{{ summaryTitle }}
{{ summaryValue }}

{{ summaryLine }}

High risk{{ resultsReady ? computation.values.high_risk_rules : '—' }} Stale{{ resultsReady ? computation.values.stale_rules : '—' }} Owner gaps{{ resultsReady ? computation.values.owner_gaps : '—' }}
Use a recent export. The tool parses one local inventory and never connects to a firewall.
{{ sourceLineCount }} rows
{{ sourceStatus }}
Use the recertification or change-review cutoff date.
Choose the policy surface closest to the reviewed rule set.
Use the review interval in your firewall governance policy.
days
Keep 0 for an unused-rule signal; raise it only when policy defines low use.
hits
Use 0 when the review should flag only already-expired access.
days
Any, wildcard, /0, and IPv6 ::/0 remain broad regardless of this threshold.
/
Examples: ssh, rdp, smb, mssql, mysql, postgres, vnc, or numeric ports.
Leave blank to use the tool name. The neutral default changes no result.
{{ computation.values.report_markdown }}
RuleRecommendationRiskOwnerReasonNext actionCopy
{{ row.rule }}{{ row.recommendation }}{{ row.risk_level }} ({{ row.risk_score }}){{ row.owner }}{{ row.reason }}{{ row.next_action }}

The chart renderer is unavailable. The queue and evidence tables remain available.

RuleActionProtocol/serviceSourceDestinationOwnerLast usedHits 30dExpiryDecisionEvidenceCopy
{{ row.rule }}{{ row.action }}{{ row.protocol_service }}{{ row.source }}{{ row.destination }}{{ row.owner }}{{ row.last_used }}{{ row.hits_30d === null ? 'Unknown' : row.hits_30d }}{{ row.expires || 'Not set' }}{{ row.decision }}{{ row.reason }}
Firewall Deny Log Analyzer Analyze firewall deny logs into ranked traffic paths using format-aware parsing, CIDR direction checks and transparent priority scores.
Firewall Rule Matrix Generator Build a reviewable firewall rule matrix from flow rows with least-privilege findings, deterministic risk cues, and platform handoff guidance.
iptables Rule Generator Build bounded iptables or ip6tables commands for a packet path with explicit CIDR and port matches, persistence choices, and production-safety checks.
IAM Policy Permissions Analyzer Review AWS IAM policy JSON for wildcard breadth, privilege paths, and policy-shape issues before validating effective access in AWS.

Firewall policies tend to accumulate exceptions. Temporary access survives its project, applications move without updating ownership, counters remain quiet for months, and a broad source range stays in place because nobody can prove it is safe to narrow. A review turns those weak signals into questions for owners and firewall engineers before they become permanent policy debt.

No single field proves that a rule should be removed. Zero recent hits may mean the service is dormant, the observation window is too short, logging is incomplete, or traffic matches an earlier rule. An expired date may be decisive for a temporary exception but still needs object expansion, rule-order, NAT, and rollback checks before production policy changes.

  • Accountability asks whether an owner and current business justification exist.
  • Use evidence compares last-used age and recent hit counts with the review policy.
  • Exposure looks for broad sources or destinations and privileged services on allow rules.
  • Lifecycle checks expiry, enabled state, and the recorded recertification decision.

The review surface changes the meaning of exposure. Internet-edge and administrative-access rules assign more weight to broad sources, while administrative access also raises the weight of privileged services. Host firewalls do not receive the broad-destination penalty used for other surfaces.

A cleanup score is a prioritization aid, not evidence of exploitability or authorization to delete a rule. The safest outcome is a queue that tells reviewers which rows need confirmation, what triggered the concern, and which production checks must precede an approved change.

How to Use This Tool:

Use a recent policy export with stable rule identifiers and the best available ownership, usage, and expiry evidence.

  1. Paste the firewall rule inventory. A recognized header can map common column names; headerless data must follow the supported positional shape.
  2. Set the review date and choose the surface that best matches the inventory: Internet edge, internal segmentation, administrative access, or host firewall.
  3. Adjust the stale-day, low-hit, expiry-warning, broad-prefix, and privileged-service thresholds to match the governance policy being applied.
  4. Read the Rule queue from Critical downward. Confirm each trigger against the full policy, objects, NAT, logs, and owner evidence.
  5. Open an authorized removal, tightening, or recertification change only after the recommendation has been reviewed by the accountable owner and firewall engineer.

Interpreting Results:

The queue contains every row whose recommendation is not Keep, plus any row scoring at least 25. It is ordered by risk band, then score, then original inventory order. Start with Critical and High rows, but preserve protective deny rules unless order or shadow analysis shows they are no longer needed.

Remove and Tighten scope are review recommendations, not executable decisions. Owner review calls for accountability evidence, while Recertify asks for current use and approval evidence. A low score can still hide missing context that the pasted inventory does not contain.

Technical Details:

Each parsed row is normalized into action, protocol, source, destination, service, owner, justification, last-used date, 30-day hits, expiry, review decision, note, and enabled state. Calendar comparisons use whole days relative to the selected review date. A rule is stale only when its age is greater than the stale threshold; known hits are low-use when they are less than or equal to the hit threshold.

Any source, wildcard, 0.0.0.0/0, and ::/0 are always broad. Other CIDR values are broad when their prefix length is less than or equal to the selected IPv4 threshold. Named services are mapped to ports before comparison with the privileged-service set.

Formula Core

Active signal weights are added, deny rules subtract eight points, and the result is clamped to the 0-to-100 display range.

S = min ( 100 , max ( 0 , ∑j=1n wj − 8D ) )

S is the rule score, each w is an active signal weight, and D is 1 for a deny rule and 0 otherwise. Scores from 0 to 24 are Low, 25 to 49 Medium, 50 to 74 High, and 75 to 100 Critical.

Rule Core

SignalWeightExact condition
Disabled row+6Enabled state is false or equivalent.
Missing owner+22Owner is blank or a recognized unknown placeholder.
Missing justification+10Business justification is blank.
Missing or stale use+18Last-used date is missing, or age is greater than the stale threshold.
Low use+12A known 30-day hit count is at or below the selected threshold.
Expired+24Expiry is before the review date.
Near expiry+12Expiry is from 0 through the warning-window days after review.
Broad allow source+24 or +16+24 at Internet edge or administrative access; +16 for other surfaces.
Broad allow destination+8Destination is broad and the surface is not Host firewall.
Privileged allow service+22 or +14+22 for administrative access; +14 for other surfaces.
Decision: remove+32The imported review decision requests removal.
Decision: review+14The imported review remains pending.
Decision: tighten+20The imported review requests a scope change.
Deny action−8The normalized action is deny, drop, block, or reject.

Recommendations use ordered rules. Disabled rows become Archive disabled row. An explicit remove decision, or an expired rule that is also stale or low-use, becomes Remove. Broad privileged allows become Tighten scope; missing ownership or justification becomes Owner review; an explicit tighten decision also tightens scope; and remaining rows scoring at least 25 or marked for review become Recertify. All others remain Keep.

Limitations and Privacy Notes:

The heuristic cannot evaluate object groups, effective rule order, shadowing, NAT, application identity, complete traffic history, or change authorization. It also cannot tell whether missing data means low risk or incomplete export coverage.

The inventory is parsed in the browser and no firewall is contacted. Rule text and settings can be retained in a shareable page address, so remove secrets, private identifiers, and sensitive network details before sharing that address or a generated report.

Worked Examples:

Stale Internet-wide SSH exception

An enabled allow rule from 0.0.0.0/0 to SSH at the Internet edge has zero 30-day hits, is more than 180 days since last use, expired before the review date, and remains marked for review. Those signals add more than 100 points before clamping, so the result is Critical 100 and the ordered recommendation is Remove. Reviewers should confirm the owner, object expansion, logs, rule order, NAT, and an approved replacement path before changing production policy.

References: