AWS Network Firewall Enhances Visibility with Rule Hit Count Capability
AWS Network Firewall now provides a rule hit count feature to help security teams identify unused or redundant stateful firewall rules, improving configuration management and compliance.
Amazon Web Services (AWS) has introduced a new capability for its Network Firewall service that significantly enhances visibility into the effectiveness of security controls. The "rule hit count" feature allows security teams to identify stateful firewall rules that are either unused or redundant by tracking how often each rule matches network traffic. This addresses a long-standing challenge for organizations needing to validate their security posture and optimize their firewall configurations.
The new functionality is designed to provide clear metrics on rule activity. When a stateful rule matches traffic and generates an alert log, its hit count is incremented. This applies automatically to rules with "alert," "drop," or "reject" actions. For rules configured with a "pass" action, the "alert" keyword must be included for them to be logged and counted. Importantly, this feature covers stateful rules within both custom and managed rule groups but does not extend to stateless rules.
AWS has enabled this capability by default for all stateful rules, meaning customers can benefit from it immediately without requiring manual activation. There is no additional cost for using the rule hit count feature itself, though standard AWS charges for storing and querying log data still apply. The feature is available across all AWS Regions where AWS Network Firewall is supported, with the exception of the Middle East (UAE and Bahrain) regions.
Organizations often face governance policies that mandate the removal of dormant rules after a specified period. Previously, identifying these rules required manual log analysis or complex custom tooling. The rule hit count feature directly addresses this by providing an automated mechanism to pinpoint rules that have not matched any traffic within a given timeframe. This is particularly beneficial for teams responsible for compliance frameworks such as PCI DSS 4.0 and the Digital Operational Resilience Act (DORA), enabling them to more easily provide evidence of active and effective security controls.
The AWS Network Firewall console now includes a "Top Rule Hits" view. This dashboard panel displays the most frequently triggered stateful rules over a selected period, along with their respective hit counts, their share of overall traffic activity, detailed rule information, and the timestamp of the last occurrence. Rules whose signature IDs do not appear in this metric are considered inactive during the selected timeframe, signaling potential staleness or incorrect placement within a rule group.
Beyond compliance and optimization, the rule hit count feature offers valuable support during incident response. For example, if a rule is designed to detect traffic to a known malicious domain, analysts can filter the metric to the timeframe of a suspected incident. If the rule shows hits, it can quickly confirm relevant activity without the need to manually parse vast amounts of log data. Conversely, a lack of hits on a rule intended to detect specific threats might prompt further investigation into the rule's configuration or the nature of the observed traffic.
AWS also highlights the utility of this feature for validating new security controls. By introducing rules for emerging threats or specific compliance requirements, such as those related to AI and machine learning domains or geofencing restrictions, security teams can use the hit counts to confirm that these new rules are actively matching traffic as intended. This immediate feedback loop helps ensure that security investments are effective and that deployed controls are functioning correctly from the outset.
While the Network Firewall dashboard provides a convenient overview, security teams can also access and analyze the raw log data directly. For logs stored in Amazon CloudWatch, CloudWatch Logs Insights can be used for querying. For logs stored in Amazon S3, Amazon Athena offers powerful analytical capabilities. This allows for deeper, custom analysis and integration with existing security information and event management (SIEM) systems.