Network monitoring that reads configuration, not counters.
SAMURAI is self-hosted network security monitoring for the configuration layer. It keeps track of device health, configuration changes, endpoints and compliance across Cisco APIC, FMC, NDO and ISE, Palo Alto, FortiGate, vCenter, routers and switches, and it gets all of it from the devices’ own APIs and SSH instead of SNMP polling.
Updated June 2026
What it keeps an eye on
Reachability every two minutes
HTTPS and TCP checks with per-device latency for controllers, firewalls and CLI devices alike.
Configuration changes
Snapshot diffs skip counters and other fields that change on their own, so what’s left is a real change, with the admin who made it.
Endpoints
An endpoint table built from MAC tables, ARP, DHCP snooping, CDP/LLDP and 802.1X, with vendors from an offline IEEE OUI database.
CIS compliance checks
More than 140 checks for IOS-XE, NX-OS, IOS-XR and ASA, with scores, waivers and remediation tracking.
Plugs into your stack
A Prometheus metrics endpoint and RFC5424 syslog forwarding, so the monitoring you already run can alert on it too.
Exports
Any table goes out as CSV, XLSX, HTML or PDF: inventory, policies, endpoints, compliance results.
SAMURAI vs SNMP monitoring suites
SolarWinds NPM, PRTG and Zabbix are mature SNMP monitors, and they’re good at it. SAMURAI watches another layer of the same network: how the devices are configured and what changed, rather than interface counters.
Data source
SAMURAI
Configuration and state over vendor APIs and SSH
SolarWinds / PRTG / Zabbix
SNMP polling, agents and flow collectors
What it catches
SAMURAI
Configuration changes with the admin’s name, policy drift, compliance regressions
SolarWinds / PRTG / Zabbix
Interface utilization, up/down state, performance baselines
Setup
SAMURAI
One self-hosted container; device types detected on first connect
SolarWinds / PRTG / Zabbix
SNMP or agent setup per device; licensed per sensor or element
Performance graphs
SAMURAI
Not something SAMURAI does: no bandwidth graphs or NetFlow today
SolarWinds / PRTG / Zabbix
Their core strength: counters, flows and long-term history
Bandwidth graphs and NetFlow belong to the SNMP suites. Many teams run SAMURAI next to one: the counters come from the monitor, the configuration and change history from SAMURAI.
Frequently asked questions
What is network monitoring software?
Software that keeps checking the health, configuration and inventory of your network devices and tells you when something breaks or changes. SAMURAI does this from the configuration side: reachability, configuration changes, endpoints and compliance across firewalls, switches, routers and controllers, in one self-hosted tool.
Is SAMURAI real-time network monitoring?
Reachability checks run every two minutes, and configuration syncs run continuously in the background and update the dashboard as soon as each one finishes. On any view you can also skip the cache and ask the device directly.
Does SAMURAI use SNMP or agents?
Neither. It talks to controllers and firewalls over their APIs and to routers and switches over SSH, running the same show commands you would.
How big a network can it handle?
It runs multi-vendor fleets with thousands of endpoints. Endpoint queries typically answer in under 400 ms because they run against a local copy that syncs in the background.
How does alerting work?
Sync failures, configuration drift and compliance regressions can go to Slack, Teams, Telegram, Discord, email, a webhook or your SIEM over syslog. There’s also a Prometheus endpoint if you’d rather alert from your own stack.
How do I deploy it?
Pull the image from Docker Hub and run one container. It’s fully self-hosted and works air-gapped.