PDF audit report

The PDF report is a branded audit report of the findings on the Audit findings page, to hand to a customer, a prospect or management. Anyone signed in can download it.

Download the report

Open Rule base, Audit findings.
Choose the Source (live firewalls or one offline snapshot), and any Finding type and Severity filters. The report uses the same filters.
Click PDF report.

Optionally fill in:

Field	Meaning
Prepared for	The customer or prospect, up to 120 characters. Shown on the cover and in the footer of every page. Optional.
Prepared by	Your name or company, up to 120 characters. Shown on the cover next to the date. Optional.

Click Download PDF. The button reads Preparing… while the report is built.

The file is named firesight-audit-<source>.pdf, for example firesight-audit-all-firewalls.pdf or the snapshot's name. Each download is recorded in the audit log.

If nothing has been audited yet, the download fails with there's no audit to report on yet: run an audit or load a snapshot first.

What the report contains

The report is A4. Every page after the cover has a FireSight header, Confidential (with prepared for and the name, if given) and a page number in the footer.

Cover

Firewall policy audit, the source (the snapshot's name, or All firewalls), a line with the number of rules, policy sets, management domains and firewalls, Prepared for (if given), the date and Prepared by (if given).

Summary: What we found

A lead paragraph: how many rules were analysed in how many policy sets, from where, when they were audited, and how many issues affect how many rules (with the percentage of all rules). Without findings, it says none matched the report's filters.
Four figures: rules analysed, rules with at least one finding, high-severity findings (critical and high), and rules that never take effect or duplicate another (shadowed plus redundant).
Findings by severity: a bar per severity on one scale.

Where to start

A table of the finding types found, in order of importance, with the number of rules, What it means and Recommended action:

Report label	Finding type
Never takes effect	Shadowed
Duplicates a rule above	Redundant
Crossing rules	Partial overlap
Too broad	Too broad
Allowed without logging	Not logged
Never used	Never hit
Not used recently	Inactive
Switched off	Disabled
Checked on a best-effort basis	Best-effort

Detail: Findings by policy set

Every finding, grouped by policy set and then by finding type. Each policy set heading shows its management domain, its number of rules and findings. Each finding type has its recommendation, and a table of Severity, Rule (the firewall's own rule ID and name) and Finding.

At most 250 findings of one type are listed per policy set; the rest are counted (…and N more. The full list is in FireSight's CSV export.). Use Download CSV for everything.

Method: How this audit works

How FireSight resolves objects, compares each rule with the rules above it, why narrow exceptions above broader rules aren't reported, why usage findings need hit counts, how rules with domain names or geography are treated, and that collecting the data was read-only.

About FireSight

A short description of FireSight (request, approve, deploy, audit, monitor), the platforms supported and planned, and how to contact FireSight.

Tips

For a customer review, load their files as an offline snapshot, choose it as the Source, and fill in Prepared for.
To focus on what matters, filter to High or a single finding type before downloading.