Hello Duckdog
Sorry no easy answer.
If your firewall generates performance logs for cpu and memory usage that NetWitness can parse then you can monitor firewall performance.
Look for your firewall to be a supported NetWitness device type and check with your firewall team if performance logs are generated.
Reference: Integrations - https://community.netwitness.com/t5/netwitness-platform-integrations/tkb-p/netwitness-integrations
If the firewall device is not supported or the performance logs are not parsed then you can create your own Custom parser or, you can let RSA Engineering know of your interest in having a future qualified parser for this device type by going to the NetWitness Community Ideas website to "Submit an Idea" to get NetWitness Product Management attention.
Click on "Submit an Idea" and describe the suggestion on the webpage, NetWitness Ideas - https://community.netwitness.com/t5/netwitness-ideas/idb-p/netwitness-ideas
This is the location where enhancement requests can be created, and also see what other Customers are suggesting. RSA Product Management monitors these suggestions and will consider the ideas that are most voted for by Customers.
