Revision Analytics
Every change your devices record is a revision. Revision Analytics reports what those revisions did to your rules over a period you choose: how much of the change was rules added, removed or modified, how the total rule count moved, and which devices the change landed on. Revisions covers what a revision is, and how the counts are produced.
The page reads from the daily history Insights collects, so the newest figures can be up to 24 hours old. Changes are made in Security Manager, and the page links through to the change list there with the device group and range already applied.
Scope and range
The selected device group and date range apply to everything on the page. The range also sets the interval the figures are grouped into. Ranges longer than your history are unavailable. Device groups covers where groups come from and what else they scope.
Change activity and net change are different numbers
Rule changes are split into new, modified and removed, reported as each one's share of the interval rather than as counts, so intervals are comparable by composition rather than by volume.
Those counts and the net change are different measures. Added, removed and modified count individual changes across every revision in the period. Net change is the difference between the total rule count at the start of the period and at the end. The two run at different scales: a year with several hundred thousand additions and removals can finish only a few thousand rules larger than it started. Subtracting removals from additions does not give the net change.
Neither the period totals nor the net change is reported as a figure. Both appear only inside the generated insight. Metrics covers how change across a selected period is measured.
The generated insight
A model writes the insight from your own figures: the start and end totals for the range, the net change and the percentage it represents, the added, removed and modified counts, and the median net growth across FireMon customers. Insights writes it once and keeps it for the day, so the same device group and range return the same wording.
Net growth against other customers appears only inside that insight. It quotes the median net rule growth across every FireMon Insights customer over the same range — each customer's change in total rule count as a percentage of what they started with — and sets your own percentage beside it. Where no other customer has usable totals, it says so rather than inventing a baseline.
Total Rules carries a customer average, but that is the average for the total rule count itself, not for net growth. Benchmarking covers who is included, and why the two sides only match at the all-devices level.
Total Rules and Tickets Created
Total Rules reports the group's rule count across the range, against the FireMon Customer Average.
Tickets Created counts the change tickets raised in each interval. That is a Policy Planner number, and Policy Planner is a separately licensed add-on, so without it there is nothing to report. Change covers the Policy Planner pages.
Breakdown by device
Each kind of change ranks the devices where the most of it happened, reporting per device:
| Figure | What it holds |
|---|---|
| New / Removed / Modified Rules in period | The device's count at the end of the range minus its count at the start |
| Percentage of total | That figure as a share of the same figure across the devices listed |
| Change over the range | The change in the device's total rule count. This is a different measure, and the only one that can be negative |
Devices are ranked by in-period change, which is not necessarily the device carrying the most rules.