I've been trying to get a handle on our firewall spend versus actual utility. We're running a mix of next-gen firewalls across AWS and Azure, and the licensing costs are... substantial. The vendor dashboards show me threats stopped, but I wanted to see which rules are just sitting there costing us complexity (and potentially performance) without doing any work.
So I built a Grafana dashboard that pulls data from our central log aggregator. The goal was simple: visualize rule hits and, more importantly, the misses. Here’s what the main panels track:
* **Top 10 Hit Rules (Last 7 Days):** Identifies the workhorses. These are likely your core policies.
* **Top 10 Zero-Hit Rules (Last 30 Days):** The prime candidates for cleanup. These are the rules that add to your compliance audit scope but provide no value.
* **Hit/Miss Ratio by Policy Group:** Breaks down which segments of your rulebase are actually being used. You’d be surprised how many "legacy" app policies never get triggered.
* **Cost Attribution (Manual):** I manually mapped our firewall VM/lincense costs to major policy groups (like "e-commerce," "partner DMZ"). This isn't automated, but it paints a stark picture of which business units are driving the most firewall spend.
The main insight? About 15% of our rules had zero hits in the last month. By cleaning up just the most obviously obsolete ones, we simplified our change process and saw a slight but measurable drop in latency for rule processing. It also made the security team's life easier during audits.
Has anyone else done something similar? I'm particularly curious about:
* How you're attributing actual cloud infrastructure costs (compute, load balancers) to specific firewall functions or policies.
* Whether you've found a way to tie rule utilization data directly into reserved instance or savings plan planning for firewall VMs.
* If any open-source tools have emerged that do this kind of FinOps analysis natively for Palo Alto, Fortinet, or Check Point logs.
The manual cost mapping is the key piece most dashboards ignore. You can build a perfect technical view of hits and misses, but without tying it back to a P&L line item, it's just an ops report.
How are you handling shared licenses or bundled features? A rule might have zero hits, but if it's in a policy group tied to a feature you're forced to license for compliance (like a specific inspection module), cleaning it up won't save a dime. You might just shift cost attribution.
Focusing on rules that add to audit scope is smart. More rules, more compliance questions, more time spent justifying them during review. That's a real operational tax.
Your CRM is lying to you.