NetWatchNetWatch v1.7 · Device & Traffic Intelligence

Secure company access

Connect to NetWatch

A configured company SSO session is detected automatically. Local and break-glass deployments can use an Admin, Operator, or Viewer key that stays only in this browser tab.

Enterprise deployment? Authenticate through the approved company identity gateway. Administrators can configure OIDC group mapping without exposing provider keys to users.

Authorized local networks only

Overview

Waiting for data Disconnected

Security operations

Network risk overview

Live evidence from approved private network scopes.

Current posture

Monitored environment

Live evidence
—Saved assetsInventory records
—Open servicesLatest audits
—Priority assetsRequire review
—Recent checksLast 7 days

Asset exposure

Highest risk score

Score—
No exposure data

Activity trend

Checks over the last 7 days

Daily
———————

Asset distribution

Exposure levels

High0
Medium0
Low0
Clean0

Advisor summary

Latest activity

Recent checks

Change detection

Recent asset changes

Host discovery

Scan a local CIDR

NetWatch checks a maximum of 256 approved IPv4 hosts. ICMP filtering may hide active devices.

Discovery results

No scan yet

0 hosts
Run an authorized scan to populate this table.

Focused check

Profile one host

Check reachability, latency, TTL, reverse DNS, and a cautious operating-system hint.

Host profile

No result yet

Run a host check to see profile details.

Service exposure

Audit common TCP ports

Checks a short defensive service list. An open port is exposure requiring review—not proof of a vulnerability.

Audit results

No audit yet

Unknown
Run an authorized audit to review common services.

Header-level visibility

Capture live traffic metadata

Wireshark-style traffic review with strict bounds. NetWatch extracts Ethernet/IP/ARP/TCP/UDP/ICMP headers and immediately discards payload bytes.

Select an approved sensor interface. Payload content is never returned or saved.

Capture summary

No capture yet

No payload retention

A normal interface usually sees only traffic to or from the NetWatch sensor.

Start an authorized capture to analyze protocol activity.

Flow analytics

Top conversations

No conversation data yet.

Observed endpoints

Device hints

No endpoint evidence yet.

Packet headers

Traffic timeline

Metadata only
No packet headers captured yet.

Persistent local data

Asset inventory

Service history

Normalized service findings

Per scan

Historical port-audit metadata is retained with bounded limits. This view contains service state and timing only; it does not store payloads.

Company context

Ownership and business priority

Admin

Admin access is required to edit asset context.

Asset evidence timeline

Selected asset activity

Select an asset

Review bounded local evidence for the selected device: discovery changes, host checks, and network observations.

Select a saved asset to load its activity timeline.

Change detection

Recent asset changes

Audit trail

Recent history

Accountability

Operations audit log

Checking integrity

Admin-only individual identity, request correlation, and HMAC chain verification. API keys and bearer tokens are never stored in this log.

Controlled automation

Company operations

Checking scheduler

Operate approved private CIDRs with maintenance-aware scheduling, deduplicated alert cases, SLA evidence, authenticated monitoring metrics, and consistent SQLite snapshots.

Evidence gate

Readiness Center

Checking evidence

Admin access is required to inspect readiness evidence.

Admin control

Add an approved scan policy

The CIDR becomes immutable approval evidence. Disable the policy when authorization or scope changes.

Admin access is required to create and change policies.

Approved scope

Scan policies

Change control

Schedule maintenance

Pause one policy or every approved policy during a bounded, documented maintenance window.

Admin access is required to manage maintenance windows.

Schedule protection

Maintenance windows

0 active

Active global windows pause all scheduled and manual policy runs. Policy-specific windows pause only their approved scope.

Operational triage

Alert inbox

Repeated unresolved findings are deduplicated into one case. “Not observed” remains evidence to validate, not proof that a device is offline.

Select an alert case to manage it.

Admin recovery control

Consistent database snapshot

Download a point-in-time SQLite backup without copying the live WAL files. Keep the file in an approved encrypted location.

Data lifecycle governance

Retention status

Preview eligible operational-history cleanup before an Admin confirms it. Audit-chain evidence is never removed by this control.

Admin access is required to inspect retention.

Deterministic local analysis

Risk advisor

Unknown

Load saved scan data to generate a local summary.

Priority findings

    Suggested next steps

      Confidence

      —

      Confidence depends on available host, port, and inventory evidence.

      Server-side decision support

      NetWatch Intelligence

      Checking

      Only aggregated, de-identified evidence is sent for analysis. IP addresses, CIDRs, hostnames, owners, departments, locations, notes, raw event details, role keys, and provider keys are excluded.

      Generate a structured defensive brief when you need a second review of the saved operational evidence.

      Evidence observations

        Limitations

          Recommended actions

          No intelligence brief has been generated in this session.

          Human validation is required before acting on any recommendation.

          MD

          Portable evidence

          Markdown report

          Human-readable inventory, changes, findings, and operations log for handover documentation.

          HTML

          Shareable report

          HTML report

          Standalone styled report with business context, findings, recommendations, and audit evidence.

          PDF

          Executive hand-off

          PDF report

          Bounded portable report for review and handover, using the same redacted local evidence.

          Interpretation

          Use results as evidence, not absolute truth.

          Firewalls, blocked ICMP, NAT, transient services, and local policy can affect what NetWatch observes. Validate important findings with the system owner.