Amazon Web Services (AWS) has introduced a new capability for its Network Firewall service, providing visibility into the hit counts of stateful firewall rules. This feature, which became available on August 24, 2026, is designed to help security teams identify unused or redundant rules, validate the effectiveness of security controls, and streamline incident response.
The rule hit count capability tracks how often stateful firewall rules match network traffic. The counter increments when a rule match generates an alert log. Rules configured with `alert`, `drop`, or `reject` actions automatically generate these logs. For rules with a `pass` action, the `alert` keyword must be included for them to appear in the metric. This functionality applies to stateful rules within both custom and managed rule groups; stateless rules are not supported.
AWS Network Firewall protects Amazon Virtual Private Clouds (VPCs) by enabling customers to create granular traffic control rules and utilize AWS-managed rules powered by Amazon threat intelligence. Its capabilities include geographic IP filtering, deep packet inspection, intrusion prevention, and proxy functionality.
The new feature is enabled by default and incurs no additional Network Firewall cost, though standard charges for storing and querying log data still apply. Rule hit counts are available in all AWS Regions where AWS Network Firewall is supported, with the exception of the Middle East (UAE and Bahrain) regions.
Organizations with governance policies that mandate the removal of dormant rules after a specified period have previously lacked a mechanism to identify them. Similarly, teams responsible for compliance frameworks such as PCI DSS 4.0 and the Digital Operational Resilience Act (DORA) often face challenges in providing evidence that specific security controls are actively functioning. The rule hit count data aims to address these issues by enabling the identification and removal of unused rules, accelerating incident response, and validating security control effectiveness for compliance purposes.
Rule group metadata is automatically included in firewall logs. This metadata is utilized by the Network Firewall monitoring dashboard to calculate hit counts, offering security teams a consolidated view of rule activity without requiring manual log queries. Users can also access and analyze this data by directly querying logs using CloudWatch Logs Insights for logs stored in CloudWatch, or Amazon Athena for logs stored in Amazon S3.
The Network Firewall dashboard now includes a "Top Rule Hits" view. This panel displays the most frequently triggered stateful rules over a selected period, detailing their hit counts, their share of overall activity, specific rule details, and the last time they occurred. Rules whose signature IDs do not appear in this metric have not matched traffic during the selected timeframe, potentially indicating a stale rule or an incorrect order within its rule group.
During incident response, this view can be particularly useful. For instance, if a rule detects traffic to an out-of-band application security testing (OAST) domain, which could signal attempted data exfiltration or an attacker validating a vulnerability, filtering the metric to the timeframe of a suspected incident can help analysts quickly identify relevant activity without manually parsing numerous log entries. AWS also demonstrated how hit counts can validate recently introduced controls, such as rules covering AI and machine learning domains or geofencing restrictions on outbound traffic, by showing that these rules were matching traffic as intended.
