[[["易于理解","easyToUnderstand","thumb-up"],["解决了我的问题","solvedMyProblem","thumb-up"],["其他","otherUp","thumb-up"]],[["很难理解","hardToUnderstand","thumb-down"],["信息或示例代码不正确","incorrectInformationOrSampleCode","thumb-down"],["没有我需要的信息/示例","missingTheInformationSamplesINeed","thumb-down"],["翻译问题","translationIssue","thumb-down"],["其他","otherDown","thumb-down"]],["最后更新时间 (UTC)：2025-08-25。"],[],[],null,["# Enable APIs and features\n\nThis page describes how to enable the APIs and features required to use\nFirewall Insights.\n\nBefore using Firewall Insights, select a project,\nensure that you have the required roles and permissions, and then complete the\nrequired setup tasks. For more information about the first two steps, see\n[Roles and permissions](/network-intelligence-center/docs/firewall-insights/concepts/roles-permissions).\n\nThe setup tasks vary based on the metrics and insights\nthat you want to use. For details, see the following table.\n\n\u003cbr /\u003e\n\n\nThe following sections describe how to enable the APIs and features.\n\nEnable the Firewall Insights API\n--------------------------------\n\nBefore performing any tasks using Firewall Insights, you\nmust enable the Firewall Insights API.\n\nTo enable the API, you can use the following steps or the\n[Google Cloud console API Library](https://console.cloud.google.com/apis/library?project=_),\ndescribed in [Enabling APIs](/apis/docs/getting-started#enabling_apis) in the\nCloud APIs documentation. \n\n### Console\n\n1. In the Google Cloud console, go to the **Firewall Insights** page.\n\n [Go to Firewall Insights](https://console.cloud.google.com/net-intelligence/firewalls)\n2. On the **Firewall Insights API** page, click **Enable**.\n\n### gcloud\n\nUse the following command: \n\n```\ngcloud services enable firewallinsights.googleapis.com\n```\n\nEnable Firewall Rules Logging\n-----------------------------\n\nIf you want to view any of the following, you must [enable\nFirewall Rules Logging](/vpc/docs/using-firewall-rules-logging#enable):\n\n- Metrics about firewall rules\n- Insights about overly permissive rules or `deny` rules; these insights are known collectively as *log-based insights*\n\nFirewall Insights\nproduces metrics and log-based insights only for those rules that have\nlogging enabled. For more information, see the\n[Firewall Rules Logging overview](/vpc/docs/firewall-rules-logging).\n\nEnable the Recommender API\n--------------------------\n\nEnable the Recommender API to do the following:\n\n- Use shadowed rule insights\n- Use overly permissive rule insights\n- Retrieve any data by making API calls or by using the Google Cloud CLI\n\n### Console\n\n1. In the Google Cloud console, go to the **Enable access to API** page.\n\n [Enable access to API](https://console.cloud.google.com/flows/enableapi?apiid=recommender.googleapis.com&_ga=2.158401658.1767111083.1627410912-1550826818.1627403508)\n2. Make sure that the correct project is selected, and then click **Next**.\n\n3. Click **Enable**.\n\n### gcloud\n\nUse the following command: \n\n```\ngcloud services enable recommender.googleapis.com\n```\n\nEnable shadowed rule or overly permissive rule insights\n-------------------------------------------------------\n\nFirewall Insights does not generate shadowed or overly\npermissive rule insights unless you actively enable these features on\nthe Firewall Insights page.\n\nAfter you enable either feature, you might\nhave to wait up to 48 hours to see the generated insights.\n\nWhen you create or update a firewall rule, you might have to wait up to ten days\nto see\n[machine learning predictions](/network-intelligence-center/docs/firewall-insights/concepts/insights-categories-states#machine-learning-predictions)\nfor overly permissive rule insights. In the meantime, you can view insights\nbased on data gathered from [Firewall Rules Logging](/vpc/docs/firewall-rules-logging).\n**Note:** If you enable these features and decide to disable them later, consider downloading the insights that Firewall Insights has generated. If you disable either feature, Firewall Insights does not save the insights previously generated for your project, even if you enable the feature later. \n\n### Console\n\n1. In the Google Cloud console, go to the **Firewall Insights** page.\n\n [Go to Firewall Insights](https://console.cloud.google.com/net-intelligence/firewalls)\n2. Click **Configuration**.\n\n3. Click **Enablement**.\n\n4. As appropriate, move the slider to **Enabled** or **Disabled** for one or\n both of the following:\n\n - **Shadowed rule insights**\n\n - **Overly permissive rule insights**\n\n### API\n\nYou can use the Recommender API to enable or disable shadowed rule insights\nand overly permissive rule insights. You can also use the API to set\nthe observation period for overly permissive rule insights and retrieve\nconfiguration details.\n\nTo enable shadowed rule insights and overly permissive rule insights, use the\n[`updateConfig` method](/recommender/docs/reference/rest/v1beta1/projects.locations.insightTypes/updateConfig).\n\nTo use the `updateConfig` method, you must set values for all of its\nparameters. When you enable or disable insights, you must also configure the\nobservation period for overly permissive insights.\n\nTo make this type of update, use the following request. \n\n```\n PATCH https://recommender.googleapis.com/v1beta1/projects/PROJECT_ID/locations/global/insightTypes/google.compute.firewall.Insight/config\n {\n \"name\": \"projects/PROJECT_ID/locations/global/insightTypes/google.compute.firewall.Insight/config\",\n \"insightTypeGenerationConfig\": {\n \"params\": {\n \"observation_period\": \"OBSERVATION_PERIOD_OVERLY_PERMISSIVE\",\n \"enable_shadowed_rule_insights\": ENABLEMENT_SHADOWED,\n \"enable_overly_permissive_rule_insights\": ENABLEMENT_OVERLY_PERMISSIVE\n }\n },\n \"etag\": \"\\\"ETAG\\\"\",\n }\n```\n\nReplace the following values:\n\n- \u003cvar translate=\"no\"\u003ePROJECT_ID\u003c/var\u003e: the ID of your project\n- \u003cvar translate=\"no\"\u003eOBSERVATION_PERIOD_OVERLY_PERMISSIVE\u003c/var\u003e: the time, in seconds, of the observation period for overly permissive rules insights\n- \u003cvar translate=\"no\"\u003eENABLEMENT_SHADOWED\u003c/var\u003e: a boolean value that represents whether shadowed rule insights are enabled\n- \u003cvar translate=\"no\"\u003eENABLEMENT_OVERLY_PERMISSIVE\u003c/var\u003e: a boolean value that represents whether overly permissive rule insights are enabled\n- \u003cvar translate=\"no\"\u003eETAG\u003c/var\u003e: the [IAM policy etag](/iam/docs/policies) value; to retrieve the etag value, use the `getConfig` method, as described in the following section\n\n#### Example\n\n```\n PATCH https://recommender.googleapis.com/v1beta1/projects/PROJECT_ID/locations/global/insightTypes/google.compute.firewall.Insight/config\n {\n \"name\": \"projects/PROJECT_ID/locations/global/insightTypes/google.compute.firewall.Insight/config\",\n \"insightTypeGenerationConfig\": {\n \"params\": {\n \"observation_period\": \"604800s\",\n \"enable_shadowed_rule_insights\": true,\n \"enable_overly_permissive_rule_insights\": true\n }\n },\n \"etag\": \"\\\"ETAG\\\"\",\n }\n```\n\n#### Retrieve configuration details\n\n\nTo retrieve details about how Firewall Insights is configured, use the\n[`getConfig` method](/recommender/docs/reference/rest/v1beta1/projects.locations.insightTypes/getConfig)\nas shown in the following example. \n\n```\n GET https://recommender.googleapis.com/v1beta1/projects/PROJECT_ID/locations/global/insightTypes/google.compute.firewall.Insight/config\n```\n\nConfigure an observation period\n-------------------------------\n\nFor some insights, you can configure an observation period, or the time interval that\nthe insight covers. For more information, see\n[Configure observation period](/network-intelligence-center/docs/firewall-insights/how-to/configure-observation-period#observation-period)\nin *Set up observation period and refresh cycle*.\n\nSchedule a custom refresh cycle\n-------------------------------\n\nYou can set up a refresh cycle to generate shadowed rule insights for your project. For more\ninformation, see\n[Schedule a custom refresh cycle](/network-intelligence-center/docs/firewall-insights/how-to/configure-observation-period#insight-schedule)\nin *Set up observation period and refresh cycle*.\n\nWhat's next\n-----------\n\n- [Firewall Insights categories and states](/network-intelligence-center/docs/firewall-insights/concepts/insights-categories-states)\n- [View and understand Firewall Insights](/network-intelligence-center/docs/firewall-insights/how-to/view-understand-insights)"]]
