Self-hosted security tooling
Tools I needed, so I built them.
Most of what follows started as a script I wrote because the commercial option cost more than the problem, or ran in someone else's cloud, or only converted in one direction. Each one is a single Go binary with SQLite storage. Nothing phones home.
The line
RuleForge
Multivendor firewall migration. Converts between any two of Cisco ASA, FTD, PAN-OS, FortiGate and Check Point — twenty directions, through a vendor-neutral model.
RuleHawk
Firewall config auditing. Finds rules shadowed by anything above them, allows far broader than the ticket that created them, and drift against a baseline.
Decoy
Canary tokens and honeypots. Bait that no legitimate user has a reason to touch — so when one trips, it is almost never a false alarm.
Attack Surface Monitor
Enumerates your exposure the way a stranger would, on a schedule. Catches the staging host and the dangling DNS record nobody remembers.
Patchlight
CVE prioritisation. Ranks your actual inventory by CISA KEV and EPSS, not by CVSS alone. Patch what is being exploited, not what scores loudest.
CertLight
TLS monitoring past the expiry date — hostname mismatch, broken chains, weak keys, and hosts still accepting obsolete protocols behind a valid certificate.
Loglight
SIEM-lite. Ingests syslog, files, journald, Docker and Windows events, and correlates a scan followed by brute force followed by a successful login into one incident.
DmarcWatch
DMARC monitoring. Reads the aggregate reports nobody opens — who sends as your domain, who is spoofing it, and when it is safe to move to p=reject.
TopoLight
Network monitoring with a live LLDP topology map — and when a switch dies, everything behind it folds under the one root cause instead of paging you thirty times. 0.4 adds NetFlow/IPFIX/sFlow, MAC/ARP endpoints, BGP/OSPF/STP state, wireless (UniFi, Meraki, Cisco WLC, Aruba), SD-WAN health, SSH config backup with diff, probes, reports, a 2–5 node cluster and a gNMI beta. One static binary.
TenantWatch
Read-only Microsoft 365 and Google Workspace posture — accounts without MFA, over-permissioned OAuth apps, mailboxes forwarding outside the org. Since 0.2 it also reads the sign-in log: legacy authentication that actually succeeded, an admin who signed in with a password alone, a password spray that landed.
Posture Report
Reads every other tool's findings, read-only, and folds them into one posture score with an executive page and a technical page. It runs no scans of its own and changes nothing — it answers "how are we doing, and what do we fix first" on paper an auditor accepts.
AuditLight
Security assessment that never exploits — no brute force, no denial of service, no fuzzing — so it is safe to point at production. Three reports: the assessment you hand over, the process report naming every check attempted and every target skipped with its reason, and the change report that shows whether the fixes held.
Every tool can emit its findings as RFC 3164 syslog, which is how they feed each other — or feed whatever collector you already run. There is nothing Hexward-specific about the format.
Written up in detail
- Firewall migration after Expedition's end of life — what each vendor tool can and cannot do, and how to do the conversion by hand.
- Cisco ASA to Palo Alto: the mapping, and the traps — why security levels break a faithful rule translation, and how to sequence the cut-over.
- Self-hosted alternatives to Thinkst Canary — what deception buys you, what it does not, and where to place bait.
- Open source firewall rule audit — how dead rules accumulate, the pf evaluation trap, and how to find them by hand.
- Lightweight self-hosted SIEM — why small deployments die silently, and an honest comparison with Wazuh, Graylog, Security Onion and ELK.
- Attack surface discovery — how dangling DNS becomes someone else's foothold, and how to enumerate your own exposure.
- CVE prioritisation with KEV and EPSS — what each score answers, a patch order that survives a real backlog, and one API failure worth knowing.
- TLS monitoring beyond expiry — the certificate failures that have no date attached, including the one that works in your browser and nowhere else.
- DMARC monitoring and the road to p=reject — what aggregate reports contain, what RFC 9989 changed in 2026, and why so many domains never leave
p=none.
How these tools are built
Not marketing claims — constraints I hold myself to, so you can check whether I kept them.
Your data does not leave your network
Every tool runs on your infrastructure as one binary. There is no telemetry, no analytics, no usage reporting. Licence validation is offline Ed25519 cryptography: a key is verified locally and the software never needs to reach any server of mine. An expired key does not disarm anything — it returns the tool to free limits.
The free edition is genuinely usable
Free editions are Apache-2.0 and complete enough to solve a real problem, not a demo with the working parts removed. Where a limit exists it is stated on the repository page before you install anything.
Nothing is silently dropped
Where a tool cannot handle something, it says so and shows you the source line. A migration that quietly discards a rule, or a detector that quietly fails to parse a timestamp, is worse than no tool at all — because it leaves you confident and wrong.
Limits are published next to the features
Every repository has an “honest limits” section covering what the tool does not do. Deception is not prevention. A vulnerability ranking is not a patch. An attack surface scan sees what is reachable, not what is safe.
Who wrote this
Nizar Tuanku — Cybersecurity. Mostly enterprise networks and Cisco security. I build these in the evenings because I keep meeting the same problems and wanting the same tools.
Source, issues and pull requests: github.com/nizartuanku. Paid editions, for the cases where the free limits are not enough, are on Whop.