Techniques are disclosed for monitoring usage of network traffic rules applied by devices on a computer network. Operations in accordance with the disclosed techniques can be performed at one or more network visibility nodes that operate as part of a visibility fabric, for example for monitoring traffic on the network. In certain embodiments, packets associated with the traffic are received at a network visibility node communicatively coupled to the network that is operable to enable visibility across the network. The network visibility node can access network traffic rules that mirror the network traffic rules applied at devices on the network. The network visibility node can further process the received packets using the accessed network traffic rules to identify packets or flows of packets that satisfy criteria associated with the accessed network traffic rules.