1. A network security device comprising: a memory configured to: store network events; and store a set of network filter rules; a processor configured to: provide an interface for modifying the set of network rules; receive a change to a set of network rules; perform a first simulation of according to the current set of network rules and a second simulation according to the changed set of network rules using the; compare the results of the first and second simulation to identify changes in network traffic allowed and denied between the current set and the changed set of network rules; display the changes in allowed and denied traffic for review of the changed set of network rules; receive an instruction to implement the changed set of network rules based on the review; and filter network traffic according to the changed set of network rules.