When Your Firewall Misses the Real Threat: Inside Your Application

You've got a solid network perimeter. Your firewall is configured, your WAF is running, your SIEM is ingesting logs. But the most dangerous threats don't come through port 443—they come through valid credentials, exploited business logic, and compromised accounts that your infrastructure tools never see. That's the gap tirreno is designed to fill: an open-source security framework that watches what happens inside your application, not just at the network boundary.

What It Does

Tirreno is a self-hosted, PHP and PostgreSQL application that ingests events from your product through API calls and SDKs, then provides a real-time dashboard for monitoring threats, fraud, and abuse. Think of it as application-layer security intelligence—it tracks user behavior, calculates risk scores, and surfaces suspicious activity that traditional security tools would miss.

The core workflow is straightforward. You send events from your application (logins, registrations, purchases, profile changes) with full context via their SDKs. Tirreno processes these events through a built-in rule engine that applies preset rules—things like account takeover detection, credential stuffing, content spam, promo abuse, bot detection—or your own custom rules. Risk scores are calculated automatically, and you can configure thresholds that trigger account suspension or flagging for manual review through a review queue.

Beyond real-time monitoring, tirreno offers a single user view that shows behavior patterns, risk scores, connected identities, and activity timelines for any specific user. There's also a field audit trail that tracks modifications to important fields—what changed and when—which is useful for compliance and forensic analysis.

The tech stack is deliberately low-dependency: PHP 8.0-8.3, PostgreSQL 12+, and a web server with Apache. The README claims a five-minute installation, and the hardware requirements are modest—128 MB RAM for the application, 512 MB for PostgreSQL, with about 3 GB of storage per million events.

Why It's Cool

What makes tirreno interesting isn't that it's another security tool—it's that it targets a specific blind spot that most organizations have. Your SIEM doesn't know what a normal user session looks like in your application. Your WAF can't tell the difference between a legitimate login and a credential stuffing attack using valid passwords. Tirreno operates at the application layer where the actual abuse happens.

• It's purpose-built for application logic abuse. The preset rules list reads like a catalog of modern web attacks: account takeover, credential stuffing, content spam, multi-accounting, promo abuse, API protection. These are problems that infrastructure security tools struggle with because they lack application context.

• The single user view is a practical feature. When you're investigating a suspicious account, you don't want to grep logs across multiple systems. Having behavior patterns, risk scores, connected identities, and an activity timeline in one place saves time and helps connect dots that might otherwise be missed.

• The field audit trail is a compliance win. Tracking changes to important fields isn't flashy, but it's the kind of feature that makes auditors happy and helps during incident response. It's also useful for internal investigations—knowing exactly what changed and when can resolve a lot of ambiguity.

• The architecture is refreshingly simple. PHP, PostgreSQL, minimal dependencies. No Kubernetes cluster required, no Elasticsearch pipeline, no event bus. You can run this on a modest VM or even a Raspberry Pi-class machine. That makes it accessible for small teams and internal tools where you don't want to stand up a complex infrastructure.

• The use cases are broader than you might expect. The README specifically calls out industrial control systems, air-gapped deployments, non-human identities (service accounts, API keys, bots), and API-first applications. This isn't just for SaaS products—it's for any system where you need to understand who or what is doing what.

How to Try It

The quickest way to see tirreno in action is the live demo at play.tirreno.com with credentials admin/tirreno. That'll give you a feel for the dashboard without installing anything.

For a self-hosted setup, you'll need PHP 8.0-8.3, PostgreSQL 12+, Apache with mod_rewrite and mod_headers, and the PDO_PGSQL and cURL PHP extensions. The README says installation takes about five minutes.

Clone the repository from github.com/tirrenotechnologies/tirreno and follow the setup instructions. There's also a Docker image available if you prefer containerized deployment—you can pull it from Docker Hub with docker pull tirreno/tirreno.

Once it's running, you'll integrate via SDKs or direct API calls to send events from your application. The README doesn't include specific code examples in the truncated portion, but the API is designed to accept events with full context in a few lines of code.

Final Thoughts

Tirreno won't replace your existing security tools, and it's not trying to. What it does is fill a specific, important gap: monitoring what happens at the application layer where traditional defenses are blind. For teams running self-hosted applications, SaaS platforms, e-commerce sites, or any system where user behavior matters, it's worth a look. The low-dependency architecture and modest hardware requirements mean you can try it on a weekend without committing to a complex deployment. If you're tired of your SIEM telling you about port scans while credential stuffing quietly drains your user accounts, tirreno might be exactly what you've been missing.

Follow @githubprojects for more developer tools and open source projects.