What we’ve learned building SAMURAI: vendor API quirks, ACI fabric design, change detection that doesn’t cry wolf, and keeping thousands of endpoints in one table.
What NIST SC-7(5) and AC-4 actually ask of a rule base, the six ways deny-by-default quietly erodes, and how to check it with objects and NAT resolved.
NIST defines a baseline as a reviewed, agreed-on specification. What CM-2, CM-3 and CM-3(7) ask of network teams, and which half a change-detection tool can honestly cover.
SP 800-53 counts audit log settings as audit information. What that means for the syslog, NTP and AAA lines on firewalls and routers, and how to catch changes to them.
What SP 800-53 Rev. 5 says about admin access to switches, routers and firewalls: AC-6(3), MA-4 and IA-2(1), break-glass accounts, and a management-plane checklist.
What PS-4, PS-5 and PS-7 in SP 800-53 mean for local accounts, shared secrets and MSP engineers on network devices, and what evidence shows a departure was handled.
NIST defines continuous monitoring as a frequency you choose and justify. What CA-7 and PM-31 ask of network teams, how to fill in the parameters, and what config data can and can’t show.
What goes out the door with a failed firewall, what SP 800-53 asks you to check when the repaired unit or its replacement comes back, and why the first snapshot diff matters most.
SP 800-53 Rev. 5 withdrew dozens of controls without renumbering anything. A map of the ones network teams still cite, and how to clean up a stale mapping.
A vendor-neutral list for reviewing firewall configuration: dead and shadowed rules, what’s really reachable, NAT exposure, change control, and the evidence auditors ask for.
SolarWinds, PRTG, Zabbix, LibreNMS and Nagios, with what each does well, and where a configuration-level tool like SAMURAI fits alongside them.
Strip the fields that change on their own, hash what’s left, and compare. That kills false-positive diffs and catches the changes audit logs never recorded.
Following a packet through IOS, NX-OS and PAN-OS means reconciling three ACL syntaxes and three route table formats that agree on almost nothing.
MAC tables, ARP, DHCP snooping, CDP/LLDP, 802.1X and APIC hosts, joined in the right order, tell you more than the spreadsheet nobody has touched in months.
How thresholds and cooldown windows keep an ACI fabric monitored when an APIC goes down, without bouncing between controllers every few seconds.
The on-call nights that started SAMURAI, and the design choices that let one read-only tool stand in for APIC, Panorama, FMC, ISE and a pile of SSH sessions.
One docker load, an offline IEEE OUI database and TLS that expects self-signed certificates. That’s all it takes to run with no internet access at all.
We write when we’ve learned something worth passing on: multi-vendor quirks, fabric design, and how SAMURAI works under the hood.