Security and NIS2
You know who changed what. Soon: you know what happened in the network.
django-nms has roles, change history and deployment audit today. The NIS2 module with Wazuh agents and an incident register is on the roadmap; we describe it here as a concept.
- Technician role with no access to customer financial data
- Change history on sellers, contracts, services and hosts
- Audit of every RADIUS and router configuration deployment
Concept: NIS2 for ISPs with Wazuh (roadmap)
Status: on the roadmap, concept. The description below is a plan, not a feature available today.
NIS2 covers telecom operators across the EU. Incident reporting has three deadlines: early warning within 24 hours, notification within 72 hours, final report within one month. django-nms is a system of record for network and customers, not a SIEM. So instead of building our own detection, we plan an integration with Wazuh.
How it is meant to work:
- Wazuh agents on servers (RADIUS, Linux routers, django-nms itself) and syslog collection from MikroTik and Cisco routers. Application logs (configuration deployments, admin actions, logins) shipped to Wazuh as JSON.
- Event ingestion. Wazuh sends alerts to django-nms by webhook. An event has source, severity, rule id, host and raw payload. The system correlates it by IP address with a subscriber host, edge router or location.
- Incident register. From one or many events you create an incident: detection time, classification, affected services, subscriber count, actions taken, notifications. DDoS events can automatically set a host block with the reason "DDoS", which already exists in the model.
- NIS2 deadlines. Every incident has 24 h, 72 h and 1 month timers with e-mail and SMS reminders to responsible people.
- Reports. Export of the notification and final report in the structure the national CSIRT requires, plus a yearly register for audit.
If you are preparing for NIS2, we would like to discuss scope. Early partners shape the module.
What is available today
-
Roles and permissions
Django groups: invoice operations, technician (hosts and locations, no contracts or customers), contract-change notifications. Technician role set up with one command.
-
Change history
django-simple-history on sellers, contract templates, services, service relations and hosts. Changed-field list in every entry.
-
Activity log
Global log of admin actions with user, model, action and period filters. Recent activity on the dashboard.
-
Deployment audit
Every RADIUS and router configuration deployment stores a log, result and host count. Session status refreshes are recorded too.
-
Secrets
E-invoicing certificate passwords encrypted in the database. SSH keys only on the server disk, never in the database.
-
Planned
NIS2 incident register
Events from Wazuh, correlation with network elements, 24h/72h/1-month deadlines, reports. On the roadmap.
-
Planned
2FA and SSO
Second login factor and corporate sign-in. On the roadmap.
-
Partial
GDPR tools
Anonymisation of test environments available. Per-customer export and erasure: on the roadmap.
-
Your data, your server
Self-hosted in Docker or EU hosting. No customer data leaves your infrastructure.
NIS2 module plan
Order may change depending on operator requests.
-
Q2 2027 Planned
Event ingestion from Wazuh
Webhook, event model, correlation with host and router by IP.
-
Q3 2027 Planned
Incident register and deadlines
Incident with classification, affected elements and 24h/72h/1-month timers.
-
Q4 2027 Planned
Reports and automatic responses
Notification exports, yearly register, automatic DDoS block.
Security questions
Can a technician see financial data?
Not with the technician role. It grants access to hosts, locations and history, without contracts, customers or invoices.
Is the NIS2 module available?
No. It is a roadmap concept. We describe it to collect requirements from operators preparing for NIS2.
Preparing for NIS2?
Let's talk about what you need in an incident register. Early partners get a say in scope and preferential terms.