Disabling multiple unused rules through the FMC API

[Scott_22]

Can multiple rules be referenced in the API script to disable those that are unused?  

[Marius Gunnerud]

Yes, this is possible. but how are you identifying the unused ACP rules? and will you be doing this through a script or using Postman, etc.?

depending on how you are doing this, you may (or may not) need to add ?bulk=true to the end of the POST URL you will be using.

[Oliver Kaiser]

6.4.0 introduced an api endpoint for hitcounts. You could do the following to disable all rules without hitcount

1. PUT to /policy/accesspolicies/{container_uuid}/operational/hitcounts) to update hitcounts (no payload needed)
2. GETto /policy/accesspolicies/{container_uuid}/operational/hitcounts to get all hitcount data

3. GET to /policy/accesspolicies/{container_uuid}/accessrules to read all accessruled

4. Loop through all hitcounts, check if hitcount = 0, edit the corresponding accessrule to set state to DISABLED (as fetched via step 3) 

5. PUT to /policy/accesspolicies/{container_uuid}/accessrules?bulk=True with the list of rules that you want to change

I created a python library to interface with FMC, maybe that will be helpful to you: https://github.com/kaisero/fireREST

There is also another cool project called fmcapi that you could look into https://github.com/daxm/fmcapi