About Unifi Log Insight
Unifi Log Insight is an MCP server published by jmasarweh in the Data category: real-time log analysis for UniFi Routers — syslog receiver (SIEM), PostgreSQL storage, IP enrichment (GeoIP, AbuseIPDB, rDNS), and React UI with live streaming, threats maps, network flow, filters, and a dashboard.
The repository has 285 stars and 19 forks, with the last commit 6 days ago. Recent commit activity is the strongest signal that reported issues will get attention.
Install
git clone https://github.com/jmasarweh/UniFi-Insights-PlusThis server has no ConduID identity, so agent calls to it are not receipted. Pin the version you install and review the source before granting it credentials.
Ask AI
Ask AI about Unifi Log Insight
Powered by Claude · Grounded in docs
Security checks
Static checks derived from the repository yesterday. Heuristics on the source, not an audit.
- ✓README presentThe repository ships documentation.
- ✓License declaredUsable under a stated license.
- ✓Tests presentA test suite exists in the repository.
- ✓Dependencies pinnedA lockfile pins dependency versions.
- ✓No dynamic code executionSource scan found no eval, dynamic Function, or shell execution.
- !Scoped permissionsDoesn't declare a permission scope. Assume it can do anything its process can.
Releases
README
✨ Features
| Feature | Description |
|---|---|
| Live Log Stream | Auto-refreshing table with expandable details, copy-to-clipboard, and intelligent pause/resume |
| Flow View | Interactive Sankey flow graph and Zone Matrix showing how traffic moves between sources, services, and destinations. Click any node to cross-filter, drill into a host slide panel for per-IP breakdowns, and save/load custom views |
| Threat Map | Interactive world map showing where threats and blocked outbound traffic originate. Switch between heatmap and cluster views, filter by time range, and click any point to inspect individual logs |
| Dashboard | Traffic breakdowns, top blocked/allowed countries and IPs, top threats with ASN/city/rDNS/categories, top devices, services, DNS queries |
| Filters | Log type, time range, action, direction, VPN badge, interface, service, country, ASN, threat score, IP, rule name, text search |
| IP Enrichment | GeoIP (country, city, coordinates), ASN, reverse DNS via MaxMind GeoLite2 with scheduled auto-update and hot-reload |
| AbuseIPDB Integration | Threat scoring (23 categories, Tor detection, usage type), daily blacklist pre-seeding, automatic backfill |
| Syslog Receiver | UDP 514 listener parsing firewall, DHCP, Wi-Fi, DNS, and system events |
| Multi-WAN & Direction | Per-interface WAN IP mapping for failover/load-balanced setups. Auto-classifies traffic as inbound, outbound, inter-VLAN, local, or VPN |
| VPN Detection | Auto-detects VPN interfaces (WireGuard, OpenVPN, Teleport, Site Magic) with badge assignment, labels, and CIDRs |
| UniFi Integration | Network discovery, device name resolution, and firewall syslog management via UniFi OS (API key) or self-hosted controllers (username/password) |
| Pi-hole Integration | DNS query logging via Pi-hole v6+ API |
| AdGuard Home | DNS query logging support (coming soon) |
| Firewall Syslog Manager | Zone matrix with bulk toggle — enable syslog on firewall rules without leaving the app (UniFi OS) |
| AI Agent Integration (MCP) | Connect Claude Desktop, Claude Code, Gemini CLI (or any http mcp client) via the Model Context Protocol (MCP) to query your network data & setup through natural conversation |
| Device Names | Friendly names from UniFi clients/devices with historical backfill |
| Theming & Preferences | Dark/light theme, country display format, IP subline (show ASN beneath IPs) |
| Interface Labels | Color-coded labels for traffic flow, applied retroactively to all logs |
| CSV Export | Download filtered results up to 100K rows |
| Retention | Configurable per log type (60-day default, 10-day DNS) and cleanup time (HH:MM, container-local). Adjustable via Settings or env vars |
| Backup & Restore | Export/import all settings as JSON |
| External DB Support | Run against an external PostgreSQL instead of the embedded one — compatible with Coolify, Unraid, managed Postgres, and any platform where bundled databases aren't allowed. Setup guide · Migration guide for existing users |
| DNS Ready | Full DNS query parsing (requires configuration) |
| Mobile Responsive | Collapsible filters, full-width table on small screens |
| Setup Wizard | Two paths: UniFi API (auto-detects WAN, VLANs, topology) or Log Detection (discovers interfaces from live traffic) |
📋 Prerequisites
- Docker and Docker Compose
- UniFi Router (or any UniFi gateway that supports remote syslog)
- Zone-based firewall (not legacy/classic). The Firewall Syslog Manager and firewall policy API require the zone-based policy engine. If you are still on the legacy/classic firewall, migrate via Settings > Policy Engine in your UniFi controller before setting up ULI.
- MaxMind GeoLite2 account (free signup) - for GeoIP/ASN lookups
- AbuseIPDB API key (free tier, recommended but optional) - for threat scoring
UniFi Network 10.x: enable SIEM-mode activity logging. Open Settings > Integrations > Syslog in the UniFi Network controller (on the default site:
https://<controller-hostname-or-ip>/network/default/integrations/syslog; multi-site controllers use their own site id in place ofdefault). Under Activity Logging choose SIEM Server and point it at the Insights Plus host, UDP port 514. Then select the log categories to forward. As of UniFi Network 10.6.106 they are Client, Security Detections, VPN and Firewall Default Policy (older 10.x builds may label them differently). Insights Plus needs Firewall Default Policy for firewall logs; the other categories are optional and forward those event types as well. If Insights Plus shows raw packet counts but nothing parses, disable SIEM, reboot the gateway, re-enable it, and re-check the categories.
Minimum host resources (estimated):
- CPU: 4 cores/threads minimum (PostgreSQL + receiver + API run concurrently)
- Memory/RAM: minimum of 4 GB of RAM
- Disk: 10 GB free for the database volume (
pgdata) at minimum
These are baseline estimates for a small home network. Higher log volume or longer retention will require more CPU cores, RAM and Disk space.
Docker log rotation is enabled by default in
docker-compose.yml(10 MB max, 5 files). If you use a custom compose file, add alogging:section to prevent unbounded container log growth.
📸 App Screenshots
Desktop
Log Stream
Expanded Log Detail
Dashboard
Dashboard — Top IPs
Flow View — Sankey Chart
Flow View — Host Detail
Flow View — Zone Matrix
Threat Map — Heatmap
Threat Map — Clusters
Threat Map — Event Detail Sidebar
Firewall Syslog Matrix
Settings
Dark Mode
Mobile
Log Stream
Flow View
Dashboard
Threat Map
📄 License
Licensed under the Business Source License 1.1 (BSL 1.1).
You may freely use, modify, and self-host UniFi Log Insight for non-commercial and internal business purposes.
You may not offer the Licensed Work to third parties on a hosted or embedded basis to compete with the Licensor's paid offerings without a commercial license.
Each version converts to Apache License 2.0 four years after its release date.
Exceptions to the BSL terms may be granted on a case-by-case basis — contact the Licensor for inquiries.
README fetched from the repository yesterday. The original is authoritative.