PLUSInsights Plus

UI Guide

Walkthrough of every screen in Insights Plus.

Log Stream

A live-updating table of every syslog event. Filter by type, time range, action, direction, VPN, interface, service, country, ASN, threat score, or use the free-text search bar.

Click any row to expand its detail panel. The expanded view shows full enrichment data including GeoIP location, AbuseIPDB threat intelligence, resolved device names, copy-to-clipboard buttons for IPs, and the raw syslog line. The live stream auto-pauseswhile a row is expanded so you don't lose your place.

Dashboard

Aggregated analytics with a configurable time range selector. The top row shows summary cards for total, blocked, threat, and allowed event counts, plus a direction breakdown.

Below the cards you'll find area and stacked charts for traffic over time, and ranked tables for top countries, top IPs, top threats, top services, and top DNS queries.

Threat Map

A geographic visualization with two modes: Threats (inbound IPs with AbuseIPDB scores) and Blocked Outbound (outbound traffic your firewall denied). Toggle between heatmap and cluster rendering, and filter by time range.

Click any point to open an inspection sidebar with IP details. The map auto-refreshes every 60 seconds. From the Log Stream detail panel you can click "View on map" to jump directly to the geographic location of an IP.

Settings

The Settings page is divided into seven sections:

  • WAN & Networks - UniFi controller connection, WAN IP, and network configuration.
  • Firewall - Zone matrix with bulk toggle for enabling or disabling syslog on firewall policies by zone pair. See Firewall below.
  • Data & Backups - Retention slider, full database export and import for backup/restore.
  • User Interface - Theme selection, country display format, and IP subline configuration.
  • Security - Admin account management, session duration, and authentication settings.
  • API - Create and manage API tokens for programmatic access, the browser extension, and MCP integrations.
  • MCP - Enable the built-in MCP server, configure scopes, and view the audit log.

Firewall

The Firewall page manages syslog for the rules on your UniFi gateway. It needs a UniFi OS gateway and a UniFi API key (not available on self-hosted controllers).

Zone matrix

  • The grid shows every source zone (rows) against every destination zone (columns).
  • Each cell shows the default posture for traffic between those two zones:
    • Allow All: the first blanket rule in evaluation order allows traffic.
    • Block All: the first blanket rule blocks traffic, or there is no blanket rule, and nothing earlier allows return traffic.
    • Allow Return: the first blanket rule blocks traffic, but an earlier rule allows established and related (return) traffic.
  • A blanket rule is one with no conditions beyond the zone pair: no specific addresses, ports, protocols or connection states. Rules are read in evaluation order, lowest index first.
  • Only enabled rules count. Auto-generated (DERIVED) rules do not set the posture.
  • Click a cell to show only that zone pair in the policy table. Click All Policies in the top-left corner to show every rule again.
  • All Policies (N) shows the total number of rules, and the label next to the matrix shows how many of the toggleable rules have syslog enabled.

Per-rule logging toggle

  • Every row in the policy table has a syslog toggle. Turning it on makes the gateway send a syslog line each time the rule matches.
  • Changes apply on the gateway immediately but can take up to 5 minutes to show up in the Log Stream.
  • You can also toggle a rule from the Log Stream: expand a firewall log entry and use Rule Logging.

Group and bulk toggles

  • Rules with the same name are grouped. The group row's toggle switches logging for every toggleable rule in the group.
  • Enable All Logging and Disable All Logging act on every toggleable rule in the current view: the selected zone pair, or all policies when no cell is selected, after the filters are applied.
  • Bulk changes ask for confirmation first and show progress while they run.

Rules that cannot be toggled

  • Auto-generated (DERIVED) rules: created by the controller for specific devices or features. Change them in the UniFi Network app under Traffic Rules.
  • Disabled rules: shown dimmed. Enable the rule in the UniFi Network app first.
  • Rules without an id: the controller returned the rule without an id, so Insights Plus cannot address it. A notice above the table counts these rules. See Firewall policies without an id.
External DatabaseAI Agent (MCP)