AWS Network Firewall Now Supports Stateful Rule Hit Counts

AWS Network Firewall now provides rule hit counts for stateful rules, giving network administrators and security engineers visibility into how often each stateful rule in the firewall policy matches network traffic. AWS Network Firewall is a managed network firewall service that provides inspection and visibility into your VPC traffic.

With rule hit counts, you can turn firewall rule activity into actionable intelligence. You can accelerate incident response by detecting the rules that triggered, identify policy blind spots such as shadow, redundant, and obsolete rules, and validate policy changes by confirming newly deployed rules are matching the intended traffic. Rule hit counts are enabled by default across both custom and managed rule groups, with metrics refreshing at configurable intervals as low as 5 minutes.

This capability is available at no additional charge as part of AWS Network Firewall. Standard charges apply for storing and querying log data. This feature is available in all AWS Regions where AWS Network Firewall is supported, except the Middle East (UAE) and Middle East (Bahrain) Regions.

To learn more, see the AWS Network Firewall product page and AWS Network Firewall documentation.