*TLDR: Single place where every external IP hitting your Unifi router/gateway is automatically scored and enriched with threat intelligence (AbuseIPDB + MaxMind), and patterns are surfaced without having to investigate each event by hand.*

UniFi's built-in traffic/firewall (Flow Insights) view shows you blocked connections with basic geolocation, but that's where it stops. You see an external IP hit your router from, say, China — now what?   
  
You copy it, open AbuseIPDB or CrowdSec or a WHOIS lookup in a browser, paste it, check the results. Repeat for every IP. There's no threat context, no way to tell at a glance whether it's a known botnet or background noise, no ASN to identify the network behind it, no pattern analysis over time. And if you want to see DHCP leases, Wi-Fi association events, or system logs? Those aren't in the controller UI at all — you're SSH-ing into the gateway and tailing logs manually.

I wanted a single place where every log type is parsed, every external IP is automatically scored and enriched with threat intelligence, and patterns are surfaced without me having to investigate each event by hand.

I looked at the usual suspects first. **Graylog** is powerful but it's built for enterprise-scale log aggregation. The overhead-to-insight ratio is brutal for a single device. **Wazuh** is similar — a full SIEM platform with agents, decoders, rule engines, and a learning curve that assumes you're running a SOC, not a home network. Both are excellent at what they do, but for "show me who's hitting my firewall and whether I should care," they're like bringing an aircraft carrier to a pond.

So I built **UniFi Log Insight** with the help of Claude Code— a self-hosted tool that receives syslog from your UDR/USG/UDM, enriches every event with threat intelligence and geolocation, and serves it through a live dashboard. Single Docker container, two free API keys, done.

**What it adds over stock UniFi:**

Every blocked firewall event gets enriched in real-time with MaxMind GeoIP (country, city, coordinates), ASN identification, AbuseIPDB threat scoring (0–100% with 23 decoded attack categories like SSH brute-force, port scan, DDoS), usage type (data center vs residential vs VPN), Tor exit node detection, and reverse DNS. Expand a log row and you see: "Known malicious IP from a data center in Shanghai, reported 847 times for SSH brute-force, last reported 2 hours ago."

The dashboard surfaces patterns the controller never shows — top threat IPs with ASN and attack categories, geographic breakdown of who's hitting your firewall, direction analysis, and volume trends.

**How it works:**

Point your gateway's remote syslog at the container (UDP 514). It parses firewall, DHCP, Wi-Fi, and system events, classifies traffic direction with automatic WAN IP learning, and stores everything in PostgreSQL with 60-day retention.

Threat intelligence uses a three-tier cache (memory → PostgreSQL → API) so repeat offenders don't burn API calls. A daily AbuseIPDB blacklist pull pre-seeds the top 10,000 highest-risk IPs for instant scoring. Rate limiting uses AbuseIPDB's response headers as source of truth — no internal counters that desync on container rebuilds.

**Links & Setup:**

Check out the repot at GitHub: [https://github.com/jmasarweh/unifi-log-insight](https://github.com/jmasarweh/unifi-log-insight)

The repo's readme has the setup steps and technical details.

Free, MIT licensed, open to contributions. Works with any UniFi device that supports remote syslog (UDR, UDM, UDM-Pro, USG).

**Notes**:  
  
Claude Code handled the implementation but I did the specs, plannings and code reviews. The github repo is scanned by Snyk and any security issue is reviewed and fixed.

Fell free to comment and if you think this is a helpful tool or request additional features.   
My next immediate enhancement is to plug in the Unifi Network/Device API so you could see the device names in the logs like Unifi does it in the Flow Insights....

An enhanced "Flow Insights" for UniFi routers — GeoIP, threat intelligence