Firewall security analytics · Proactive SOC
ThisFirewall reads every log your FortiGate fleet sends, checks each alert before it reaches a person, hunts every five minutes and opens the ticket with the evidence attached. When you want people watching too, Belton's SOC can take the queue.
The problems it solves
Built for MSPs, internal IT teams and SOCs that run FortiGate fleets and need more than a log viewer.
Every firewall logs every session it handles. Across a fleet that is far more than anyone can read, so the connection your policy allowed sits there unread.
Every log is enriched with the IP's owner, country, application and user, then 21+ behavioural hunts run over it continuously: beaconing, brute force, exfiltration, reconnaissance and shadow IT.
Point tools raise everything and decide nothing. The alert that matters arrives with forty that don't.
Eight checks run before anything becomes an alert, including allowlists, threat intelligence, network ownership and the site's own baseline. Related signals become one case, and every host gets one verdict: clean, suspicious or compromised.
Admin access without MFA, an over-permissive rule, a support contract that quietly expired. You find out in an audit or an outage.
Each firewall's configuration is scored against best practice and the CIS FortiGate benchmark, compared with the rest of the fleet, backed up and diffed. Licence and support expiry is tracked per device.
Matching every vendor advisory to the exact build on every firewall is slow work, so it gets put off.
Firmware is matched against the NVD CVE catalogue, CISA's Known Exploited Vulnerabilities list and Fortinet PSIRT advisories, with an upgrade path to the recommended release.
SSL-VPN portals are scanned and password-sprayed constantly, and a successful login from the wrong place looks like any other login.
Hunts every five minutes catch SSL-VPN brute force and tie failures to any later success. Command-and-control beacons are caught by their timing, even inside HTTPS.
Everyone asks whether you are secure. A good answer needs evidence.
An A–F security rating, MITRE ATT&CK coverage, dwell time and control mapping to CIS, NZISM, ISO 27001 and NIST CSF, live in the console or as scheduled reports.
Proactive SOC
Most security tools wait for someone to look. ThisFirewall does the first hour of the investigation on its own, so whoever picks it up starts with a case already built.
A host on Riverbend Manufacturing's plant network opens an HTTPS session to an address in St Kitts. The firewall allows it. It is one line in a night of logs.
RBM-EDGE-FW01 · 172.20.14.7 → 203.0.113.200:443 · action=accept
Hunts run over the fleet's traffic every five minutes. This one sees the same destination every 120 seconds, give or take two. People don't keep time like that. Malware does.
c2_beaconing · interval 118–122 s · 6 sessions
Eight checks run first: not a private or reserved address, not on an allowlist, threat-intel and network-owner lookups, and this site's own baseline. The network was registered nine days ago, and this site has never talked to St Kitts before.
validation 8/8 · network age 9 days · first contact: KN
The beacon, the new network, the new country and the plant-network location are joined into a single case, scored critical, with the evidence attached.
case #15281 · CRITICAL · C2 beaconing from RBM plant host
An AI investigator reviews the case. When it is confident the activity is malicious, it opens a critical ticket in Autotask with the timeline and evidence.
verdict=malicious · ticket → Autotask (critical)
The engineer on shift, yours or Belton's, starts with one case instead of a night of logs. They block the destination at the edge as a temporary rule and raise a change to isolate the host in the next OT maintenance window, because you don't drop a live control host blind.
block 203.0.113.200/32 @ RBM-EDGE-FW01 · CHG-1042 raised
A fictional case from the demo fleet. The times are illustrative; the screens are real.
It runs on every firewall, day and night, without anyone watching.
Belton IT Nexus, the New Zealand company behind ThisFirewall, can run the queue for you. Belton analysts triage your cases, follow up the tickets and bring you the decisions that need a person.
Scope and coverage are agreed with you and quoted separately.
Ask about the managed SOCProduct tour
Every screen here comes from the read-only demo: three made-up clients, five firewalls, and the kind of trouble real networks have.
One queue for every firewall and every client, worst first. Each alert shows what was seen, where, how often and which checks it passed, so the first decision is quick.
Also hereIncidents · Compromised Hosts · Beacon Clusters · Anomalies · Dwell Time · Threat Hunting · SSL VPN Exposure
Traffic by category, unsanctioned apps and AI services, DNS, file transfer and destinations by country. Trace any IP or host across the whole fleet from one search box.
Also hereThreat Map · DNS · Log Search · IP / Host Trace · Egress Intel · File Transfer
Posture findings for every device, fleet-wide standardisation, firmware measured against Fortinet's recommended release, and a worklist that turns each firewall's open findings into one ticket.
Also hereLicensing · Standardisation · Config Backups · Config Drift · Policy Analyzer · CVE Exposure
Tag interfaces as IT, OT, DMZ or guest and the segmentation view shows every crossing, scored, with the critical paths first. OT maturity is graded on the L0 to L4 ladder from traffic actually observed, not from a questionnaire.
Also hereOT Maturity · Traffic · VPN · WAN / SD-WAN
An executive scorecard, an A–F security rating, ATT&CK coverage and dwell time, with controls mapped to CIS, NZISM, ISO 27001 and NIST CSF. Schedule the reports and they arrive on their own.
Also hereSecurity Rating · Dwell Time · Scheduled Reports · Client Reports
How it works
No agents, no span ports, no new hardware. Two settings on each firewall.
Point each FortiGate's syslog at ThisFirewall, over TLS on 6514 or UDP on 514.
ThisFirewall reads configuration, licences, firmware and health through it. It never writes to your firewalls.
Dashboards fill from the first log, hunts start straight away, and posture, licensing and firmware are scored on the first scan.
Works from the read-only API alone: inventory, posture, standardisation, licensing, firmware and fleet health from day one.
Lights up as logs arrive: hunting, cases, traffic, shadow IT, segmentation, dwell time and the proactive SOC. Both layers are in every plan.
We host, patch, monitor and back it up. Shared with a database per tenant, or a dedicated single-tenant instance.
Docker on Ubuntu 24.04 LTS, in your cloud or on-prem. Around 4 vCPU and 16 GB RAM, plus storage for your retention.
New Zealand, Australia, the EU or your own. Your data stays in the region you choose.
Pricing · Introductory rates
Introductory rates for our first customers. The platform fee covers everything ThisFirewall does. Each firewall is then priced by the size of your fleet, so the rate drops as you grow. Never per seat.
The console, continuous hunting, the proactive SOC automation, reporting and compliance evidence, for every client and site you run.
NZ$500
per month, excl. GST
plus, for every firewall
1–5 firewalls
NZ$55
per firewall / month, excl. GST
A single site or a handful of branches.
Request a demo6–25 firewalls
NZ$42
per firewall / month, excl. GST
A growing MSP book or a multi-site business.
Request a demo26–100 firewalls
NZ$30
per firewall / month, excl. GST
An established MSP or SOC fleet.
Request a demo101+ firewalls
NZ$20
per firewall / month, excl. GST
A large MSP, enterprise or national SOC.
Talk to usYour whole fleet is priced at the rate for its size. Examples, per month excl. GST:
Every feature is in every plan: threat detection and hunting, incident cases, egress and shadow AI, identity risk, fleet health, OT visibility, configuration posture, firmware exposure, dwell time and compliance evidence. Pay annually and save around 25% more.
Security and trust
Syslog in and a read-only API user. Nothing is pushed back. Fixes arrive as CLI for your own change window.
Raw logs never leave your instance. Threat-intel lookups send only public IPs and indicators.
TLS 1.2 or 1.3 in transit, including syslog over TLS. Credentials and API keys encrypted at rest with AES-256-GCM.
Microsoft Entra ID sign-in, access scoped per client and site, and a hash-chained audit trail of who saw what, from where.
Bring your own OpenAI or Anthropic key, or run a local model. Prompts are sanitised and scoped to your tenant, and no model trains on your data.
Engineered to ISO 27001 and SOC 2 principles and the New Zealand Privacy Act 2020.
Questions
No. It is read-only toward your firewalls. Policy changes come as review-only CLI that you apply yourself, in your own change window.
No sensors, no agents, no span ports. ThisFirewall ingests the syslog you already send and reads through a read-only API user.
FortiGate today. Palo Alto, Cisco, Sophos, Check Point and pfSense are on the roadmap. Tell us what you run and we will tell you where it sits.
The platform does the first pass on its own: hunts, checks, correlation, AI investigation and tickets. If you want people on the queue too, Belton IT Nexus offers a managed SOC on top, scoped with you and quoted separately.
On infrastructure we agree with you, including a dedicated single-tenant instance in your region. Your data stays yours.
An afternoon for the first firewall: point syslog at ThisFirewall, add a read-only API user, and the dashboards fill from day one.
It sees OT traffic crossing zones at the firewall, which is what segmentation governs. Deep inspection of function codes needs a sensor inside the plant, and we are clear about that line.
These rates are for the customers who join us first, while we onboard early deployments. Ask us for the specifics before you commit to a term.
Ubuntu 24.04 LTS under Docker. A single instance runs comfortably on about 4 vCPU and 16 GB RAM, plus block storage sized to your log volume and retention.
Your raw logs never leave your instance. Outbound calls are limited and disclosed: Microsoft Entra ID for sign-in, optional AI on your own key with sanitised prompts, and threat-intel feeds that receive only public IPs and indicators.
TLS 1.2 or 1.3 in transit, including syslog over TLS on 6514. Credentials and API keys are encrypted at rest with AES-256-GCM. The log store listens only on the local machine.
A database per tenant, with tenant-scoped access enforced on every read and write. A dedicated single-tenant instance is available.
Microsoft Entra ID single sign-on, role-based access scoped per client and site, and a tamper-evident, SHA-256 hash-chained audit trail of who saw what, from where.
No. Bring your own OpenAI or Anthropic key, or run a local model. Prompts are sanitised, tenant-scoped and kept small, no model is trained on your data, and the platform is fully usable with AI turned off.
Request a demo
Prefer email? [email protected] · A Belton IT Nexus product.
Ask for a free Firewall Exposure Check. Point one firewall at ThisFirewall for 24 hours, or send us a config export, and we will return a report and walk you through it in 30 minutes.
Ask for an Exposure Check
