Firewall Deny Log Analyzer

{{ badge.label }} {{ badge.value }}

Firewall log slice:

Keep the time window and source filter consistent when comparing runs.

{{ fileStatus || 'Drop one LOG, TXT, JSONL, or CSV file onto the editor.' }}

Source format:

Auto detect resolves JSON, key-value, Cisco ASA, Linux packet, and CSV rows independently; a pinned format bypasses that choice.

Deny tokens:

The default recognizes deny, drop, reject, blocked, and block.

Watch ports:

Example: 22,445,1433,3306,3389,5432.

Repeat threshold:

The slider covers common focused samples; the exact field accepts up to 1,000.

denies

Internal IPv4 CIDRs:

RFC1918 ranges are loaded by default; add routed site, cloud, VPN, or partner prefixes that your environment treats as internal.

Visible deny groups:

The default maximum is neutral and keeps every supported visible group.

groups

Visible parser rows:

The default maximum is neutral for the supported browser-local source size.

rows

Source	Destination service	Direction	Denies	Share	Policy/rule	Signal	Lines	Copy
{{ row.source }}	{{ row.destination_service }}	{{ row.direction }}	{{ row.denies }}	{{ row.share }}	{{ row.policy }}	{{ row.signal }}	{{ row.line_refs }}

Priority	Score	Focus	Evidence	First check	Copy
{{ row.priority }}	{{ row.score }}	{{ row.focus }}	{{ row.evidence }}	{{ row.next_action }}

Line	Status	Parser	Action/verdict	Source	Destination service	Policy/rule	Parser note	Copy
{{ row.line }}	{{ row.status }}	{{ row.parser }}	{{ row.action }}	{{ row.source }}	{{ row.destination_service }}	{{ row.policy }}	{{ row.note }}

No denied source-service pairs matched this slice. Review the parser ledger or adjust the deny tokens.

Loading chart…

A deny record proves that an enforcement point rejected traffic matching a rule. It does not, by itself, identify the application that sent the traffic, show whether the block was expected, or reveal whether another device translated the addresses first. Useful triage begins by preserving that distinction.

Repeated lines become easier to investigate when they are grouped into traffic paths. A path combines the same source address, destination address, transport protocol, and destination port. That grouping can expose a noisy client, a blocked dependency, an administration port under repeated probing, or a policy rule that is producing concentrated failures.

Decision evidence comes from the parsed action or verdict and the original source line.
Route context comes from comparing both IPv4 addresses with the reviewer's internal CIDR list.
Service context comes from an explicit service field or a limited destination-port name lookup.
Priority combines deny count, direction, watched ports, and an inclusive repeat threshold.

Direction is relative to the network boundary chosen for the review. Traffic is ingress when the source is outside and the destination is inside, egress in the opposite case, lateral when both are inside, and perimeter when both are outside. Missing addresses, invalid IPv4 values, or an incomplete CIDR policy can make that label unknown. Private address space alone is not a trust decision, especially across VPNs, overlapping networks, and translated paths.

Counts make sense only within a stable slice. Ten records from five minutes cannot be compared directly with ten records from a day, and logging rate limits or aggregation may cause one record to represent more than one attempt. Preserve the device scope, time window, source filter, and logging policy for before-and-after comparisons.

A high-ranked deny deserves earlier review, not automatic remediation. One blocked connection to a sensitive service may matter more than hundreds of expected background denials, while repeated traffic may come from a stale but harmless client. Confirm ownership, policy intent, change history, and endpoint evidence before suppressing logs or adding an allow rule.

How to Use This Tool:

Analyze a focused log slice and prove the parser's decisions before acting on its ranking.

Select Source format. Use Auto detect for mixed or uncertain input. Pin a named format when every line follows the same known grammar and automatic detection is ambiguous.
Paste or load the Firewall log slice. Keep it at or below 500,000 characters and preserve the collection window for any later comparison.
Set Deny tokens, Watch ports, Repeat threshold, and Internal IPv4 CIDRs. Port ranges are inclusive. The repeat bonus begins when a path count equals the selected threshold.
Check Parse Ledger. If expected denials appear as ignored or unparsed, correct the format choice, tokens, or missing source fields before trusting the aggregates.
A structured allow, allowed, accept, accepted, permit, pass, or passed decision overrides deny-like text elsewhere in the same line.
Open Deny Hotspots and Rule Review Queue. Match the leading path to its source lines, rule identity, asset owner, and change record before proposing a policy change.

Interpreting Results:

The priority bands order investigation under a local heuristic. They do not measure exploitability, compromise, business impact, or the safety of allowing traffic.

Confirm the highest-ranked group against its line references and parsed action before using its score.
Treat Unknown direction as missing route evidence, not as a fifth trusted zone.
Read ignored and unparsed counts with the deny total. Zero matches may reflect the slice, the parser, or the token vocabulary.
A familiar port name is only a lookup hint. Verify the listening application and the policy's intended source-to-destination path.

Technical Details:

Firewall records from different products can describe the same network tuple with different field names and message shapes. Normalization maps supported records into a shared representation before decision, direction, grouping, and ranking rules run.

Transformation Core

Transformation from firewall source lines to ranked deny paths
Stage	Rule	Result
Clean	Remove terminal escape sequences, standardize line endings, trim trailing spaces, and number non-empty lines.	Stable source references
Parse	Read supported JSON, key-value, Cisco ASA, Linux firewall, or CSV fields.	Source, destination, port, protocol, decision, policy, service, and reason where available
Decide	Give structured allow words precedence, then check deny tokens in structured fields and finally raw text.	Denied, ignored, or unparsed row
Classify	Compare source and destination IPv4 values with every supplied CIDR and test the destination port against the watch set.	Direction and watched status
Group	Combine equal source, destination, protocol, and destination-port tuples.	One path with count, policies, and line references
Rank	Sort by descending score, then count, then a stable path identifier.	Ordered review queue

Automatic mode resolves a parser for each line, so a single capture may report a mixed source. Pinning a format bypasses that choice. CSV headers are excluded from deny totals, while unsupported rows remain visible as parser evidence.

Rule Core

Decision order prevents a raw message from overruling an explicit allow result:

Exclude the row when its structured decision contains allow, allowed, accept, accepted, permit, pass, or passed.
Otherwise, count it as denied when a configured token appears in the structured action or verdict.
If no structured token matches, search the raw line for a configured deny token.

IPv4 direction rules and priority weights
Direction	CIDR membership	Weight
Ingress	Source outside; destination inside	7
Lateral	Source inside; destination inside	6
Egress	Source inside; destination outside	4
Perimeter	Source outside; destination outside	2
Unknown	Either address or the CIDR evidence cannot be resolved	1

CIDR membership includes the network and broadcast bounds. The direction model accepts IPv4 only; an empty CIDR list also yields Unknown.

Formula Core

Every grouped path receives two points per deny, one direction weight, and optional watched-port and repetition bonuses.

S = 2 c + w_{d} + 9 I_{watch} + 6 I_{repeat}

c is the path's deny count, w_d is its direction weight, and each indicator is 1 when its condition is true or 0 otherwise. The repeat indicator turns on at c ≥ threshold.

Firewall deny score bands
Priority	Inclusive score boundary
Low	`S` < 9
Medium	9 ≤ `S` < 16
High	16 ≤ `S` < 24
Critical	`S` ≥ 24

Three lateral denies to a watched port at a repeat threshold of 3 score 27: 6 from volume, 6 from direction, 9 from the watched-port match, and 6 from repetition. Raising the threshold to 4 removes only the repeat bonus and produces 21 points.

Group share is the path count divided by all matched deny events and is displayed to one decimal place. The visible group limit of 3 to 25 and parser-row limit of 5 to 500 shorten presentation only; complete accepted input still supplies the aggregate counts. Watch ports accept values from 0 to 65,535 and inclusive ranges, while the repeat threshold accepts 2 to 1,000.

Limitations and Privacy:

Parsing, grouping, scoring, and exports run in the browser, and raw log text is excluded from shared settings. Exported evidence can still expose internal addresses, policy names, services, and line content.

Selected parsers cannot cover every vendor version, multiline event, nested object, or SIEM rewrite.
IPv6, NAT, overlays, tunnels, and overlapping ranges can make direction incomplete or misleading.
Logging gaps, sampling, aggregation, and rate limiting can separate record count from connection-attempt count.
The heuristic does not use asset value, user identity, payload, connection state, threat intelligence, vulnerabilities, or the surrounding allow policy.

References:

Contents of an AWS Network Firewall log, Amazon Web Services.
EVE JSON Format, Open Information Security Foundation.
RFC 1918: Address Allocation for Private Internets, RFC Editor, February 1996.
How to log dropped packets with iptables, Simplified Guide.
How to test outbound firewall egress policy, Simplified Guide.