관찰 기간 및 새로고침 주기를 구성하는 데 필요한 권한을 얻으려면 관리자에게 프로젝트에 대해 방화벽 추천자 관리자(roles/recommender.firewallAdmin) IAM 역할을 부여해 달라고 요청하세요.
역할 부여에 대한 자세한 내용은 프로젝트, 폴더, 조직에 대한 액세스 관리를 참조하세요.
이 사전 정의된 역할에는 관찰 기간 및 새로고침 주기를 구성하는 데 필요한 recommender.computeFirewallInsightTypeConfigs.update 권한이 포함되어 있습니다.
일부 통계의 경우 통계에서 처리할 기간을 의미하는 관찰 기간을 구성할 수 있습니다. 예를 들어 과도한 권한이 부여된 통계 및 deny 규칙 통계에 대해 관찰 기간을 구성할 수 있습니다. 기본 관찰 기간은 6주이고 7일에서 1년 사이로 관찰 기간을 구성할 수 있습니다.
예를 들어 deny 규칙 통계의 관찰 기간을 2개월로 설정한 경우 관찰 기간이 지난 후 적중 항목이 있는 deny 규칙 목록을 검토하면 방화벽 통계에 이전 2개월 동안 적중 항목이 있는 규칙만 표시됩니다. 나중에 관찰 기간을 1개월로 변경하면 분석 기간이 짧아지므로 방화벽 통계에서 규칙 수가 다르게 식별될 수 있습니다.
통계를 검토하고 관찰 기간을 구성할 때 다음 사항에 유의하세요.
적중이 있는 deny 규칙의 관찰 기간을 구성하면 방화벽 통계는 통계 결과를 즉시 업데이트합니다.
과도한 권한이 부여된 규칙 통계의 관찰 기간을 업데이트하면 방화벽 통계가 기존 결과를 업데이트하는 데 최대 48시간이 걸릴 수 있습니다. 그 동안 기존 결과의 관찰 기간은 이전에 구성된 관찰 기간과 일치합니다.
과도한 권한이 부여된 통계의 경우 통계에서 방화벽 규칙이 없는 것으로 식별되면 방화벽 통계에 사용된 통계를 식별하기 위한 관찰 기간이 표시되지 않습니다.
섀도 처리된 규칙 통계는 이전 데이터를 평가하지 않으므로 관찰 기간이 없습니다. 섀도 처리된 규칙 분석은 24시간마다 기존 방화벽 규칙 구성을 평가합니다.
적중 항목이 있는 deny 규칙의 관찰 기간을 설정하려면Google Cloud 콘솔을 사용해야 합니다. 하지만 Recommender API를 사용하여 과도한 권한이 부여된 규칙 통계의 관찰 기간을 설정할 수 있습니다. 또한 API를 사용하여 통계를 사용 설정하고 구성 세부정보를 검색할 수 있습니다.
[[["이해하기 쉬움","easyToUnderstand","thumb-up"],["문제가 해결됨","solvedMyProblem","thumb-up"],["기타","otherUp","thumb-up"]],[["이해하기 어려움","hardToUnderstand","thumb-down"],["잘못된 정보 또는 샘플 코드","incorrectInformationOrSampleCode","thumb-down"],["필요한 정보/샘플이 없음","missingTheInformationSamplesINeed","thumb-down"],["번역 문제","translationIssue","thumb-down"],["기타","otherDown","thumb-down"]],["최종 업데이트: 2025-08-22(UTC)"],[],[],null,["# Set up observation period and refresh cycle\n\nThis page describes how to configure an observation period and a refresh cycle in\nFirewall Insights.\n\nFor an overview of the available insights, see\n[Firewall Insights categories and states](/network-intelligence-center/docs/firewall-insights/concepts/insights-categories-states).\n\nFor a list of firewall usage metrics, see\n[View Firewall Insights metrics](/network-intelligence-center/docs/firewall-insights/how-to/view-metrics).\n\nRequired roles and permissions\n------------------------------\n\n\nTo get the permission that\nyou need to configure observation period and refresh cycle,\n\nask your administrator to grant you the\n\n\n[Firewall Recommender Admin](/iam/docs/roles-permissions/recommender#recommender.firewallAdmin) (`roles/recommender.firewallAdmin`)\nIAM role on your project.\n\n\nFor more information about granting roles, see [Manage access to projects, folders, and organizations](/iam/docs/granting-changing-revoking-access).\n\n\nThis predefined role contains the\n` recommender.computeFirewallInsightTypeConfigs.update`\npermission,\nwhich is required to\nconfigure observation period and refresh cycle.\n\n\nYou might also be able to get\nthis permission\nwith [custom roles](/iam/docs/creating-custom-roles) or\nother [predefined roles](/iam/docs/roles-overview#predefined).\n\nConfigure observation period\n----------------------------\n\nFor some insights, you can configure an *observation period* ---the time interval\nthe insight covers. For example, you can configure the observation period for\noverly permissive and `deny` rule insights. The default observation window is\nsix weeks, and you can configure the observation period between seven\ndays to one year.\n\nFor example, if you set the observation period for `deny` rule insights\nto two months, when you review the list of `deny` rules with\nhits after the observation period, Firewall Insights shows you\nonly those that had hits during the past two months. Suppose\nyou later change the observation period to one month; Firewall Insights\nmight identify a different number of rules because it would analyze a\nshorter time interval.\n\nWhen reviewing insights and configuring observation periods, be aware of the\nfollowing:\n\n- When you configure the observation period for `deny` rules with hits,\n Firewall Insights updates the insight results immediately.\n\n- When you update the observation period for overly permissive rule insights,\n Firewall Insights can take up to 48 hours to update\n existing results. In the interim, the observation period for existing\n results matches the previously configured observation period.\n\n- For overly permissive insights, if the insight identified no firewall rules,\n Firewall Insights does not display the observation period\n to identify the insights used.\n\n- Shadowed rule insights do not have an observation period because they do not\n evaluate historical data. Shadowed rule analysis evaluates your existing\n firewall rule configuration every 24 hours.\n\n- Traffic log data from the last 24 hours might not be included when\n generating insights.\n\n### Console\n\nConfigure an observation period:\n\n1. In the Google Cloud console, go to the **Firewall Insights** page.\n\n [Go to Firewall Insights](https://console.cloud.google.com/net-intelligence/firewalls)\n2. Click **Configuration**.\n\n3. Click **Observation period**.\n\n4. As appropriate, set the **Observation period** drop-down list to the\n appropriate time for each of the following:\n\n - **Overly permissive rule insights**\n\n - **Deny rule insights**\n\n### API\n\nTo set the observation period for `deny` rules with hits, you must use the\nGoogle Cloud console. However, you can use the Recommender API to set\nthe observation period for overly permissive rule insights. You can also use\nthe API to enable insights and to retrieve configuration details.\n\nTo set the observation period for overly permissive rules insights, use the\n[`updateConfig` method](/recommender/docs/reference/rest/v1beta1/projects.locations.insightTypes/updateConfig).\n\nTo use the `updateConfig` method, set values for all of its\nparameters. Also specify whether shadowed rule insights\nand overly permissive rule insights are enabled or disabled.\n\nTo make this type of update, use the following request. \n\n```\n PATCH https://recommender.googleapis.com/v1beta1/projects/PROJECT_ID/locations/global/insightTypes/google.compute.firewall.Insight/config\n {\n \"name\": \"projects/PROJECT_ID/locations/global/insightTypes/google.compute.firewall.Insight/config\",\n \"insightTypeGenerationConfig\": {\n \"params\": {\n \"observation_period\": \"OBSERVATION_PERIOD_OVERLY_PERMISSIVE\",\n \"enable_shadowed_rule_insights\": ENABLEMENT_SHADOWED,\n \"enable_overly_permissive_rule_insights\": ENABLEMENT_OVERLY_PERMISSIVE\n }\n },\n \"etag\": \"\\\"ETAG\\\"\",\n }\n```\n\nReplace the following values:\n\n- \u003cvar translate=\"no\"\u003ePROJECT_ID\u003c/var\u003e: the ID of your project\n- \u003cvar translate=\"no\"\u003eOBSERVATION_PERIOD_OVERLY_PERMISSIVE\u003c/var\u003e: the time, in seconds, of the observation period for overly permissive rules insights\n- \u003cvar translate=\"no\"\u003eENABLEMENT_SHADOWED\u003c/var\u003e: a boolean value that represents whether shadowed rule insights are enabled\n- \u003cvar translate=\"no\"\u003eENABLEMENT_OVERLY_PERMISSIVE\u003c/var\u003e: a boolean value that represents whether overly permissive rule insights are enabled\n- \u003cvar translate=\"no\"\u003eETAG\u003c/var\u003e: the [IAM policy etag](/iam/docs/policies) value; to retrieve the etag value, use the `getConfig` method, as described in the following section\n\n#### Example\n\n```\n PATCH https://recommender.googleapis.com/v1beta1/projects/PROJECT_ID/locations/global/insightTypes/google.compute.firewall.Insight/config\n {\n \"name\": \"projects/PROJECT_ID/locations/global/insightTypes/google.compute.firewall.Insight/config\",\n \"insightTypeGenerationConfig\": {\n \"params\": {\n \"observation_period\": \"604800s\",\n \"enable_shadowed_rule_insights\": true,\n \"enable_overly_permissive_rule_insights\": true\n }\n },\n \"etag\": \"\\\"ETAG\\\"\",\n }\n```\n\n#### Retrieve configuration details\n\n\nTo retrieve details about how Firewall Insights is configured, use the\n[`getConfig` method](/recommender/docs/reference/rest/v1beta1/projects.locations.insightTypes/getConfig)\nas shown in the following example. \n\n```\n GET https://recommender.googleapis.com/v1beta1/projects/PROJECT_ID/locations/global/insightTypes/google.compute.firewall.Insight/config\n```\n\nSchedule a custom refresh cycle\n-------------------------------\n\nSet up a refresh cycle to generate shadowed rule insights for your project.\n\nYou can schedule the refresh cycle to begin on a specified date and customize\nthe cycle frequency. The default cycle frequency is one day (24 hours). \n\n### Console\n\nConfigure a custom refresh cycle for insights:\n\n1. In the Google Cloud console, go to the **Firewall Insights** page.\n\n [Go to Firewall Insights](https://console.cloud.google.com/net-intelligence/firewalls)\n2. Click **Configuration**.\n\n3. Click **Enablement**.\n\n4. To enable shadowed rule insights, click the toggle.\n\n5. In the **Start on** field, enter a date from which the custom refresh\n cycle starts.\n\n6. In the **Repeat every** field, select the frequency for the refresh\n cycle starting from the cycle start date:\n\n - **day**: every 24 hours\n - **week**: every week on the days you select\n - **month**: every month\n - **quarter**: every quarter\n\n The new insight generation schedule takes effect 24 hours after saving\n changes to the schedule.\n\nWhat's next\n-----------\n\n- [View and understand Firewall Insights](/network-intelligence-center/docs/firewall-insights/how-to/view-understand-insights)\n- [Review and optimize firewall rules](/network-intelligence-center/docs/firewall-insights/how-to/review-optimize)"]]
