New Validator: Identify rule usage to detect unused rules

[moshekaplan]

From https://www.reddit.com/r/paloaltonetworks/comments/11zjzdq/python_script_for_analyzing_panorama_configuration/ :

good addition to this might be identifying redundant rules, shadowed rules, or rules that aren’t shadowed but still have no hit count.

I was hoping to integrate the hit count data so I could mimic how I use policy optimizer to find rules that are deletion candidates. Something like displaying a list of all rules never since since they were created x years ago, and all rules that were once used, but have not been used for duration y.

If there's an efficient way to collect that data, I'm game to try, but it seems like the only way would be to dump all hit counts from all devices in a device group, then iterate through the rules in the device group and seeing when they were created, last reset and last hit. Could be at one request per device per rule type, it's still realistic, but would add a pretty significant amount of runtime in the initial data collection. OTOH it could probably be implemented to only run if the rule "lifespans" (x and y mentioned before) are set, so only users interested in the functionality would have the runtime cost.