A Cisco firewall analyzer for FMC, FTD and ASA.
SAMURAI is a self-hosted Cisco firewall analyzer. It reads access-control and NAT policies from Firepower Management Center, pulls FTD and ASA configuration over SSH, and adds the ACLs on the IOS, IOS-XE and NX-OS gear around them. You work from the rules as they’re configured, and every change comes with the admin who made it.
Updated June 2026
What it reads from Cisco
FMC access and NAT policies
Access-control and NAT rules, policy assignments and deployable devices from FMC, searchable across every FTD it manages.
FTD and ASA over SSH
Interfaces, routes, objects and access rules straight from the devices, shown in the same view as your FMC policies.
Object groups, flattened
Network and service groups are expanded all the way down, so a rule reads “tcp/443” instead of a nested object-group name.
Router and switch ACLs
Access lists on IOS, IOS-XE and NX-OS appear next to the firewalls, so the whole Cisco path is in one place. These ACLs are shown, not risk-scored.
ACI contracts
Tenants, EPGs and contracts from APIC and NDO, so east-west fabric policy sits beside the perimeter rules.
Who changed it
FMC, FTD and ASA policy changes are detected from device state, diffed and tied to the admin and transaction behind them. Audit logs aren’t needed.
How it differs from Cisco log analyzers
Most tools sold as a “Cisco firewall log analyzer” parse syslog to tell you what traffic passed. SAMURAI reads configuration to tell you what the rules are and what changed. They answer different questions, and you may well want both.
Data source
SAMURAI
Configuration from FMC, FTD, ASA and IOS/NX-OS devices
Cisco log analyzers
Syslog and traffic logs
Question it answers
SAMURAI
What are the rules, and who changed them?
Cisco log analyzers
What traffic passed or got denied?
Scope
SAMURAI
Cisco firewalls plus routers, switches, ACI, ISE and vCenter
Cisco log analyzers
Usually firewall logs only
Deployment
SAMURAI
One self-hosted Docker container, works air-gapped
Cisco log analyzers
Log collector or SaaS pipeline
For traffic analytics, a log analyzer is the right tool. To search Cisco firewall configuration across FMC, FTD, ASA and the network around them, and to see who changed what, use SAMURAI.
Frequently asked questions
Does SAMURAI analyze Cisco Secure Firewall (FMC/FTD)?
Yes. It reads access and NAT policies, objects and deployable devices from FMC, and FTD configuration from the devices. You can search and diff policy across every managed FTD from one dashboard.
Can it read Cisco ASA?
Yes, over SSH: interfaces, routes, objects and access rules. ASA shows up in the same view as FMC and FTD.
Is this a Cisco firewall log analyzer?
No. SAMURAI reads policies and objects from the devices and doesn’t parse syslog, so you’re analyzing the rules and their changes. It can forward its own events as RFC 5424 syslog, but log analytics isn’t its job.
Does it do Cisco firewall rule cleanup or optimization?
It does the analysis. For FTD, the Policy Analyzer works out effective access, flags shadowed, redundant and overly broad rules, and ranks each rule by exposure. It doesn’t run recertification or approval workflows; policy-management suites do that.
Is there a free version?
Yes. The Docker image comes with a free test license, no email needed, so you can point it at your own Cisco firewalls before you talk to us.
How do I deploy it?
Run one container on a VM that can reach FMC, your FTD and ASA devices, and your IOS/NX-OS gear. It’s usually serving data in about five minutes.
Is there a free Cisco firewall log analyzer?
SAMURAI isn’t a log analyzer, but it is free to try: the test license ships with the image, no email needed. If you specifically want free traffic-log analytics, a dedicated log tool is a better fit. If you want to see your Cisco rules and their changes, try SAMURAI on your own devices.
Can I use SAMURAI as a Cisco firewall audit tool?
Yes, for configuration audits. You get a searchable record of FMC, FTD and ASA policies and objects, plus a change timeline showing who made each change, which covers what most audits ask for. It doesn’t produce compliance certification reports or flag unused rules by hit count.
Does it work as a Cisco firewall monitoring tool?
It monitors configuration, not traffic. SAMURAI keeps syncing FMC, FTD and ASA and flags every policy change, so you always know what the rules are and when they changed. It doesn’t draw SNMP bandwidth graphs.
Does it support legacy Cisco PIX or ASA?
ASA, yes, over SSH. PIX is end-of-life and isn’t supported; its successors, ASA and FTD, are.