Compliance Rules

netbobr evaluates flows against 7 rule sets: built-in structural rules that are on by default and individually toggleable in the Rules tab, plus 6 compliance frameworks that can be toggled independently - enable only the standards relevant to your environment, or run all of them at once for maximum coverage.

The built-in rules detect structural issues like overly broad addresses, dangerous port ranges, and protocol misconfigurations. The compliance frameworks span payment card security (PCI-DSS), general IT hygiene (CIS Controls), US federal standards (NIST 800-53), EU network security (NIS2), financial sector resilience (DORA), and adversary technique detection (MITRE ATT&CK). Together they provide 153 active rules (15 built-in + 138 framework rules) covering insecure protocols, overly permissive access, network segmentation violations, remote access exposure, and more.

This section documents every rule in each framework, plus the built-in structural rules and the port/service risk database that powers service detection.

The rule tables show each rule's worst-case severity, the same severity the Rules tab shows. Some rules emit a lower severity in less exposed cases, for example a /17 to /20 address instead of a /16-or-wider one. Each framework page lists these tiers.

ICMP has no ports, so an ICMP flow never counts as "all ports" or a "wide port range" in any rule. An all or blank ICMP type field means every known ICMP type, so type-specific checks such as ICMP Redirect (PCI-NET-091) and Echo Request (ATK-T1018-01) fire for it.

DORA-NET-033 is registered but not evaluated, because it needs a user-configurable list of financial messaging ports. It is not included in the 153.