A running count of packets the firewall matched against a rule with an explicit reject action, which drops the packet and sends an RST or ICMP response back to the sender, as distinct from a silent drop. Because reject actively tells the sender the connection was refused, a spike here specifically indicates enforcement against connection attempts that were probably automated or malicious, not passive network noise. Example: fwRejected jumping from a baseline of 10 per minute to 5,000 per minute in a few seconds is characteristic of a port scan being actively rejected rule by rule.