ruledoc.io v0.2
Get started
Features

Reads any major firewall config. Maps it to six frameworks. Outputs a report your auditor will sign.

Below is everything the product does, with the level of detail a security engineer expects. If something is missing, ask. sales@ruledoc.io.

How it works.

Three steps. Most uploads complete in under 90 seconds. The longest config we have seen in production was 47 MB and finished in 2 minutes 6 seconds.

  1. 01 · Upload

    Drop the config.

    Text, XML, or vendor backup format. Up to 50 MB per file. The vendor selector tells you the exact extensions accepted, with the menu path in your firewall's GUI to find them.

  2. 02 · Normalize

    Parser does the work.

    Vendor-specific parsers extract rules, zones, NAT, IPsec, logging, authentication, sessions, and HA into one structured form. Same shape whether your firewall is a Clavister .bak or a FortiGate .conf.

  3. 03 · Report

    Pick the framework.

    Read findings by severity, with control mapping and remediation. Export the PDF for the auditor and the JSON for your GRC tool. Same data, two shapes.

Six frameworks. Same evidence, different lens.

Every framework gets the same uploaded config and produces its own report. The control codes are real, taken straight from the source standard. We do not invent mappings.

NIS2 EU directive
Network and Information Security 2 Risk management, incident reporting, supply-chain security. Article 21(2) covers ten measures, all surfaced.
example finding NIS2 Art. 21(2)(b) Incident handling
Logs are kept on the device, not shipped off.
SOC 2 AICPA
Trust Services Criteria Security (CC), availability (A), processing integrity (PI), confidentiality (C), privacy (P).
example finding SOC 2 CC7.2 Anomaly monitoring
No off-box destination for security logs.
PCI-DSS v4 PCI SSC
Payment Card Industry Data Security Standard CDE scope wizard. Segmentation analysis. Logging requirements 10.x covered end to end.
example finding PCI-DSS 1.4.2 Inbound traffic to CDE
Rule allows untrusted network into CDE.
ISO 27001 2022
ISO/IEC 27001 Annex A The 93 controls in the 2022 update. We map the ones the firewall config can actually evidence.
example finding ISO 27001 A.8.16 Monitoring activities
Continuous monitoring not in place.
CIS Controls v8 CIS
Center for Internet Security Implementation Groups 1 through 3, with the firewall-related safeguards from each.
example finding CIS 8.10 Retain audit logs
Retention period not enforced.
NIST CSF 2.0
Cybersecurity Framework Identify, Protect, Detect, Respond, Recover. Plus Govern in the 2.0 update.
example finding NIST CSF DE.CM-1 Continuous monitoring
Logs are local only.

Ten firewall platforms. One report shape.

Mixed estates produce one consistent report. The parser layer is vendor-aware so you do not write the report twice for two different firewalls.

Check Point
Cisco ASA
Clavister
FortiGate
Juniper
Palo Alto
Sangfor
Sophos
Untangle
WatchGuard

What a finding looks like.

Real shape from a real report. The control codes are clickable in the PDF and jump to the framework citation. The cited config line jumps to the rule in your config.

High NIS2 Art. 21(2)(d) · Supply-chain security · RD-NIS2-0017

Inbound rule permits 0.0.0.0/0 to the management plane.

Rule in_wan_mgmt permits TCP/443 from any source to the firewall's management interface. NIS2 risk management expects administrative access to be restricted to known sources.

Cited from config, line 1,247
SourceNetwork="any"
DestinationNetwork="mgmt"
Service="https"
Action="Allow"
Remediation

Replace any with the administrative jump-host subnet, or move the management plane to an out-of-band VLAN.

Why teams pick ruledoc.

The short version. Long version: read the rest of the page.

No agents, no scans.

Static analysis on the config file. Nothing to install on the firewall, no port to open, no service account to provision.

Plain-English findings.

Auditors do not care about CLI syntax. The report explains what is wrong, why it matters, and what to change. CLI snippets are in the remediation block for the engineer.

Vendor-neutral output.

Mixed FortiGate, Palo Alto, and Clavister estates produce one consistent report. The finding for "permits any-to-any" reads the same regardless of which device emitted the rule.

JSON for your GRC tool.

Findings export as JSON with the same structure as the PDF. Pipe it into your SOAR or GRC platform with no transformation step in between.

Try it

Get a sample report on your own config.

Free, watermarked, browser-only. Make sure the output matches what your auditor is asking for.

Try a sample report View pricing