netbobr0.0.0.0/0 → ANY / TCP ANY
"Just open everything for now, we'll tighten it in production." Spoiler: they never do.
the problem
Firewall requests fail review because nobody checks them first.
These land in your approval queue every day. Sound familiar?
FTP to a public database
"We need to transfer files to the DB server." Plaintext credentials over the internet. PCI violation on arrival.
No zone segmentation
"We don't have network zones yet." Flat network, no blast radius containment, auditor's worst nightmare.
Compliance finding post-deploy
"Nobody told me about NIST 800-53." The rule went live, the audit found it, now it's a P1 remediation ticket.
how it works
Three steps. Zero ambiguity.
[ 01 ]
describe the flow
Enter source, destination, protocol, and port. Or upload a CSV, Terraform plan, or cloud config.
[ 02 ]
get instant findings
Risk score (0–100), compliance violations across 6 frameworks, zone policy verdicts, and actionable remediation.
[ 03 ]
fix before you submit
Tighten the scope, switch protocols, add segmentation. Submit a clean request the first time.
the numbers
153
rules
6
frameworks
5
cloud formats
0
data collected
cli
Add to your CI/CD pipeline.
Fail builds on high-risk firewall requests. Shift left from the terminal.
Install from npm and validate firewall rules in any pipeline. Supports JSON, CSV, SARIF, table, and PDF output. Auto-detects AWS Security Groups, Azure NSG, GCP firewall rules, Kubernetes NetworkPolicy, Terraform plan JSON, and Terraform HCL.
github actionsazure devopsgitlab cijenkinssarif
compliance
Six frameworks. One analysis.
Every flow is checked against all enabled frameworks simultaneously. No separate scans, no context switching.
PCI-DSS34 rules
v4.0.1
Insecure protocols, network segmentation, database exposure, remote access, and cardholder data environment controls.
CIS Controls21 rules
v8 (IG1–IG3)
Overly permissive rules, service exposure, administrative access, DNS policy, and implementation group tiering.
NIST SP 800-5321 rules
Rev. 5
Information flow enforcement, least functionality, encrypted tunnel visibility, remote access, and baseline mapping.
NIS2 Directive20 rules
2022/2555
Network segmentation, ICS/SCADA isolation, supply chain security, and incident reporting readiness for essential entities.
DORA17 rules
2022/2554
Financial sector ICT risk management, third-party oversight, infrastructure resilience, and digital operational testing.
MITRE ATT&CK25 rules
v18.1
Initial Access, Command & Control, Lateral Movement, Exfiltration, and Discovery tactic detection with technique mapping.
also supportscsvaws-sgazure-nsggcp-fwk8s-netpoltf-plantf-hcl