Changelog

Every release, every fix, every feature — documented.
Click any version to expand the full release notes.

Planned
v0.1.9.3 — Security, Alerting & Monitoring Suite
August 18, 2026
15 new4 fixed2 removed
›
Security
New DNS Blocklist
Block malware, phishing, ransomware, and command-and-control servers across your entire network with one setting. Six protection categories, custom block and allowlist, blocked query log, and domain tester. Works on every device automatically — no agent required. Runs locally on the NetWatch server, nothing leaves your network.
New Two-Factor Authentication (TOTP)
Time-based one-time password (TOTP) support for all user accounts. QR code enrolment, 6-digit verification, and backup code generation. Compatible with Google Authenticator, Authy, and any standard TOTP app.
Alerting
New Browser Push Notifications
Instant alerts delivered directly to your browser — desktop and mobile — with no app required. Uses the Web Push standard with VAPID keys generated on your server. Notifications route directly from your NetWatch server to your browser. CoreOutpost never sees them.
New Slack, Teams & Discord Webhooks
Send alerts to any Slack channel, Microsoft Teams channel, or Discord server via incoming webhook. Rich formatting with severity colours and device details. Nothing routes through CoreOutpost — your webhook, your workspace.
New Email Alerts via SMTP
Email notifications for device offline/online events, new devices, threats, rogue devices, and warranty expiry. Uses your own SMTP credentials — no third-party relay. Your email server, your data.
New Team Chat & Direct Messages
Internal messaging between NetWatch users. System alerts, threat events, and ISP outages post automatically to team chat. Direct messages between users for coordination during incidents.
New Privacy & Communication Controls
All external communication is off by default. Every channel — email, webhooks, push, version checks — requires explicit opt-in. Designed for air-gapped and HIPAA-adjacent deployments that need zero external calls.
Monitoring
New Uptime Tracking
Per-device uptime history stored locally. Uptime percentage calculated for 24h, 7d, and 30d windows. Most and least reliable device rankings on the Overview. Timeline bar visualization in the device detail panel.
New ISP Outage Detection
Automatic internet connectivity checks every 5 minutes. On failure, NetWatch runs a traceroute to classify the outage — local network issue, ISP outage, or upstream failure. Alerts via push notification and team chat with ISP contact details included.
New ISP Contact Directory
Auto-detects your ISP via public IP lookup and ASN registration. Built-in support contacts for 15 major carriers. Admin override for local and regional ISPs. Contact info stored locally on the NetWatch server — available even during a complete internet outage.
New Network Diagnostics
Ping, traceroute, port check (17 common ports), and speed test accessible directly from the right-click context menu on any device. Run from the NetWatch server — no agent required on the target device.
Reports
New PDF Network Reports Business
Professional multi-page PDF reports generated on your NetWatch server and downloaded instantly to your browser. Includes cover page, executive summary, full device inventory with uptime percentages, security events, rogue devices, and offline event log. No data sent to CoreOutpost.
Experience
New Guided First-Login Tutorial
6-step interactive tour that launches automatically for new users. Desktop spotlight mode highlights each nav section. Mobile swipe card layout on small screens. Completion stored server-side — finishing on one device marks it done everywhere. Replayable from Settings → About.
New Setup Guides
9 step-by-step guides built into the dashboard covering first-time setup, agent installation, DNS blocklist, push notifications, ISP detection, 2FA, remote access, PDF reports, and network diagnostics. Available offline — always accessible even without internet.
New Right-Click Context Menu
Right-click any device to access ping, traceroute, port check, rename, add note, view health, view details, and remote power management (sleep/restart/shutdown). Admin re-authentication required for power actions.
Bug Fixes
Fixed Login Anomaly Detection
New login location alerts were firing on known devices after logout. Known IPs and devices are now persisted to disk, capped at 50 entries each, and re-read on every login.
Fixed SMTP Password Masking
Saving SMTP configuration was overwriting the stored App Password with the masked placeholder. The password field is now stripped from the payload if unchanged.
Fixed Settings Tab Persistence
Refreshing on Settings → Preferences fell back to Overview. Hash-based tab routing now survives page refresh correctly.
Removed
Removed Remote Desktop — Phase 1
RDP file download has been removed from this release. We are building a full native remote access experience in a future release — persistent agent tunnel, screen streaming, input forwarding, file transfer, and multi-monitor support. Half-built RDP is not the NetWatch standard.
Released
v0.1.9.2 — Asset Management & Security Polish
August 13, 2026
9 new6 fixed
›
New Features
New Device Health Monitoring
Real-time health data collected from devices on your network — no agent required on target machines.
  • Windows PCs: CPU, RAM, disk usage, SMART status, BSOD history, battery level (laptops)
  • Printers: toner/ink levels, drum life, paper jams, error states via SNMP
  • Switches: port errors, CRC errors, temperature, uptime via SNMP
  • Health shown inline in the devices table — double-click or right-click → View Health for the full panel
  • Remote WMI collection for same-subnet Windows devices with 3-minute cache
New Remote Power Management Admin · Manager
Sleep, restart, or shut down any Windows device on your network from the dashboard. Requires password re-authentication on every action. All commands audit-logged. On failure, fix commands posted automatically to Team Chat.
New Team Chat Pro · Business
Real-time messaging for your team — built into the dashboard with zero external dependencies.
  • @ mentions for devices, locations, users, and roles — Tab to autocomplete, arrow keys to navigate
  • Reply to specific messages with inline quoted preview
  • Direct messages — private 1-on-1 threads alongside the main channel
  • High, Critical, and Emergency threat alerts auto-posted to chat
  • System messages with copy-ready fix commands when remote actions fail
  • Search messages instantly without leaving the panel
  • Unread badge on the header button and sidebar nav item
New Activity Log
A unified record of everything your team does — separate from system logs.
  • Tracks renames, device notes, rogue approvals, power commands, settings changes, alert acknowledgements
  • Searchable and filterable by category and date range (up to 60 days)
  • Encrypted export to .nwlog file (AES-256-GCM)
  • Direct navigation links on every entry to the relevant dashboard section
New Device Notes Admin · Manager
Add a text note to any device. Notes appear as a 📝 indicator in the devices table, show in the right-click menu, persist across sessions, and are included in CSV exports.
New Alert Acknowledgement
Acknowledge any alert with an optional note. Shows who acknowledged it, when, and what they noted — inline on the alert card. Stored server-side and visible to all users.
New CSV Export
Export the currently filtered device list including name, IP, MAC, vendor, type, status, latency, last seen, location, and device note.
New Collapsible Sidebar with Pinned Items
Click any sidebar group label to collapse or expand it. Right-click any item to pin it to the top of the sidebar. Both states persist across sessions and page refreshes.
New Login Anomaly Detection
Flags when a user logs in from a new IP address or device type not seen before for that user. Posts a system message to Team Chat with a prompt to revoke all sessions if the login wasn't expected.
Improvements
Improved C2 Beaconing — False Positive Reduction
Dramatically fewer false positives from Windows Update, Teams, Spotify, and other legitimate services.
  • CDN/cloud IP whitelist expanded: Akamai, Cloudflare, Fastly, CloudFront, Google, Microsoft (full 20.x.x.x), Apple (full 17.x.x.x)
  • Minimum beacon interval raised to 30 seconds — eliminates browser keep-alives and OS telemetry
  • Ports 80, 443, 8080, 8443, 53, 123 excluded from detection
  • Variance tolerance raised to 30%, sample requirement raised to 6 connections
Improved Identification Engine
  • DHCP option 55 fingerprinting with 30+ OS patterns
  • DNS behavioral fingerprinting with 60+ domain patterns
  • Gateway .1 IP short-circuit — any .1 address immediately identified as Router
  • Randomized MAC detection via locally administered bit check
  • NetBIOS WORKGROUP filtering, UPnP deep parse, multi-source confidence merging
Improved System Logs / Activity Log Separation
System Logs shows only server and security events. Activity Log shows only user actions. Each view links to the other — nothing hidden, everything in the right place.
Improved Settings Follow You Across Devices
Refresh interval, inactivity timeout, and location order are now stored server-side per user. Log in on a new device and your settings are already applied.
Improved Plain English Error Messages
Every server error returns a human-readable message. The dashboard translates HTTP status codes, network errors, and server error codes into clear, actionable language — no more raw "401 Unauthorized" or "Failed to fetch".
Bug Fixes
Fixed Approved Rogue Devices Reappearing After Restart
save_registry() was never called — the save code was orphaned inside a different function. Approved devices were lost on every server restart. Registry now correctly persists. Randomized MACs keyed by IP so approval holds across MAC rotations.
Fixed Users Tab Not Loading
GET /api/users was missing its @app.route decorator and was never registered as a route.
Fixed License Showing Free on New Devices
Settings → License was reading from the local token only. Now reads the server-synced license first — correct plan shown immediately after login on any device.
Fixed Activity Log 500 Error
CHAT_MAX, EXPORTS_DIR, and ACTIVITY_RETAIN_DAYS constants were missing, causing a server crash on every Activity Log request.
Fixed IP Allowlist Crashing All Requests
A stray docstring merge renamed is_ip_allowed to ip_is_allowed in the auth decorator, causing a NameError on every authenticated endpoint.
Fixed Chat Messages Delayed Until Panel Reopened
SSE events were sent as generic message events instead of named events. The client's addEventListener('chat_message') never fired. Messages now appear instantly.
Released
v0.1.9.1 — Network Protection & Threat Detection
August 10, 2026
3 new
›
New Features
New Threat Detection Engine
  • Port scan, SYN flood/DDoS, ARP spoofing, C2 beaconing, ransomware lateral movement detection via Npcap packet analysis
  • Dedicated Threat Monitor — real-time threat feed, severity grouping, active isolations, detection history
  • Alert grouping — multiple threats from the same source IP grouped into one incident and escalated one severity level
  • Alert escalation — Warning → High after 5 minutes, High → Critical after 15 minutes if unresolved
  • Tab title badge — browser tab shows 🚨 (n) when active threats are detected
New Bandwidth Monitoring
Per-device traffic history with 1h/6h/24h graphs in Threat Monitor → Bandwidth tab. SNMP foundation with extended device polling for system info, interface counters, CPU usage, and metrics.
New Real-Time SSE Push
Threat alerts delivered instantly to open dashboards without polling. Agent command polling pushes isolation and restore commands to agents in real time.
Released
v0.1.9 — Security Foundation
August 4, 2026
7 new
›
New Features
New Encryption at Rest
netwatch-config.json, netwatch-agents.json, netwatch-registry.json, and agent config files all encrypted with AES-256-GCM using machine-specific keyfiles.
New Brute Force Lockout
5 failed login attempts triggers a 15-minute account lock, persisted across server restarts. In-process rate limiting — 300 req/min default, 10/min on auth endpoints.
New Chained HMAC Audit Log
Every log entry cryptographically signed and chained. Tamper detection identifies broken entries. Back-fill on startup for legacy entries. Sensitive data (API keys, tokens, passwords) auto-masked before logging.
New Rogue Device Detection
MAC+IP registry per location. Three detection types: unknown device, IP mismatch, MAC mismatch (possible ARP spoofing). Daily re-alert, auto-approve on enable.
New Agent Registration & Approval
Each agent must register and be approved by an admin before reporting. Unique HMAC-signed token per agent. Pending/approved/revoked states visible in Security → Agents.
New Security Settings
Auto logout on inactivity (15/30/60/120 min or Never) with warning modal. Session health check every 10 seconds — instant logout on revocation. IP allowlisting by IP or CIDR range. HTTP security headers (CSP, HSTS, X-Frame-Options).
New Navigation Reorganized
Four labeled groups: Monitor, Network, Security, Administration. Rogue Devices moved to dedicated Security page. Agents tab added to Security section with pending badge.
Released
v0.1.8.4 — UI Overhaul
July 18, 2026
5 new1 fixed
›
New Features
New Topology View Rebuilt
HTML drag-and-drop nodes replacing SVG. Router, Switch, AP, Firewall, NAS, and WiFi node types. Port assignment, lock device position, per-location tabs, mobile card view.
New WiFi vs Wired Detection
Assign devices to WiFi nodes in topology. Badges appear automatically in the Devices tab with connection filter pills.
New Active Sessions View
See all logged-in devices with IP, device type, and sign-in time. Revoke individual sessions or all sessions at once with CONFIRM dialog.
New First-Time Tutorial
6-step guided tour on first login with spotlight on each nav section. Skip button available. Replay from Settings → About.
New Live Demo
Interactive demo launched at demo.coreoutpost.com — explore Netwatch with realistic simulated data before installing.
Improvements
Improved Alert & Log Grouping
Multiple offline devices grouped into one alert per location with expandable device list. Repeated log entries collapsed with ×count badge.
Improved Auto-Save
Device name changes auto-save after 7 seconds with Unsaved/Saving/Saved/Failed indicator bottom-right.
Improved Dormant Agent Suppression
Locations offline 3+ days hide devices and alerts — yellow banner explains the outage without cluttering the view.
Bug Fixes
Fixed Right-Click Context Menu Position
Rendered via React portal — no longer mispositioned on any screen size. Mobile long press triggers context menu with haptic feedback.
Released
v0.1.8.3 — Session Persistence & Password Management
July 13, 2026
2 new
›
New Features
New Session Persistence
User sessions survive server restarts — no more forced re-login after every server update.
New Change Password
Users can update their password from Settings → Connection. Password change invalidates all other active sessions for security.
Released
v0.1.8.2 — Exact Device Model Identification
July 7, 2026
›
Improvements
Improved Exact Model Extraction
  • Exact printer model via manufacturer web interfaces — HP, Brother, Canon, Epson, Ricoh, Xerox, Kyocera
  • Exact Windows PC model via WMI — returns "Dell OptiPlex 7090 (Windows 11 Pro)" instead of "Windows Desktop"
  • Exact network device model from SNMP sysDescr — Cisco Catalyst 3750, Synology DS920+, etc.
  • Cisco Meraki correctly identified via HTTP fingerprinting
  • Confidence scoring improved — exact sources score 95, medium 60–80, guesses 35
Released
v0.1.8.1 — Enhanced Device Identification Engine
July 7, 2026
1 new
›
New Features
New Identification Engine v2
  • 500+ MAC prefix to exact device model mappings
  • Apple model code mapping — converts internal codes like iPhone15,2 to "Apple iPhone 14 Pro"
  • 200+ hostname patterns — Windows PCs, Apple devices, printers, cameras, smart home, NAS, routers
  • HTTP fingerprinting — 20+ URL patterns for routers, printers, NAS, cameras
  • Port signature matching — 18 port combinations mapped to device types
  • Smart home: Shelly, Tasmota, ESP, Sonos, Echo, HomePod identified
  • Gaming: PlayStation, Xbox, Nintendo Switch identified from MAC prefix
  • Falls back to original identification if engine unavailable
Released
v0.1.8 — Persistence, Mobile & Available IPs
July 6, 2026
4 new1 fixed
›
New Features
New Server Persistence
Location and device data saved to netwatch-data.json on every report — survives server restarts. Auto-discover locations with one-click add from the dashboard.
New Available IPs View
Dedicated view showing all unused IP addresses per location in numeric order with copy to clipboard.
New Mobile Responsive Dashboard
Top bar, slide-out hamburger drawer, and bottom navigation bar on all views. KPI grid, overview grid, and device table all adapt to small screens.
New Filter Pills
Location, Status, and Type filters replaced with clean pill buttons. Multi-select Type filter with grouped categories: Desktops, Laptops, Mobile, Printers, Routers, Switches, Smart, Servers, Unknown.
Bug Fixes
Fixed IP Address Sort Order
Device list now sorts numerically (.1, .2 ... .11, .12) instead of alphabetically (.1, .10, .11, .2).
Released
v0.1.7 — Background Nmap & Incremental Reporting
July 5, 2026
2 new
›
New Features
New Background Nmap Scanning
Fast ping scan reports first — Nmap runs in background threads for unknown devices. Results stream to the dashboard as each device is identified. Throttled to -T2 --max-rate 50 to avoid disrupting busy networks.
New Incremental Scan Reporting
Agent reports every 5 devices found — dashboard updates live as the scan progresses instead of waiting for completion.
Released
v0.1.6 — Stale Agent Detection & Standalone Executables
June 30, 2026
3 new1 fixed
›
New Features
New Stale Agent Detection
Server auto-marks devices offline after 90 seconds of silence. Dashboard shows a red banner when an agent stops reporting.
New Standalone Executables
NetwatchServer.exe and NetwatchAgent.exe — no Python installation required on deployment machines.
New Dashboard Deployed
Dashboard live at app.coreoutpost.com.
Bug Fixes
Fixed Device Flicker & Multi-Location Matching
Devices no longer disappear between scan cycles. Multi-location matching bug caused by stale closure resolved.
Released
v0.1.5 — Alert Filtering, Dark Mode & CSV Export
June 28, 2026
1 new
›
New Features
New Alert Filtering & Export
Search, severity filter buttons, location dropdown, and date range on Alert Center. Export devices to CSV. Dark/light mode toggle saved to localStorage. Connection status pulse when new data arrives.
Released
v0.1.4 → v0.1.0 — Foundation
June 25–27, 2026
4 new
›
Foundation
New v0.1.4 — Polish
Standardized spacing, loading skeleton on Overview, smooth fade-up view transitions, improved empty states.
New v0.1.3 — Resilience
Error boundaries, stale data banner with last known state, device detail panel on click, last seen timestamp on offline devices.
New v0.1.2 — Advanced Identification
Scapy passive traffic fingerprinting. mDNS/Bonjour, SNMP, UPnP, HTTP banner grabbing. 10-layer identification pipeline.
New v0.1.0 — Initial Release
Setup screen, live device data, five views. Device renaming, alert generation, sidebar navigation. Netwatch is born.