Insights Plus

Insights Plus is a self-hosted, open-source UniFi firewall log analyzer for making firewall logs more useful. It captures syslog events, enriches them with GeoIP and threat scores, and presents the results through traffic visualizations and dashboards.

Its live log stream shows every firewall event in real time with country flags, threat scores, reverse DNS, and device names. The tool also includes an interactive threat map with heatmap and cluster views, AbuseIPDB scoring for every public IP against 23 abuse categories, and flow visualizations using Sankey graphs. Additional features include dashboard and analytics views for traffic trends, top blocked countries, top threats with ASN, city, and rDNS context, busiest devices, and DNS breakdowns. It also enriches external IPs with country, city, coordinates, ASN, and reverse DNS, and provides a firewall syslog manager with bulk toggle controls. Multi-WAN and VPN logs are auto-detected and labeled, and CSV export and JSON backup are supported.

Insights Plus also has an AI agent that works with Claude, Gemini, or any MCP-compatible AI, letting users ask about their network in plain English. A companion browser extension brings Insights Plus data into the UniFi Network Controller, adding inline threat badges, a side panel with AbuseIPDB threat scores and related details, and an embedded dashboard tab. The extension also matches the controller’s dark and light modes.

The software is delivered as a single Docker container with no external dependencies. The page also points to a GitHub repository and shows a docker pull command for ghcr.io/jmasarweh/unifi-log-insight:latest. It is available as open source, and the page notes that it is built by jmasarweh.