clicking Clear Hit Counts. When confirming the action, choose Clear and Reload to refresh the hit count data. You can clear hit counts for up to 500 rules at a time. You cannot undo clearing hit counts.

Note	Click the checkbox in the table header to select all rules visible in the list. To select a range of rules, select the first rule's checkbox, then Shift+click the last rule's checkbox; all rules in between are also selected.

(When viewed from the access control policy.) You can do the following with individual rules:
- Edit the rule by clicking Edit from the More () menu.
- Delete the rule from the policy by clicking Delete from the More () menu.
- Enable or disable the rule by clicking Enable/Disable Rule from the More () menu.
- Clear the hit count (reset it to zero) for the rule by clicking Clear Hit Count from the More () menu. You cannot undo this action.
(When viewed from the prefilter policy.) Change the displayed columns by clicking Cog () and selecting the columns to show.
(When viewed from the prefilter policy.) Click on a rule name to edit it, or click View () in the last column to view the rule details. Clicking on the rule name highlights it in the policy page where you can edit it.
(When viewed from the prefilter policy.) Clear the hit count information (reset it to zero) for a rule by right-clicking the rule and selecting Clear Hit Count. You can select multiple rules by using Ctrl+click. You cannot undo this action.
Generate a comma-separated values report of the details on the page by clicking Generate CSV on the bottom-left of the page.

Step 5

Click Close to return to the policy page.