A custom Home Assistant integration that provides real-time network security monitoring for your home. It combines passive NetFlow/IPFIX traffic analysis with active network scanning, external IP threat intelligence, DNS blacklist checks, and vulnerability detection — all presented through a dedicated multi-view sidebar dashboard.
Passively monitor all your network traffic without installing agents on any device. Home Security Assistant listens for NetFlow v5, v9, and IPFIX datagrams on a configurable UDP port and classifies internal vs. external traffic using your configured CIDR ranges.
Go beyond passive monitoring with optional ping + port scanning of all observed internal hosts. The scanner runs on a configurable interval and discovers services even when hosts block ping.
22,80,443,8000-9000). Defaults to 47 well-known ports
Every external IP that communicates with your network is automatically enriched with threat intelligence from multiple sources, giving you unparalleled visibility into who is connecting to your home.
Proactively discover known vulnerabilities on your network before attackers do. Home Security Assistant queries the NIST National Vulnerability Database (NVD) and cross-references findings against the CISA Known Exploited Vulnerabilities catalog.
Every device on your network is automatically fingerprinted and categorized, giving you a complete inventory of your connected home.
device_tracker entities (IP, name, hostname, MAC)
No more wading through raw logs. Get clear, prioritized findings with severity ratings, source IPs, categories, and occurrence counts.
| View | Description |
|---|---|
| Overview | Summary stats, Active Scan card, NetFlow listener health, recent alerts, and NVD keyword chips color-coded by source |
| Network Map | Live force-directed graph with zoom/pan showing scanned hosts, flow-active hosts, at-risk devices, gateways, and top external peers |
| Hosts | Searchable device inventory with inferred roles, scan results, and tracker-enriched names |
| Findings | Actionable security findings with dismiss buttons, CVE details, and remediation hints |
| External IPs | Enriched external IP table with threat ratings, VirusTotal hits, AbuseIPDB scores, and on-demand lookup |
| Vulnerabilities | Sortable CVE browser with CVSS scores, severity, CISA KEV flags, and a detail modal with full description and CPE criteria |
| Recommendations | Prioritized hardening suggestions based on your current network state |
| Sensor | Description |
|---|---|
| Active Devices | Count of observed internal devices |
| Scanned Devices | Count of devices with active scan results |
| Total Flows | Total NetFlow/IPFIX records ingested |
| Open Findings | Count of actionable (high/critical) findings |
| Vulnerability Count | Count of CVE vulnerabilities detected |
| Suspicious Sources | Devices reaching commonly abused ports |
| High Egress Sources | Devices exceeding outbound data threshold |
| NVD Keywords | Count of NVD search keywords in cache with per-keyword CVE count and source classification |
| Service | Description |
|---|---|
homesec.trigger_scan |
Immediately run a full active network scan without waiting for the next scheduled interval |
homesec.nvd_refresh |
Flush the local NVD CVE cache and re-fetch fresh vulnerability data from NVD |
custom_components/homesec directory into your Home Assistant custom_components/ folder.Device tracker enrichment is automatic — if you have router or presence integrations that create
device_tracker entities, Home Security Assistant will use those names, hostnames, and MAC addresses.
softflowd
| Option | Default | Description |
|---|---|---|
| Bind host | 0.0.0.0 |
UDP listen address |
| Bind port | 2055 |
UDP listen port |
| Internal networks | 192.168.0.0/16, 10.0.0.0/8, 172.16.0.0/12 |
Comma-separated CIDRs |
| Enable sidebar panel | true |
Register the Web UI panel |
| Option | Default | Description |
|---|---|---|
| Enable active scanner | true |
Ping + port scan internal hosts |
| Scan interval | 300 s |
Seconds between active scans |
| Scan exceptions | empty | Comma-separated IPs to skip during scanning |
| Scan ports | 47 default ports | Comma-separated ports or ranges to probe |
| Option | Default | Description |
|---|---|---|
| External IP retention | 24 h |
How long to keep external IPs (0 = forever) |
| Enable reverse DNS | true |
Resolve external IP hostnames |
| Blacklist URLs | abuse.ch feeds | Comma-separated threat intel feed URLs |
| IPInfo token | empty | Optional, improves IP geolocation quota |
| VirusTotal API key | empty | Optional, enables VT lookups |
| Shodan API key | empty | Optional, enables Shodan lookups |
| AbuseIPDB API key | empty | Optional, enables abuse score lookups |
| Enrichment cache TTL | 300 min |
Minutes before re-querying providers |
| Option | Default | Description |
|---|---|---|
| NVD API key | empty | Optional, increases NVD rate limit to 50 req / 30 s |
| NVD cache TTL | 12 h |
Hours before re-fetching CVE data |
| NVD minimum CVE year | 2020 |
Oldest CVE year to include (0 = all years) |
| NVD search keywords | 16 defaults | Product names to query NVD for (e.g. OpenSSH, nginx, WordPress) |
Home Security Assistant is free, open-source, and built for the Home Assistant community. Start monitoring your network in minutes.