This is where Nmap meets Open Policy Agent (OPA). One finds the truth about your network. The other decides what to do about it. Together, they turn raw, noisy scan data into instant, enforceable decisions.
Nmap is the fastest way to map active hosts, discover open ports, and fingerprint services. It gives you facts. OPA takes those facts and runs them through policies you write in Rego. Those policies are the rules: no exposed SSH on public IPs, only approved versions of TLS, no forgotten admin panels. OPA doesn’t care how you decide those rules. It cares about enforcing them, every time, for every scan result.
The workflow is simple. Run Nmap. Parse its XML or JSON output. Feed it into OPA. Get a clear allow/deny decision with detailed reasoning. This closes the gap between detection and action. You’re not just finding problems—you’re defining exactly how to respond.
The power comes from making this part of automation. When CI/CD jobs spin up test environments, Nmap runs. OPA checks the results. Unsafe services mean a failed build. In production, run the same checks on a schedule or triggered by changes in cloud environments. Every scan gets the same policy enforcement, no drift, no exceptions.
Integrating Nmap with OPA also gives you auditability. Every decision runs through versioned policy code. Every scan result is evaluated the same way. That means compliance teams get hard evidence. Security teams get consistency. Engineers get logic that’s easy to test and easy to change.
Scaling is easy. Containerize your scanner, pipe the results to a centralized OPA instance or run OPA side-by-side for each job. Use lightweight scripts or event-driven workflows to trigger scans and evaluations. The system stays fast, accurate, and predictable.
If you want to see this live without building it from scratch, you can spin it up with hoop.dev in minutes. Set up the Nmap scans, plug them into OPA, watch the policies enforce themselves. The code runs. The results speak. The truth of the port scan becomes an immediate decision you can trust.