How to use this calculator
- Enter or choose rules in the policy.
- Enter or choose rules with at least one hit in the period.
- Enter or choose fully shadowed rules (optional).
- The rules used updates as you type. Use Copy result or Share to keep it.
Method
Coverage % = Rules with hits ÷ Total rules × 100; Unused = Total − Rules with hits; To review = Unused − Shadowed
- Rules with hits
- rules whose hit counter rose in the review period
- Shadowed
- rules that can never match because an earlier rule catches all their traffic
Worked example
- Coverage = 312 ÷ 480 × 100 = 65%.
- Unused = 480 − 312 = 168 rules (35%).
- 25 are shadowed and can be removed; 168 − 25 = 143 need an owner to confirm.
65% of the 480 rules carried traffic; 25 shadowed rules can go and 143 unused rules need review.
What the result means
Unused is not the same as unneeded: disaster-recovery, year-end and failover rules can be silent for months. Review with the rule owner, disable before deleting, and track coverage over time.
Assumptions and limits
- Hit counters were not reset during the period and cover every firewall enforcing the policy.
- A rule with hits may still be too broad; coverage says nothing about least privilege.
- This is a simple ratio, not a risk score.
Questions
Why must shadowed rules be among the unused ones?
A fully shadowed rule is never reached, so its hit counter stays at zero.
How long should the review period be?
Long enough to cover your slowest business cycle; many teams use 90 days or more.