# Insights Plus

> Self-hosted UniFi firewall log analyzer (SIEM) with real-time threat intelligence, GeoIP enrichment, AbuseIPDB scoring, and interactive security dashboards. Runs as a single Docker container (PostgreSQL 16, Python syslog receiver, FastAPI API, React UI). No external dependencies, zero data collection.

Insights Plus (formerly UniFi Log Insight) ingests syslog from UniFi gateways — firewall, DNS, DHCP, Wi-Fi — parses and classifies each event, enriches it with GeoIP/ASN/threat data, and serves everything through a live dashboard. Also supports Pi-hole v6 DNS ingestion, a built-in MCP server for AI agents, a Chrome/Firefox extension that embeds enrichment into the UniFi Controller, and optional built-in authentication.

For the complete docs content as a single markdown file, see [/llms-full.txt](https://insightsplus.dev/llms-full.txt).

## Getting Started

- [Introduction](https://insightsplus.dev/docs): Overview of Insights Plus, architecture, and how the enrichment pipeline works.
- [Prerequisites](https://insightsplus.dev/docs/getting-started): Required and optional dependencies (Docker, UniFi gateway, MaxMind, AbuseIPDB, UniFi API).
- [Installation](https://insightsplus.dev/docs/installation): Docker Compose quick start with per-rule syslog setup and the first-run wizard.

## Configuration

- [Environment Variables](https://insightsplus.dev/docs/configuration): Every supported env var, ports, and retention policy.
- [Authentication](https://insightsplus.dev/docs/authentication): Enabling built-in auth, session management, API tokens, and reverse-proxy `X-ULI-Proxy-Auth` setup for nginx, NPM, Caddy, Traefik.
- [MaxMind GeoIP](https://insightsplus.dev/docs/maxmind): Automatic GeoLite2 database updates and manual refresh.
- [AbuseIPDB](https://insightsplus.dev/docs/abuseipdb): Threat scoring fields, three-tier cache, blacklist pre-seeding, rate limiting.
- [Pi-hole](https://insightsplus.dev/docs/pi-hole): Polling Pi-hole v6 over the REST API to pull DNS query logs into the main log stream.
- [External Database](https://insightsplus.dev/docs/external-database): Connect to an existing PostgreSQL 14+ instance and the SECRET_KEY requirement for external DBs.

## Features

- [UI Guide](https://insightsplus.dev/docs/ui-guide): Log Stream, Dashboard, Threat Map, and Settings walkthrough.
- [AI Agent (MCP)](https://insightsplus.dev/docs/mcp): Built-in Model Context Protocol server, tool catalog, scopes, and client setup for Claude Desktop, Claude Code, Gemini CLI.
- [Browser Extension](https://insightsplus.dev/docs/browser-extension): Chrome and Firefox extension that injects enrichment badges and an embedded dashboard tab into the UniFi Controller.
- [DNS Logging](https://insightsplus.dev/docs/dns-logging): Gateway compatibility, dnsmasq limitations, and Pi-hole / AdGuard Home workarounds.
- [API Reference](https://insightsplus.dev/docs/api-reference): Full REST endpoint table including auth, logs, stats, firewall, UniFi, tokens, and MCP.

## Deployment

- [Unraid Setup](https://insightsplus.dev/docs/unraid): No-terminal install via the Unraid Docker UI with port and volume mappings.
- [Database Maintenance](https://insightsplus.dev/docs/database-maintenance): Retention cleanup, VACUUM ANALYZE vs VACUUM FULL, and Docker log rotation.
- [Troubleshooting](https://insightsplus.dev/docs/troubleshooting): Common issues — UniFi API auth errors, missing logs, GeoIP failures, external DB problems.

## Optional

- [GitHub — jmasarweh/unifi-log-insight](https://github.com/jmasarweh/unifi-log-insight): Source code, issue tracker, release notes.
- [OpenAPI Spec](https://insightsplus.dev/openapi): Interactive API reference.