Firewall monitoring in the Network Firewall console
Firewall monitoring provides comprehensive visibility into your firewall's flow logs and alert logs. After you enable detailed monitoring, you can access these dashboards directly from the Monitoring tab in the firewall details page, without leaving the Network Firewall console.
Prerequisites for firewall monitoring
Before you can use firewall monitoring, review the following prerequisites based on your logging configuration:
Enable firewall monitoring
You can enable firewall monitoring in any of the following ways:
-
During firewall creation, using the logging configuration widget in the Configure advanced settings workflow. For more information, see .
-
From the Edit Logging Configuration page of an existing firewall For more information, see Updating a firewall in Amazon Network Firewall.
-
Directly from the Monitoring tab in the firewall details page
Considerations for using firewall monitoring
When you modify or move an Amazon S3 bucket or CloudWatch log group that is queried to populate the firewall monitoring dashboard, the metrics populated in the dashboard can become inaccurate.
When you enable detailed monitoring for a firewall that sends logs to Amazon S3:
-
Network Firewall creates Amazon Athena tables in your account to process the log data.
-
These tables are used exclusively for populating detailed monitoring dashboards and are managed by the Network Firewall console.
-
Network Firewall creates Amazon Athena metadata files (including CSV files) in your S3 bucket. These metadata files are downloadable records of the metrics that populate the firewall monitoring dashboard.
For information about how Amazon S3 integrates with Amazon Athena, see Querying Amazon S3 Inventory with Athena
For best practices on using the firewall monitoring dashboard, see Working with the firewall monitoring dashboard.