AWS Network Firewall Adds Rule Hit Counts to Identify Unused Security Rules

AWS has introduced a new capability for AWS Network Firewall that tracks rule hit counts, providing security teams with direct visibility into how often individual stateful firewall rules match live network traffic.

This feature aims to minimize reliance on manual log reviews. It helps organizations identify dormant, misordered, or ineffective rules across both custom and managed rule groups.

AWS Network Firewall Adds Rule

As enterprise firewall policies expand, unused rules can create operational challenges, consume unnecessary capacity, and complicate audits.

The rule hit counts offer an activity signal for each monitored rule, enabling teams to determine whether specific controls are actively enforcing policies or should be reviewed for potential removal.

AWS stated that this capability also supports evidence collection for compliance programs, including PCI DSS 4.0 and the EU’s Digital Operational Resilience Act (DORA).

The measurements for rule hit counts are derived from Network Firewall alert logs. Counters increase when a stateful rule match triggers an alert log, which includes rules configured with alert, drop, or reject actions. However, standard pass rules do not generate alert logs and thus do not appear in hit-count metrics by default.

To measure allowed traffic matches, administrators can incorporate Suricata’s alert keyword into a pass rule. This modification maintains the rule’s allow behavior while creating an alert record that can be counted.

This distinction is crucial for teams that need to validate allowlist rules, monitor sanctioned SaaS access, or establish a baseline for expected egress traffic.

AWS adds metadata to alert events, including the resource ARN associated with the rule group or policy. Analysts can link this ARN to a Suricata signature ID (sid) to identify the specific rule responsible for a detection.

The same metadata powers the Network Firewall console’s Top Rule Hits view, which aggregates activity across Availability Zones within a selected AWS Region.

The dashboard displays total rule hits, the percentage of overall hits, signature IDs, rule descriptions, resource ARNs, and the last observed event time.

Rules not included in the selected lookback window may be unused, obsolete, or incorrectly ordered behind broader matching rules. Teams should validate expected traffic patterns before deciding to delete any rules.

This telemetry can also assist in incident response. During an investigation, analysts can filter rule-hit activity to the suspected time window, quickly determining whether rules targeting malicious domains, prohibited geographies, unusual ports, or sensitive application categories were triggered.

AWS emphasized the importance of this capability in confirming that newly deployed controls are functioning as intended by matching and blocking traffic.

Rule hit counts are enabled by default, but alert logging must be configured. The native dashboard requires logs to be delivered to Amazon CloudWatch Logs or Amazon S3, with detailed monitoring enabled. Organizations using custom analytics can query the logged metadata through CloudWatch Logs Insights or Amazon Athena.

This capability does not incur additional charges for Network Firewall usage. However, standard costs for CloudWatch, S3, and Athena storage and queries still apply. Currently, it supports only stateful rules and is available in the supported AWS Regions, excluding the Middle East (UAE) and Middle East (Bahrain).

Prevent incidents due to slow investigations. Power your Tier 1 with threat intelligence from 15K SOCs: Integrate TI Lookup in your SOC