Features

DNS tools

• Dig — any record type, custom resolver, DNSSEC validation, +trace mode.
• Multi-resolver propagation — fan-out to a configurable resolver panel (Cloudflare 1.1.1.1, Google 8.8.8.8, Quad9 9.9.9.9, local BIND9, plus operator-added resolvers) so you can see propagation lag in real time.
• DNSSEC chain validator — walk the chain of trust from root, surface broken signatures.
• Zone health — SOA serial drift, NS consistency across authoritatives, glue checks.
• Reverse DNS — single host + bulk sweep over a CIDR.
• WHOIS — single domain + bulk; falls back through registrar / RDAP / TLD WHOIS as needed.
• Certificate Transparency / crt.sh — surface every cert ever issued for a domain.
• AXFR test — confirm zone transfers are locked down (or working, if you intended them to).
• Typosquat detection — generate likely typo permutations, check which are registered.
• SPF / DKIM / DMARC analyzer — full RFC 7208 SPF validator with DNS-lookup counting; DKIM key parser + strength check; DMARC tag parser.
• DNS flush — clear the portal's own DNS cache without restarting services.

Network tools

• Ping / traceroute / MTR — IPv4 + IPv6, configurable counts, packet-loss + latency stats.
• Port scan — TCP connect scan against a host or CIDR, with the safety caps preventing accidental wide scans.
• Packet capture — tcpdump-driven file capture; downloads as .pcap for analysis in Wireshark.
• SNMP walk — SNMPv2c and v3 (auth + priv), credential vault integration so credentials aren't pasted into the URL bar.
• ASN lookup — Team Cymru.
• BGP looking glass — RIPE RIPEstat, route + AS-path views.
• IP geolocation — locally-stored GeoLite2 lookup, no per-query API call.
• IP reputation — 8 DNSBLs: Spamhaus ZEN, Barracuda, SpamCop, SORBS, CBL, PSBL, DroneBL, Lashback UBL.
• HTTP security-header audit — HSTS, CSP, X-Frame-Options, X-Content-Type, Referrer-Policy, Permissions-Policy, cookie flags.
• Subnet / supernet calculator — describe, split into N subnets, aggregate a list of prefixes.

Threat intel

All providers below are optional integrations — add API keys in Admin → Integrations only for the ones you have accounts with. Every provider call is rate-limited per the global safety caps so a misconfigured loop can't burn your free tier.

• VirusTotal — file, hash, URL, domain, IP lookups.
• Censys — host + cert search.
• Shodan — host + service banners.
• AbuseIPDB — reported-abuse history for an IP.
• GreyNoise — background-radiation classification.
• URLScan — sandboxed URL analysis.
• Pulsedive — indicator enrichment.

Monitors

• HTTP / HTTPS — status code + body regex + max latency.
• TCP connect — port reachability.
• ICMP ping — packet loss thresholds.
• Certificate expiry — SAN-aware, with configurable warn / critical windows.
• DNS record — A/AAAA/MX/TXT/CNAME match against an expected value.

Certificates

• Portfolio sweep — feed it a list of hostnames, get expiry + issuer + SAN coverage for each.
• Watchlist — pin specific certs, page when any of them approaches expiry.
• Auto-discovery — pull certs from devices already inventoried in the portal.
• Renewal-method introspection — Let’s Encrypt / Cloudflare Origin / self-signed / manual.

Network devices & backups

• Device inventory — annotate routers, switches, firewalls, AP controllers.
• Scheduled config backups — SSH + scrape, stored locally with diff history.
• Encrypted credential vault — AES-256-GCM, HKDF-derived subkeys per device, never logged or exported in plaintext.

Runbooks & wizards

• Runbooks — Markdown procedures stored in the portal, runnable inline (the tools they reference launch from the runbook).
• Wizards — guided multi-step diagnostics (e.g. “why can’t this client reach this hostname?” chains DNS → route → firewall → TLS).

Directory

• LDAP browser — bind + search arbitrary LDAP trees, with the credential vault.
• Entra / Azure AD — read-only user + group lookups via Microsoft Graph.
• Bind verification — confirm service-account creds work before saving them to an integration.

Admin surface

• Users & RBAC — granular permission grants, role templates, single-session enforcement, admin-driven MFA reset.
• Scope manager — hide features your team doesn’t need; restrict tools to specific domains / ASNs / CIDRs.
• Integrations — wire AD/LDAP, Entra, Infoblox, NetBox, BlueCat, phpIPAM, ISC Kea, notification channels.
• System health — per-component probes (web, DB, cache, queue, scheduler), Fail2ban admin panel with persistent ignoreip overrides.
• Queues — Celery + scheduled job introspection, retry / kill, DLQ inspection.
• Webhooks — outbound integrations with HMAC-signed payloads + audit log of every delivery.
• Email / SMS channels — SMTP + Twilio (or env-var creds), per-user fallback to recovery contact.
• Lockout appeal review — public appeal form, admin review queue.
• Audit log — every mutation recorded, HMAC row chain so tampering is detectable.
• GDPR — per-user data export, right-to-be-forgotten erasure, PII redaction at audit-insert time.

Security

• Passwords — argon2id, configurable minimum length, breach-list compare on enrolment.
• MFA — TOTP (pyotp), backup codes with low-water banner, admin-driven reset, recovery contacts.
• Sessions — single-session enforcement, idle + absolute timeouts, server-side revocation on password change.
• CSRF — app-layer double-submit cookie, enforced on every mutating route.
• Audit chain — HMAC row hash linking each audit row to the previous one; tampering breaks the chain visibly.
• PII redaction — applied at audit insert, so logs never carry passwords / tokens / personal data.
• AppArmor profiles — every service runs under a tight profile.
• Credential vault — AES-256-GCM with HKDF-derived subkeys; master key + row HMAC key regenerable for fresh deployments.
• Fail2ban — SSH + portal login + lockout appeal jails, ADMIN_CIDR ignoreip seeded at install, persistent override panel.

Safety caps

Every poll, monitor, scan, and external-API call has hard-coded floor and ceiling clamps. Defaults are conservative; admins can raise them, but they can’t bypass them. The point is that a fresh install, even with bad config, can’t accidentally hammer external services or your own infrastructure.

Observability

• Prometheus /metrics — HTTP request / latency, DB up, queue depth (auth-gated by admin.system.metrics).
• API tokens — scoped, per-token rate limits, revocable, audit-logged.
• Structured logs — JSON to stdout for log-shipping; PII pre-scrubbed.

Install → Browse the docs Back home