kineticlull.com

What It Is

KineticLull focuses on managing External Dynamic Lists (EDLs) for network security. The core idea is to let security analysts maintain lists through a Web UI or API, while firewalls automatically pull the content from generated URLs. Its companion tool, GhostHunter, is a Chrome/Firefox browser extension that captures the domains accessed while browsing web applications, helping teams build more accurate firewall or proxy allow-lists.

Core Capabilities

In terms of protection type, this is not a full firewall. Instead, it is an EDL management and domain discovery tool designed to support policy allow-listing, blocklists, and proxy rule maintenance. Deployment is based on the self-hosted KineticLull Django application. According to the description, users can clone the repository and run setup.sh to generate an EDL server with SSL and a systemd service; GhostHunter is installed through the browser extension stores. On the management side, the product emphasizes “no firewall login required”: security analysts can update EDLs without PAN administrator credentials. Each EDL has its own ACL, allowing only specified firewall source IPs to pull the list. API Inbox supports team submissions for admin review. Each entry records who added it and when, with searchable activity logs and CSV export available.

Pricing and Compliance

The description only states that both KineticLull and GhostHunter are MPL-2.0 open source. It does not disclose a commercial edition, hosted version, support subscription, or payment methods. It also provides no information on compliance certifications such as SOC 2 or ISO 27001, so it should not be assumed to carry enterprise compliance validation by default.

Pros and Cons

The main advantage is its clear positioning: it can reduce the need to request change windows or share high-privilege firewall accounts just to update simple lists. ACLs, review workflows, and audit trails are practically useful for security team collaboration. GhostHunter helps visualize “which domains a web app actually depends on,” reducing overly broad allow-listing. The drawbacks are that it requires self-hosting and ongoing operation of Django, SSL, and system services, so ease of use depends on the team’s technical capability. The available materials do not show alerts, SLA, enterprise support, or compliance certifications. Its scope is also clearly limited: it is not a replacement for policy orchestration, traffic detection, or a threat intelligence platform.

Who It’s For and Access From China

It is best suited for security teams that already have firewall/proxy infrastructure, frequently maintain EDLs or allow-lists, and want to standardize the workflow from domain discovery to list publishing. Access from China is not discussed in the source text. Actual availability of GitHub, Chrome Web Store, and Firefox Add-ons may depend on the local network environment. Payment information is not provided. If local vendor support is required, alternatives to compare include built-in object group/EDL management from firewall vendors, proxy gateway policy platforms, or other open-source list management tools.