From raw firewall logs to evidence, in five stages.
Every flow your firewalls see passes through a fixed, auditable pipeline until what remains is a named, scored, actionable record. Nothing is pushed back to your firewalls at any stage.
- Ingest - FortiGate syslog over TLS (port 6514) plus a read-only REST poll for device and config state. No agents, no span ports.
- Enrich - every IP, ASN, application, country and identity resolved locally against the enriched stream.
- Hunt - a library of behavioural hunts (beaconing, brute-force, exfil/egress-drift, reconnaissance, IoC-feed matches, firmware/KEV exposure, UEBA) turns noise into named, scored, deduplicated threats.
- Illuminate - OT traffic, the IT/OT boundary and dwell-time made visible from the same stream.
- Prove - a maturity scorecard and compliance evidence your board and auditor can read.
A dual-store design: fast state, deep logs.
ThisFirewall separates the high-volume log store from the application state so the console stays fast while retaining the raw evidence. The detection engine reads the log store, and writes scored, tenant-stamped threat records back to the state store.
Components
- ClickHouse - columnar store for high-volume firewall logs, fed by Fluent Bit.
- SQLite - application and device state, threat records, and per-tenant data (one database per tenant).
- API workers - stateless, behind the firewall; a Redis cache fronts hot reads.
- Packaged as Docker containers on a single Linux host (or your own orchestration).
Tenant scoping
Every read is scoped to the caller's accessible devices, serials and clients. Threat records carry a tenant_id; log queries are constrained to the tenant's device serials. There is no cross-tenant code path on a read.
Scored, deduplicated, and explainable - not an alert firehose.
Hunts run continuously and on schedule against the enriched log stream. Each finding is created once, enriched, scored, validated, and correlated into a single record with a verdict and a recommended action - so an analyst reads stories, not thousands of orphan alerts.
- Schedule and detect - a continuous threat monitor plus scheduled hunts read ClickHouse (device-scoped).
- Create and enrich - findings are upserted (deduplicated) and enriched with owner, ASN, geo and reputation.
- Investigate - an optional AI investigator adds context; it never sees raw logs beyond the sanitised, tenant-scoped excerpt.
- Score and validate - a deterministic verdict scorer and a validator suppress false positives (for example, a 120s beacon to gaming infrastructure is correctly downgraded, not paged).
- Auto-suppress on evidence - patterns the firewall itself classifies as benign (for example, high-volume egress to a GenAI service) are auto-filed as shadow-AI on the Shadow IT view, not paged as data exfiltration, with a full audit trail. A genuine exfil to a non-AI destination still fires.
- Correlate - related signals are assembled into one attack story with a single disposition.
Run it on infrastructure you control.
A single instance is modest to run; storage scales with your log volume and retention. Deploy it self-hosted in your own datacentre or cloud, or let us host a single-tenant instance for you in the region you choose.
| Resource | Reference instance |
|---|---|
| Operating system | Ubuntu 24.04 LTS (kernel 6.8), Docker |
| Compute | ~4 vCPU |
| Memory | ~16 GB RAM (+ small swap) |
| OS disk | 150 GB SSD |
| Log store | Block storage sized to volume × retention (reference: 420 GB) |
| Ingress | 443 (console) + 6514 (syslog/TLS); SSH IP-locked |
| Deployment | Self-hosted, Belton-managed, or hybrid |
Storage is the variable that scales with you: log volume multiplied by your retention window. We size it with you during onboarding.
Read-only by design, hardened by default.
Toward your firewalls
- Ingest is syslog plus a read-only API user. ThisFirewall never writes firewall configuration.
- Policy output is review-only CLI we generate for you to apply in your own change window.
Encryption
- In transit: TLS 1.2/1.3, including syslog over TLS (6514).
- At rest: credentials and API keys encrypted with AES-256-GCM.
Identity, access & audit
- Microsoft Entra ID SSO; no passwords are stored by ThisFirewall.
- Role-based access scoped per client and per site.
- Tamper-evident audit trail - a SHA-256 hash chain recording who saw what, from where.
Network hardening
- The log store is bound to loopback; the host firewall exposes only 443 and IP-locked SSH.
- Standard helmet/CSP/HSTS, CSRF protection, and rate limiting on the console.
What stays in, and the short list of what goes out.
Your raw firewall logs never leave your instance. The only outbound calls are to the services below, each receiving the minimum needed - and you can see and constrain them.
| Service | Purpose | What is sent |
|---|---|---|
| Microsoft Entra ID | SSO / identity | Auth assertions (no passwords stored) |
| OpenAI / Anthropic (optional) | AI analysis | Sanitised, tenant-scoped prompt context, on your key |
| Threat-intel feeds | IP / indicator enrichment | Public IPs and indicators only |
| PSA (Autotask) (optional) | Ticketing / company sync | Ticket + company metadata, HMAC-signed |
No customer raw logs, no personal data beyond the above, and nothing is pooled across customers. The full dependency register is available for your security review.
Single-tenant, or database-per-tenant.
For a dedicated deployment, your instance is yours alone. In a managed multi-tenant deployment, isolation is one database per tenant, with every query scoped to the tenant's own devices and clients. Data is never co-mingled, and it stays in the region you choose.
Scales with your fleet and your logs.
The API tier is stateless and scales horizontally behind a Redis cache. ClickHouse scales horizontally for log volume and search. State lives in a single-writer store; larger fleets are served by sizing the host, and a high-availability topology is the documented path for the largest deployments.
Optional, and on your key.
- Bring your own key (OpenAI or Anthropic) or run a local LLM - no token markup.
- Prompts are sanitised, tenant-scoped and token-minimised; no model is trained on your data.
- The platform is fully usable with AI turned off; AI adds narrative context, it does not gate detection.
Engineered to the controls procurement expects.
ThisFirewall is engineered to ISO 27001 and SOC 2 principles, GDPR Article 32 (security of processing), and the NZ Privacy Act 2020 (IPP5 storage & security, IPP12 cross-border disclosure). These are framed as alignment, not certification, and the product surfaces live control-evidence views mapped to each framework.
Live in an afternoon; operable for the long run.
- Onboarding: point one firewall's syslog at ThisFirewall, add a read-only API user, and the dashboards populate from day one.
- Backups: on-host, encrypted, and restore-tested.
- Observability: health/ready/live endpoints and structured logging (never logging secrets).
- Updates: rolled with you on a managed instance, or on your schedule when self-hosted - it is the same platform either way.
Send this to your security team.
Then point one firewall at ThisFirewall for a complimentary Firewall Exposure Check, or see your own network in a 30-minute demo.
Request a demo