Forward NQE Query to Identify Modified Firewall Rules

This NQE already exists. you can find it in the NQE Library under

John:  For Palo Alto FW, the following query will provide a basis for your requirement. 

foreach device in network.devices
foreach aclEntry in device.aclEntries
where isPresent(aclEntry.lifecycleData)
let lifecycleData = aclEntry.lifecycleData
select {
  deviceName: device.name,
  createdAt: lifecycleData.createdAt,
  lastModified: lifecycleData.lastModified,
  lastUsed: lifecycleData.lastUsed,
  truncatedHitCount: lifecycleData.truncatedHitCount
}

If you want to perform math on the dates, you can add the following to represent current time at time of collection.

let currentTime = 
            if isPresent(device.snapshotInfo.collectionTime)
              then device.snapshotInfo.collectionTime
                else device.snapshotInfo.backfillTime

Is it possible to get NQE to return the list of unused firewall rule ID’s with the results?  That is the piece of data that missing for me today.

Hi John,

when you run the build in NQE: 

/Forward Library/Security/Firewalls with Unused Security Rules

It will show you the names of the policies.

Then click on the unused policy, It will open a tab on the right side.

Scroll down to see the firewall policy name.

This will show the policy ID.

Does this solve your request?