Firewall rule and data flow analysis and modification

A method comprising:

• presenting, in a user interface, a list of rules defined on a firewall that instruct the firewall on whether to allow or deny a specific packet of data, each rule including a property to allow or deny data and a 5-tuple including a source port, a protocol, a destination port, a source IP or FQDN, and a destination IP or FQDN;
• receiving a selection of a rule included in the presented list of rules upon which to perform analysis;
• retrieving firewall flow log data associated with the selected rule, the data of a flow included in the firewall flow log data including data indicating whether the flow was allowed or denied, an identifier of the select rule that allowed or denied the flow, and 5-tuple data;
• processing the firewall flow log data, the processing including identifying and counting occurrences of unique flows by unique 5-tuple values;
• generating, based on at least one of the occurrences of unique flows and counted flows allowed or denied by each rule of a rule base, a recommendation including at least one of:
• limiting allowances or denials of the selected rule to fewer 5-tuple values;
• deleting or deactivating the selected rule;
• and
• modifying application precedence of the selected rule;
• and
• updating the user interface to include a view of the processed firewall flow log data and selectable user interface items for each of the generated recommendations, the selection of which generates a system command to implement the selected recommendation on the firewall.

A system comprising:

• a processor;
• a network interface device;
• and
• a memory storing instructions executable by the processor to perform data processing activities comprising:
• generating user interface data renderable on a user device as a user interface to present a list of rules defined on a firewall that instruct the firewall on whether to allow or deny a specific packet of data, each rule including a property to allow or deny data a 5-tuple including a source port, a protocol, a destination port, a source IP or FQDN, and a destination IP or FQDN;
• transmitting the user interface data to a user device via the network interface device;
• receiving, via the network interface device, a selection of a rule included in the presented user interface upon which to perform analysis;
• retrieving, via the network interface device, firewall flow log data associated with the selected rule, the data of a flow including data indicating whether the flow was allowed or denied, an identifier of the select rule that allowed or denied the flow, and 5-tuple data;
• processing the firewall flow log data, the processing including identifying and counting occurrences of unique flows by unique 5-tuple values;
• generating, based on at least one of the occurrences of unique flows and counted flows allowed or denied by each rule of a rule base, a recommendation including at least one of:
• limiting allowances or denials of the selected rule to fewer 5-tuple values;
• deleting or deactivate the selected rule;
• and
• modifying application precedence of the selected rule;
• and
• updating the user interface data, by transmitting further user interface data via the network interface device to the user device, to render a view of the processed firewall flow log data and selectable user interface items for each of the generated recommendations, the selection of which generates a system command to implement the selected recommendation on the firewall.