Analytics & Reporting

Turn Firewall Events Into
Business Intelligence.

Every packet decision, DNS query, and application-layer event Neurowall makes can be streamed into ClickHouse — a column-store database purpose-built for exactly this kind of high-volume, append-only analytical data. The result: dashboards and reports that answer questions your live firewall state can't.

5
Event sources feeding ClickHouse (Neurowall, Vaanvil, dnstap, Darkstat, Elf-Owl)
1
Unified analytics store for L3/L4, L7, and DNS telemetry
NATS
JetStream-backed durable delivery — no event loss on restart
The Problem

Live firewall state answers
"now." Not "why."

A firewall's operational database is built for fast rule lookups and verdicts — not for answering "which source IPs generated the most blocked traffic last quarter" or "how did DNS query volume change after we onboarded a new tenant." Those are analytical questions over historical event volume, and row-store operational databases are the wrong tool for them.

Operational vs. Analytical Workloads

Rule and threat tables are optimized for point lookups and small transactional writes. Aggregating millions of historical events across them is slow and risks contending with live traffic decisions.

Siloed Telemetry

Firewall events, DNS queries, and application-layer (L7) events are naturally captured by different subsystems. Without a shared store, correlating them (e.g. "which DNS query preceded this blocked connection") means manually joining logs by hand.

No Trend Visibility

Without a queryable history, questions about growth, seasonality, or attack trend lines require re-deriving them from raw logs every time — not a repeatable reporting process.

Compliance & Audit Reporting

Auditors and compliance reviewers want historical evidence — not just "the policy is X today," but "the policy enforced Y over the review period." That needs a queryable event history.

How It Works

One pipeline. Five sources.

Neurowall
L3/L4 verdicts
Vaanvil
L7 events
dnstap
DNS queries
Darkstat
traffic stats
Ramen
webhook + NATS JetStream ingestion, batching
ClickHouse
columnar store — fast aggregate queries over billions of rows
Dashboards, reports, ad-hoc SQL

Neurowall's telemetry sidecar, Ramen, ingests firewall (L3/L4), application-layer (Vaanvil), DNS (dnstap), and network traffic (Darkstat) events through webhooks and durable NATS JetStream subjects, batches them, and writes them into ClickHouse. Because ClickHouse is column-oriented, aggregate queries — counts, sums, distinct-value cardinality — over months of event history run in milliseconds to seconds, not minutes.

Durable by Design

Ingestion runs through NATS JetStream, so events are durably queued even if ClickHouse or Ramen is briefly unavailable — no silent data loss during restarts or maintenance windows.

What You Can Build

Reporting that goes
beyond a dashboard tile.

Use CaseDescription
Traffic trend reportingQuery historical allow/block/drop volume by source, destination, protocol, or time window — daily, weekly, quarterly
Top-talkers / top-blocked analysisRank source IPs, destinations, or rules by event volume across any historical range
DNS query analyticsAggregate dnstap records to find query volume by domain, client, or resolver — useful for both security and capacity planning
Cross-layer correlationJoin L3/L4 firewall events with L7 (Vaanvil) events in the same store to trace a request end-to-end
Compliance evidenceProduce historical enforcement reports for audit and rule-review cycles, backed by real event data rather than point-in-time snapshots
Capacity & growth planningTrack traffic growth over time per gateway or per tenant to inform scaling decisions
What Teams Do Without a BI Layer

Ad-hoc reporting doesn't
get better by repeating it.

Without a dedicated analytics pipeline, most teams answer "what does our traffic history say" the same expensive way every single time it's asked.

Common approachThe recurring cost
Manually grepping raw log filesEvery new question means writing a new ad-hoc script against unindexed text — slow, error-prone, and the analysis dies with the person who wrote it
Exporting to a spreadsheet each timeManual export-and-pivot doesn't scale past a few thousand rows, and the "report" is a one-off artifact that's stale the moment it's generated
A generic BI tool bolted onto raw logsWithout a columnar backing store, the BI tool itself becomes slow at exactly the aggregate queries it exists to answer quickly
No historical reporting at allQuestions about trends, growth, or attack patterns over time simply go unanswered — decisions get made on gut feel instead of data that already exists somewhere in the logs
What Happens Without This

Decisions get made
on incomplete information.

Leadership asks for a quarterly security posture report
Without a queryable event history, someone spends days manually reconstructing an approximate answer from scattered logs — or the report simply doesn't happen this quarter.
You need to justify a capacity upgrade
Without real traffic-growth data, the request rests on anecdote ("it feels busier") rather than a chart showing the actual trend line — a much harder case to make to budget owners.
An auditor wants evidence of enforcement over the review period
A point-in-time screenshot of current rules doesn't answer "what was enforced in March" — without historical event data, that evidence gap becomes a finding.
A pattern repeats across multiple incidents
Without cross-incident historical correlation, each occurrence gets investigated from scratch as if it were new — the connection that would speed up root-causing goes unnoticed.
Why CloudArmour

Reporting that's repeatable,
not reconstructed each time.

Built on ClickHouse, Not Bolted On

The analytics pipeline exists to make exactly these questions fast — see ClickHouse Database for why the underlying store is suited to this workload specifically.

Standard SQL, No New Tool to Learn

Reports are written in SQL against a durable event store — repeatable and version-controllable, not a one-off spreadsheet export that goes stale immediately.

Every Source, One Timeline

Firewall, DNS, and application events share the same store and time axis, so cross-source questions don't require stitching together separate tools by hand.

Answers Ready Before the Question Is Asked

Because ingestion is continuous and durable, the data needed for next quarter's report is already being collected today — no scramble when leadership or an auditor asks.

Get started

Ready to turn events into insight?