A Cisco ACI analyzer that reads the fabric like you do.
SAMURAI is a self-hosted Cisco ACI analyzer that reads APIC and Nexus Dashboard Orchestrator over their APIs: tenants, EPGs, bridge domains, contracts, endpoints and fabric health. Changes are tracked and tied to the admin who made them, and the fabric sits in the same search as the firewalls, ISE and vCenter hosts it connects.
Updated June 2026
What it pulls from APIC and NDO
Who talks to whom
Tenants, application profiles, EPGs and bridge domains, with the contracts between them. Answer “can this EPG reach that one?” without clicking through the APIC GUI.
Where an endpoint lives
Fabric endpoints (fvCEp) with their MAC, IP, leaf and port, joined to the endpoint table from your access switches and routers. When a VM moves between leaves, you see it.
Multi-site policy through NDO
Nexus Dashboard Orchestrator schemas and templates sit next to each site’s APIC state, so a stretched EPG or cross-site contract reads as one thing.
An APIC cluster that fails over
SAMURAI tracks the cluster per site. If the controller it’s reading from keeps failing, it switches to a healthy one and keeps syncing.
Changes grouped by transaction
Changes are read from fabric state, grouped by APIC transaction (txId) and attributed to the admin, with timestamps in your time zone. You don’t have to decode the raw audit log.
The fabric in context
The Palo Alto or FTD at the border, the ISE policy on the access side and the vCenter hosts behind the leaves all show up in the same search.
Where it sits next to APIC
APIC configures the fabric and stays the source of truth. SAMURAI only reads from it. What it adds is search across fabrics and sites, a change history you can read, and the firewalls and servers the fabric connects, in the same place.
Role
SAMURAI
Reads, searches and keeps history. Never pushes config
APIC on its own
Configures the fabric; the source of truth
Scope
SAMURAI
ACI plus the firewalls, routers, switches, ISE and vCenter around it
APIC on its own
The fabric it controls
Change history
SAMURAI
One timeline across fabrics, grouped by transaction, with the admin’s name
APIC on its own
An audit log per controller
Deployment
SAMURAI
One self-hosted Docker container; runs air-gapped
APIC on its own
Part of the fabric itself
Keep APIC for configuration. SAMURAI is for the questions that span more than one fabric, or more than the fabric: who changed this contract, where that endpoint went, and what the border firewall does with the traffic.
Frequently asked questions
How does SAMURAI connect to Cisco ACI?
It reads the APIC REST API, and Nexus Dashboard Orchestrator for multi-site fabrics. It needs read-only access and never pushes configuration.
Does it support APIC clustering?
Yes. SAMURAI tracks the APIC cluster per site. After a set number of consecutive failures it switches to a healthy controller, waits out a cooldown, and keeps syncing.
Can it show who changed the ACI configuration?
Yes. Changes are detected from fabric state, grouped by APIC transaction (txId) and attributed to the admin. Timestamps are shown in your time zone, so the history reads like a changelog instead of a raw audit dump.
Does it cover multi-site ACI?
Yes, through Nexus Dashboard Orchestrator. NDO schemas and templates are read alongside each site’s APIC state, so cross-site policy shows up in the same view.
Is there a free version?
There’s a free test license in the Docker image on Docker Hub. No email needed, so you can point it at your own APIC before you talk to us.
How do I deploy it?
Run one container on a VM that can reach your APIC, and NDO if you use it. Most installs are showing fabric data in about five minutes.