[[["易于理解","easyToUnderstand","thumb-up"],["解决了我的问题","solvedMyProblem","thumb-up"],["其他","otherUp","thumb-up"]],[["很难理解","hardToUnderstand","thumb-down"],["信息或示例代码不正确","incorrectInformationOrSampleCode","thumb-down"],["没有我需要的信息/示例","missingTheInformationSamplesINeed","thumb-down"],["翻译问题","translationIssue","thumb-down"],["其他","otherDown","thumb-down"]],["最后更新时间 (UTC)：2025-08-29。"],[],[],null,["# Manage and export insights\n\nThis page describes how to list, describe, dismiss, restore,\nand export insights.\n\nRequired roles and permissions\n------------------------------\n\n\nTo get the permissions that\nyou need to manage and export insights,\n\nask your administrator to grant you the\nfollowing IAM roles on your project:\n\n- [Firewall Recommender Admin](/iam/docs/roles-permissions/recommender#recommender.firewallAdmin) (`roles/recommender.firewallAdmin`)\n- [Firewall Recommender Viewer](/iam/docs/roles-permissions/recommender#recommender.firewallViewer) (`roles/recommender.firewallViewer`)\n\n\nFor more information about granting roles, see [Manage access to projects, folders, and organizations](/iam/docs/granting-changing-revoking-access).\n\n\nThese predefined roles contain\n\nthe permissions required to manage and export insights. To see the exact permissions that are\nrequired, expand the **Required permissions** section:\n\n\n#### Required permissions\n\nThe following permissions are required to manage and export insights:\n\n- ` recommender.computeFirewallInsights.list `\n- ` recommender.computeFirewallInsights.update`\n\n\nYou might also be able to get\nthese permissions\nwith [custom roles](/iam/docs/creating-custom-roles) or\nother [predefined roles](/iam/docs/roles-overview#predefined).\n\nList insights for a project\n---------------------------\n\nTo list the insights for a project, do the following: \n\n### gcloud\n\nUse the [`gcloud recommender insights list` command](/sdk/gcloud/reference/recommender/insights/list): \n\n```\ngcloud recommender insights list \\\n --project=PROJECT_ID \\\n --location=global \\\n --insight-type=google.compute.firewall.Insight \\\n --filter=EXPRESSION \\\n --limit=LIMIT \\\n --page-size=PAGE_SIZE \\\n --sort-by=SORT_BY \\\n --format=json\n```\n\nReplace \u003cvar translate=\"no\"\u003ePROJECT_ID\u003c/var\u003e with the project ID that you want to\nlist insights for.\n\nThe `location` flag always uses the location named `global`. The\n`insight-type` flag always uses the insight type named\n`google.compute.firewall.Insight`. Unless you\nformat the output in JSON, the command output is tabular.\n\nThe following fields are optional:\n\n- \u003cvar translate=\"no\"\u003eEXPRESSION\u003c/var\u003e: apply this Boolean filter to each\n resource that you want to list\n\n If the expression evaluates as `True`,\n that item is listed. For more details and examples of filter expressions,\n run `$ gcloud topic filters` or see the\n [`gcloud topic filters` documentation](/sdk/gcloud/reference/topic/filters).\n- \u003cvar translate=\"no\"\u003eLIMIT\u003c/var\u003e: the maximum number of resources to list;\n the default number of resources listed is unlimited\n\n- \u003cvar translate=\"no\"\u003ePAGE_SIZE\u003c/var\u003e: the maximum number of resources to\n list per page\n\n The default page size is determined by the service;\n otherwise, there's no paging. Paging might be applied before or after\n \u003cvar translate=\"no\"\u003eFILTER\u003c/var\u003e and \u003cvar translate=\"no\"\u003eLIMIT\u003c/var\u003e.\n- \u003cvar translate=\"no\"\u003eSORT_BY\u003c/var\u003e: a list of comma-separated\n field key names to sort by for a resource\n\n The default order is ascending.\n To specify a descending order, prefix a field with `~` (a tilde).\n\n### API\n\nMake a `GET` request to the\n[`projects.locations.insightTypes.insights` method](/recommender/docs/reference/rest/v1/projects.locations.insightTypes.insights/get): \n\n```\nGET https://recommender.googleapis.com/v1/{parent=projects/*/locations/global/insightTypes/*}/insights\n```\n\nThe following example shows a sample response for this command: \n\n```\ninsights {\n\"name\": \"projects/{project_number}/locations/global/insightTypes/google.compute.firewall.Insight/insights/{insight-id}\"\n\"description\": \"Firewall projects/{project_id}/global/firewalls/{shadowed_firewall_name} is shadowed by projects/{project_id}/global/firewalls/{shadowing_firewall_name}.\"\n\"content\": {\n \"shadowingFirewalls\": [\n \"//compute.googleapis.com/projects/{project_id}/global/firewalls/{shadowing_firewall_name1}\"\n ]\n},\n\"lastRefreshTime\": \"2020-04-01T19:16:43Z\",\n\"observationPeriod\": \"0s\",\n\"stateInfo\" {\n \"state\": \"ACTIVE\"\n}\n\"category\": \"SECURITY\"\n\"targetResources\":[\n \"//compute.googleapis.com/projects/{project_id}/global/firewalls/{shadowed_firewall_name}\"\n ],\n\"insightSubtype\": \"SHADOWED_RULE\"\n}\n```\n\nDescribe insights\n-----------------\n\nTo describe details about a particular firewall rule in a project, do the following: \n\n### gcloud\n\nUse the [`gcloud recommender insights describe` command](/sdk/gcloud/reference/recommender/insights/describe): \n\n```\ngcloud recommender insights describe INSIGHT_ID \\\n --project=PROJECT_NAME \\\n --location=global \\\n --insight-type=google.compute.firewall.Insight\n```\n\nReplace the following:\n\n- \u003cvar translate=\"no\"\u003eINSIGHT_ID\u003c/var\u003e: the ID of the insight to describe\n- \u003cvar translate=\"no\"\u003ePROJECT_NAME\u003c/var\u003e: the name of the project that you want to list insights for\n\nThe `location` flag always uses the location named `global`. The\n`insight-type` flag always uses the insight type named\n`google.compute.firewall.Insight`.\n\n### API\n\nMake a `GET` request to the\n[`projects.locations.insightTypes.insights` method](/recommender/docs/reference/rest/v1/projects.locations.insightTypes.insights/get): \n\n```\nGET\nhttps://recommender.googleapis.com/v1/{name=projects/*/locations/global/insightTypes/*/insights/*}\n{\n \"name\": projects/PROJECT_ID/locations/LOCATION/insightTypes/INSIGHT_TYPE_ID/insights/INSIGHT_ID,\n}\n```\n\nReplace the following:\n\n- \u003cvar translate=\"no\"\u003ePROJECT_ID\u003c/var\u003e: the project ID\n- \u003cvar translate=\"no\"\u003eLOCATION\u003c/var\u003e: always use the location named `global`\n- \u003cvar translate=\"no\"\u003eINSIGHT_TYPE_ID\u003c/var\u003e: always use the value `google.compute.firewall.Insight`\n- \u003cvar translate=\"no\"\u003eINSIGHT_ID\u003c/var\u003e: the ID for the insight\n\nMark an insight as dismissed\n----------------------------\n\nIf any insight isn't meaningful, or if you want to hide it for any other reason,\nyou can dismiss it. After you dismiss an insight, the Google Cloud console no\nlonger displays the insight to you or other users unless you restore it.\n\nTo mark an insight as dismissed, do the following: \n\n### Console\n\n1. In the Google Cloud console, go to the **Firewall Insights** page.\n\n [Go to Firewall Insights](https://console.cloud.google.com/net-intelligence/firewalls)\n2. Find the appropriate card and click **View full list**.\n\n3. Select the rules that you want to dismiss, and then click **Dismiss**.\n\nRestore a dismissed insight\n---------------------------\n\nIf you dismissed an insight that you later think is relevant, you or another\nuser can restore it and make it visible in the Google Cloud console.\n\nTo restore a dismissed insight, do the following: \n\n### Console\n\n1. In the Google Cloud console, go to the **Firewall Insights** page.\n\n [Go to Firewall Insights](https://console.cloud.google.com/net-intelligence/firewalls)\n2. Click **Dismiss History** . In response, the Google Cloud console\n displays the **Dismissed insights** page.\n\n3. Select the insights that you want to restore, and then click **Restore**.\n\nExport insights\n---------------\n\nIf needed, you can export shadowed and overly permissive rule insights in CSV\nor JSON format. `Deny rules with hits` information cannot be exported because\nit is based on firewall stackdriver metrics and not on insights.\n\nYou might want to export insights for any of the following reasons:\n\n- You need to import the data into another system.\n- You want to access the data while you are offline.\n- You intend to disable Firewall Insights, but you want to retain access to previously generated insights.\n\nTo export insights, do the following: \n\n### Console\n\n1. In the Google Cloud console, go to the **Firewall Insights** page.\n\n [Go to Firewall Insights](https://console.cloud.google.com/net-intelligence/firewalls)\n2. Click **Save as**.\n\n3. Follow the prompts to choose a format for your insights and download them.\n\nYou can also export insights to BigQuery. When you export\ninsights to BigQuery, you can view daily snapshots of insights for\nyour organization. For more information, see\n[Export recommendations to BigQuery](/recommender/docs/bq-export/export-recommendations-to-bq).\n\nWhat's next\n-----------\n\n- [Review and optimize firewall rules](/network-intelligence-center/docs/firewall-insights/how-to/review-optimize)"]]
