AWS Network Firewall Gains Visibility into Triggered Security Rules

Key Takeaways

• AWS has launched a new “rule hit count” feature for its Network Firewall, providing direct visibility into stateful security rule triggers.
• This capability, enabled by default, helps security teams identify active, inactive, or misconfigured firewall rules without manual log analysis.
• The feature supports incident response, compliance validation, and efficient firewall policy management by showing how often individual rules match network traffic.
• Rule hit counts are available at no extra charge for AWS Network Firewall, though standard CloudWatch Logs, Amazon S3, and Athena fees apply.

Enhanced Visibility for AWS Network Firewall Rules

Amazon Web Services has rolled out a significant enhancement for its Network Firewall service, introducing rule hit count support. This new functionality offers security professionals unprecedented insight into the real-time performance of stateful firewall rules, directly indicating which rules are actively engaging with network traffic.

Enabled by default, this feature addresses a long-standing challenge for organizations managing complex firewall policies. As these policies expand, they frequently accumulate rules that become redundant, never activate, or are incorrectly positioned within the inspection hierarchy. Previously, determining the efficacy or necessity of a specific rule involved labor-intensive manual searches through extensive firewall logs. This often complicated and slowed down essential tasks such as firewall maintenance, incident investigations, and compliance verification.

Streamlined Rule Management and Analysis

The new rule hit count feature leverages existing AWS Network Firewall alert logs to quantify how frequently individual stateful rules are triggered by traffic. This data is critical for maintaining an optimized and secure network posture.

Dashboard Insights and Data Access

Within the AWS console, the “Top Rule Hits” dashboard presents a comprehensive overview, detailing the signature ID, rule description, resource ARN, total hit count, percentage of overall hits, and the timestamp of the most recent rule activation. This granular visibility allows security teams to swiftly ascertain whether a control is operational. A rule consistently appearing in the dashboard confirms its active engagement with traffic, whereas its absence during a specified lookback period might indicate it is unused, obsolete, or being bypassed by another rule positioned earlier in the inspection order.

AWS Network Firewall registers a “rule hit” specifically when a traffic match generates an alert log. Consequently, rules configured with “alert,” “drop,” or “reject” actions are included in the hit count data, as these actions inherently create alert records. Conversely, “pass” rules do not generate alert logs by default and therefore will not appear in the hit count. Organizations wishing to monitor matches for allow rules can achieve this by incorporating the “alert” keyword into their Suricata pass rules. For instance, a rule can be configured to permit HTTPS traffic while simultaneously generating an alert log, enabling teams to track authorized traffic patterns without disrupting connections.

Alert logs now include an “aws_metadata” field from AWS, which contains the ARN of the rule group or firewall policy responsible for the event. This allows analysts to combine the resource ARN with the Suricata signature ID (SID) to pinpoint the exact rule that triggered an alert. Alert data is delivered to either Amazon CloudWatch Logs or Amazon S3. Security operations teams can then analyze these logs using CloudWatch Logs Insights or Amazon Athena, while the native Network Firewall monitoring dashboard offers a more accessible view of frequently triggered rules.

Applications in Incident Response and Compliance

This feature significantly aids incident response efforts. If a security team suspects unauthorized outbound communication to a malicious domain, they can filter the rule hit count view to the relevant time period. This can quickly reveal whether a domain-blocking or threat-detection rule was triggered, its frequency of activation, and the timing of the most recent event.

Furthermore, rule hit counts support compliance operations. Teams adhering to standards like PCI DSS 4.0, DORA, and internal governance requirements can leverage this data as tangible evidence that firewall controls are effectively functioning. It also empowers central cloud security teams to efficiently review policies managed across various business units, facilitating the removal of dormant rules that consume capacity without contributing to security.

AWS noted that system-generated signature IDs might also appear in the dashboard. These IDs can represent default actions in strict-order policies, such as dropping established traffic that did not match any explicit rule. In such scenarios, the displayed ARN will point to the firewall policy rather than a specific stateful rule group.

The rule hit count feature is provided without any additional charges for AWS Network Firewall. However, standard fees for CloudWatch Logs, Amazon S3, and Athena storage or query operations will still apply. This capability currently supports stateful rules exclusively, with stateless rules not yet covered. It is available in all supported AWS Regions, excluding the Middle East Bahrain and Middle East UAE Regions.

What You Should Do

• Explore the “Top Rule Hits” dashboard in the AWS console to familiarize yourself with the new visibility features.
• Regularly review rule hit counts to identify inactive, redundant, or misconfigured stateful firewall rules and optimize your firewall policies.
• For “pass” rules that you wish to monitor, modify them to include the “alert” keyword in your Suricata rules to generate alert logs and enable hit counting.
• Integrate rule hit count data into your incident response workflows to quickly identify triggered security controls during investigations.
• Utilize the rule hit count data as evidence for compliance audits, demonstrating the active functioning of your firewall controls.
• Leverage CloudWatch Logs Insights or Amazon Athena for deeper analysis of alert logs, combining resource ARNs and Suricata SIDs for precise rule identification.

Disclaimer: HackersRadar reports on cybersecurity threats and incidents for informational and awareness purposes only. We do not engage in hacking activities, data exfiltration, or the hosting or distribution of stolen or leaked information. All content is based on publicly available sources.