All your devices,
read the same way.
SAMURAI keeps devices, endpoints, paths, policies, changes and snapshots in one model. A question about a firewall rule and a question about a switch port get answered in the same place.
Find the endpoints nobody documented
SAMURAI pulls MAC and ARP tables, DHCP snooping, CDP/LLDP neighbors, 802.1X sessions and APIC fabric hosts from every switch, router and controller, then joins them into one endpoint table. An OUI lookup tells you who made each device.
- Search by field, with subnet matching
- Correlates MAC, ARP, DHCP, CDP/LLDP, 802.1X and APIC data
- Names each device’s maker from the 39K-entry IEEE OUI list
- Syncs in the background, so a search never waits on a device
See where a flow gets dropped, hop by hop
Enter a source, destination, protocol and port. SAMURAI walks the path through routers, switches and firewalls, checks the ACL or policy at each hop against its configuration, and traces the return path too.
- Forward and return paths in one trace
- Understands wildcard masks and port ranges
- Works on IOS, NX-OS, IOS-XR, PAN-OS and FTD
- Compare any two snapshots side by side
A diff only when something really changed
Each sync compares what the device reports now with the last snapshot. It doesn’t rely on audit logs. Counters, uptimes and other fields that move on their own are ignored, so a new snapshot is stored only when someone changed something.
- No duplicate snapshots when nothing changed
- Keeps 168 snapshots per collection by default, adjustable
- Side-by-side diff for any two snapshots
- Drift alerts to Slack, Teams, Telegram, email or your SIEM
See what your firewalls actually allow
A rule says one thing. Once objects are expanded and NAT is applied, it often allows something else. SAMURAI works out what traffic actually gets through, finds shadowed, redundant and overly broad rules, and ranks every rule by how much it exposes.
- Effective access across the whole rule base, with objects and NAT resolved
- Shadowed, redundant and overly broad rules, found for you
- Rules ranked by exposure, widest first
- One policy model for Palo Alto, FTD, FortiGate, Juniper SRX and ACI
AI that can tell routine from risky.
It checks every configuration change against what it knows about your network, so routine changes stay quiet and risky ones get flagged.
- Plain facts you can read and correct
- A severity and a reason for every change
- Runs on a local model or in the cloud
Everything else you’ll use day to day
Endpoint inventory
One inventory built from MAC, ARP, DHCP, CDP/LLDP, 802.1X and APIC data, with each device’s maker looked up by OUI.
Path simulation
Trace any source, destination and port through routers, switches and firewalls, with the ACL at each hop checked against configuration.
Change monitoring
Changes are found by comparing real device data, so you catch the ones the audit trail missed.
Alert routing
Configuration drift, failed syncs and state changes go to whichever channels and incident systems you connect.
Network map
Links between devices are discovered for you. Drag devices into groups and read their health from the color.
Compliance checks
Run checks across the whole fleet, track fixes and waivers, and export a report for each framework.
Export any table
Every table exports to CSV, XLSX, HTML or PDF with your current filters applied.
Roles and LDAP
Permission-based and custom roles, scoped per user and mapped from your LDAP groups.
SSH from the browser
Open an SSH session to any device in a browser tab, with tab completion and proper line editing. No jump host to maintain.
Evidence collection
During an incident, collect per-command output bundles from a device. Each file and the archive are hash-stamped, so you can show nothing was altered.
Detection rules
Write a rule for any configuration change, preview what it would have matched, then send a notification or queue AI analysis when it fires.
High availability
Run SAMURAI as an active/passive pair with a heartbeat. If the active node goes down, the standby takes over.
HTTPS certificates
Generate a CSR, install your certificate and manage SAMURAI’s own HTTPS from Settings, using your own PKI.
Outbound proxy
Reach devices in segmented networks through a SOCKS5 or direct proxy, with a caching resolver.
Alerts go where your team already looks
Send configuration drift, failed syncs and state changes to chat, email, your SIEM or a ticket queue. The AI analysis runs on the model you pick, including one that never leaves your network.
Sent through your own mail server, with no third party in between.
Posts events to the channels you choose.
Alerts to a bot, a group or a direct chat.
Posts to your server’s channels over a webhook.
Posts events to your Teams channels.
Streams events to your SIEM over syslog.
Sends the raw event payload to any HTTP endpoint you run.
Opens a case from a network event, ready for triage.
Files issues in the projects your team already uses.
Runs the model on your own hardware, so analysis never leaves your network.
Works with OpenAI or any endpoint that speaks its API.
Uses Anthropic’s Claude models for analysis and summaries.
Runs analysis on models in your own AWS Bedrock account.
How it works
Add your devices
Add APIC controllers, FMC, NDO, Palo Alto firewalls, routers and switches. SAMURAI recognizes each platform and uses the right commands for it.
Let it sync
Background workers pull configurations, routes, MAC and ARP tables, neighbors and policies from each device, and endpoints are correlated as the data arrives.
Ask your questions
Search endpoints, trace a path, read a configuration, open the topology map or put two snapshots side by side.
Hear about drift
Real changes raise alerts in the channels your team already uses, and any table exports when an auditor asks.
The whole install is one docker run
It runs on a single VM, with no cloud dependency and nothing installed on your devices. Expect data on screen about five minutes after you start it.