FireSight ghcr.io/tjindarr/unifi-insights-hub:latest https://ghcr.io/tjindarr/unifi-insights-hub latest Latest stable build from main host sh false https://raw.githubusercontent.com/Tjindarr/unifi-insights-hub/main/unraid/icon.png http://[IP]:[PORT:8095] FireSight is a self-hosted firewall log analyzer and syslog dashboard for UniFi routers (UDR / UDM / UXG / Cloud Gateway). Acts as a syslog server on UDP/514, parses UniFi firewall, STA-tracker and internal events, enriches them with GeoIP and threat intelligence (AbuseIPDB + offline FireHOL/Spamhaus blocklists), and serves a fast dark NOC-style web UI with FTS5-backed search. Single container — no separate database, no extra services. SQLite (WAL + FTS5) keeps searches snappy even on large log volumes. Features: - Syslog UDP/514 listener with UniFi RFC3164 + CEF parser - Real-time firewall log viewer with pause/resume, country + ASN, threat level - Internal events viewer (Wi-Fi roam, auth, DHCP, admin actions) in plain English - Full-text search across raw syslog (SQLite FTS5) - Per-minute event charts driven by the global time range - Pie charts for actions, categories, and external IP threat level - Optional UniFi API polling (read-only) for client name resolution - Configurable retention by age + DB size cap, hourly VACUUM - First-login forced password change, session cookie auth - Local timezone support via the TZ env var (router timestamps lack a TZ field) https://github.com/Tjindarr/unifi-insights-hub/issues https://github.com/Tjindarr/unifi-insights-hub https://raw.githubusercontent.com/Tjindarr/unifi-insights-hub/main/unraid/templates/firesight.xml https://raw.githubusercontent.com/Tjindarr/unifi-insights-hub/main/README.md Tools:System Network:Other Status:Stable unifi syslog firewall log analyzer udr udm ubiquiti security network noc A UniFi router (UDR/UDM/UXG/Cloud Gateway) configured to send remote syslog to this container on UDP/514. Optional: a read-only UniFi local user for API polling. ### 2026-06-28 - First Unraid Community Apps release of FireSight - Firewall, internal, events, logs and raw-syslog views - GeoIP + AbuseIPDB + offline threat-feed enrichment - SQLite FTS5 search, retention by age + DB size, VACUUM scheduler 2026-06-28 6.10 MIT https://raw.githubusercontent.com/Tjindarr/unifi-insights-hub/main/screenshots/overview.png https://raw.githubusercontent.com/Tjindarr/unifi-insights-hub/main/screenshots/firewall.png https://raw.githubusercontent.com/Tjindarr/unifi-insights-hub/main/screenshots/internal.png https://raw.githubusercontent.com/Tjindarr/unifi-insights-hub/main/screenshots/events.png https://raw.githubusercontent.com/Tjindarr/unifi-insights-hub/main/screenshots/logs.png https://raw.githubusercontent.com/Tjindarr/unifi-insights-hub/main/screenshots/raw.png 8095 514 /mnt/user/appdata/firesight Europe/Stockholm admin admin 30 2048