hit count on whitelist entries

[giulio]

Hello i need to know what and how many times my entries in all whitelists are matched, like a hit count feature. This comes from a customer request for deleting all old and not used entries. Is this feature present ? or is it satisfable in some way ? thanks Giuliano Buraschi

[fw_mon · Accepted solution]

Hello Giuliano,

I think it is possible but needs some work (especially if you have many whitelist rules):

In each whitelist rule create a new event to write a log with a name of the white list and a : List.LastMatches property 

This will create a log with following content:

"Global Whitelist" "www.microsoft.com"

"SSL Whitelist" "*.example.com"

"URL Whitelist" "mcafee.com"

Wait a day/week/month and analyze the log with following command:

sort test.log | uniq -c | sort -gr

you'll get a list of matching entries incl list names.

after that you need to compare your whitelists with the results to find non matching entries - using a script, or excel or splunk or manually.

another option is to use PDStorage and/or Map.HasKey, but this will require even more work...