SAM rule expiration sorting

[Bob_Zimmerman]

In SmartView Monitor, SAM rules list their expiration dates as '%R %B %d, %Y'. This expands to "hour:minute monthName zeroPaddedDayOfMonth, yearWithCentury". Sorting on this column is done in strict alphabetical order, which results in strange orderings:

09:47 April 03, 2018
09:52 March 31, 2018
10:04 April 04, 2018
10:07 April 02, 2018

I suspect nobody has ever wanted this ordering of expiration dates.

Please change the display of the expiration date to ISO 8601 format: '%FT%R', which expands to 'yearWithCentury-month-dayOfMonth', a letter T, then 'hour:minute', all with zero-padding as needed. This should cause them to sort properly with no added sorting logic.

[PhoneBoy]

I'm curious how many people actually use fw sam rules.
It's an older feature for sure.

[Bob_Zimmerman]

I use them mostly as part of SmartEvent’s automatic responses.

I’m also working on giving my company’s incident response team access to create SAM rules to lower the latency in urgent blacklist requests. The current process involves IR opening a ticket, then waiting on a whole different part of the company (IR is under CISO, people who push firewall rules are under CTO; wildly different top-level incentives) to process it. We’re working on upgrading to R80-family to take advantage of the more granular permissions, but we still have some old firewalls R80 no longer supports.

[blason]

I'm curious how many people actually use fw sam rules.
It's an older feature for sure.

I am another who is using it most. Infact all that noise over internet is being dropped because of that.

[dbrown3611]

I'm curious how many people actually use fw sam rules.
It's an older feature for sure.

Used with good results in our environment (R77.30). As with post by Zimmie, our heaviest usage is the integration with SmartEvent.

[aweldon]

I use SAM rules quite a bit - as others have said with SmartEvent reactions. Also using CPDBL for fw samp.

[ShadowPeak.com]

Anyone still using block rules via fw sam and/or the Smartview Monitor should definitely check out the capabilities of fw samp if SecureXL is enabled. Drops are enforced very early in SecureXL thus avoiding the overhead going into the Firewall Path (F2F) where fw sam rules are enforced; great for killing massive flooding attacks with minimal impact on CPU utilization. There are a crapload of other features in fw samp as well including packet/bandwidth limits, total/new connections limits, blocking by geographic country, etc:



Right now fw samp can only be accessed from the CLI, but I seem to recall hearing there may be something on the roadmap to make this feature accessible through some kind of GUI.