Skip to main content

Firewall Module

The Firewall Module gives your NOC team a unified view of all firewall devices — from real-time CPU and memory health to rule analysis, threat detection, VPN tunnel status, and compliance posture. It consolidates data that would otherwise require logging into each firewall individually, surfacing the most important operational metrics in a single dashboard.

Summary Cards​

CardDescription
DevicesTotal number of firewall devices under monitoring
RulesAggregate count of firewall rules across all devices
ThreatsTotal threats detected across all firewalls in the current period
Active/TotalRatio of active policy groups to total configured policy groups
EventsTotal firewall events logged in the monitoring period

Tabs​

The Firewall Module is organised into five tabs:

TabDescription
OverviewDevice health summary with CPU, memory, throughput, and session metrics
LogsRaw firewall log entries with filtering by device, severity, and event type
RulesRule inventory with hit counts, last-matched timestamps, and unused rule identification
VPNVPN tunnel status aggregated from all firewall devices
ThreatsBlocked threats, intrusion attempts, and categorised threat events
ComplianceFirewall configuration compliance against defined security policies

Firewall Device Health & Performance Table​

The main table on the Overview tab lists every monitored firewall with the following columns:

ColumnDescription
DeviceFirewall hostname or identifier
StatusOnline or Offline based on last poll
CPUCurrent CPU utilisation percentage, colour-coded by threshold
MemoryCurrent memory utilisation percentage
LatencyRound-trip latency to the device in milliseconds
BW In/OutCurrent inbound and outbound bandwidth throughput
Sessions (24h)Number of active and new sessions in the last 24 hours
Groups (24h)Policy group hit counts in the last 24 hours
InterfacesCount of monitored interfaces on this device
VPNNumber of VPN tunnels associated with this firewall
RulesTotal rule count configured on the device
OptionsActions — view details, drill into logs, manage rules

Logs Tab​

The Logs tab provides a real-time and historical view of firewall log entries. Filters available:

  • Device — Scope logs to a single firewall
  • Severity — Filter by Critical, High, Medium, Low, Informational
  • Event Type — Filter by Allow, Deny, Drop, NAT, VPN, Threat

Each log entry shows timestamp, source IP, destination IP, port, protocol, action taken, and the rule that matched.

Rules Tab​

The Rules tab inventories all firewall rules across all devices:

  • Rule Name / ID — Identifier as configured on the firewall
  • Device — Which firewall this rule belongs to
  • Action — Allow, Deny, or Drop
  • Hit Count — Number of times this rule has been matched
  • Last Hit — Timestamp of the most recent rule match
  • Unused Rules — Rules with zero hit count over the selected period are flagged — candidates for cleanup

Threats Tab​

Blocked and detected threats are listed with:

  • Time — When the threat was detected
  • Device — Firewall that detected it
  • Threat Name — CVE reference or threat category (e.g., Malware, Port Scan, Brute Force)
  • Severity — Critical, High, Medium, Low
  • Source / Destination — IPs involved
  • Action — Whether the traffic was blocked or alerted

Best Practices​

  • Investigate high CPU (above 80%) — CPU spikes on firewalls often correlate with DDoS activity, large rule sets, or logging overhead. Check the Threats tab for concurrent events.
  • Review unused rules quarterly — Unused rules in the Rules tab are security debt. Remove or disable them to reduce attack surface and simplify audits.
  • Monitor session counts for anomalies — An unusual spike in sessions (24h) may indicate connection flooding or scanning activity originating from inside the network.
  • Correlate VPN tunnel drops with latency — If a VPN tunnel shows as down, cross-reference latency metrics to determine if the underlying WAN path is degraded.