Skip to content

// service · Assessment Technology

OT firewall policy and log analysis

Turn a ten-year firewall ruleset into a cleanup work order

Offline analysis of plant firewall configs and logs across Palo Alto, Fortinet, ASA, and Check Point. Every finding names the rule index to fix.

Book a consultation All services

// how the engagement runs

  1. 01

    Export

    Your firewall team produces a config export and a log export per device, following a written guide for that vendor. Nothing authenticates to the firewall.

  2. 02

    Policy normalization

    We normalize rules from all four vendors into one schema: zones, addresses, services, action, enabled state, and rule order. A twelve-plant estate becomes one comparable register.

  3. 03

    Policy analysis

    We flag permit-any rules, shadowed rules, overly broad subnet masks, IT-to-OT bridging rules, and bridging that happens through NAT.

  4. 04

    Log correlation

    We match log events back to rules. Hit counts confirm which rules are alive, and denied probes, administrative logins, and off-hours OT traffic surface on their own.

// who does the work

Led by senior OT practitioners

  • Engagement lead

  • Lead assessor

  • Security engineer and architect

  • Analyst

See how each engagement runs

A plant firewall ruleset holds ten years of change requests, vendor exceptions, and temporary rules that outlived the work they were for. Reading it by hand stops scaling past a few hundred rules, so the review never happens.

We parse the configuration and the logs offline and return findings at the rule index. Each finding names the rule and the reason, so your team can open a work order the day it lands.

Scope we state up front

  • The work is offline and read-only. Export instructions are written per vendor and per version for your firewall team.
  • Dead rule findings stay provisional until log data confirms them, and the register marks which is which.
  • NAT parsing is complete for PAN-OS. We validate ASA and Check Point NAT against your own export before we report on it.

Firewall analysis is one of four evidence sources in OT asset discovery and network visibility. When you add passive network capture, we also list observed flows that no permit rule allows. Send one config export and one log export, and book a consultation to review the results.

// after the engagement

The findings keep moving

Clients who want help running the fixes can put the findings in Resilion, the platform we use to run programs. Each fix gets a named owner at a named site, and the evidence lands as it closes.

See how Resilion works
Resilion task list with task IDs, sites, priority, status, and a named assignee on each task. Demo data.
Resilion · tasks routed to named owners · demo data

// FAQ

Questions about OT firewall policy and log analysis

Do you connect to our firewalls?
No. Your firewall team exports the config and logs for each device by following a written guide for that vendor and version. We never authenticate to a firewall or call its API.
Which firewall vendors do you support?
Palo Alto, Fortinet, Cisco ASA, and Check Point, which covers about 95 percent of what we find in OT. NAT parsing is complete for PAN-OS. For ASA and Check Point we validate it against a real export from your estate before we claim it. If you run another vendor, we tell you before scoping.
How small can we start?
One config export and one log export from a single device at a single plant. That shows you the findings register against your own ruleset with no connection to your network.

Talk to the people who do this work

Thirty minutes with a senior OT security practitioner. We confirm fit, plant scope, and who should be in the room. If it is not a match, we say so.

Book a consultation Book a demo