Change Tracking and Alerts
The change feed — new hosts, opened/closed ports, MAC and hostname changes, and up/down transitions.
Boltarr diffs every scan against the last known state, records what changed, and can notify you. Two stages: record → alert.
Everything is always recorded to the Changes feed; alerts are the subset that push to ntfy.
Settings → 🔔 Changes → Record controls which change types are logged:
- New host · Port opened / closed · MAC changed · Hostname changed · Host offline / online
- Keep history for N days (retention).
See them in Scans → Changes (whole-network feed, click a row to jump to that host) or a host's Changes tab. Port closed is only recorded for ports a scan actually covered, so a shallow scan never false-flags a deeper scan's ports.
Settings → 🔔 Changes → Alerts turns recorded changes into notifications:
- Alert for — scope by classification: Static / Dynamic / All. Unknown-classified hosts never alert. (So "Static only" pings you about your fixed-IP gear but not roaming phones.)
- Per-type toggles — choose which change types push (new host, ports, MAC, hostname, offline/online).
- Attach device MAC — adds the MAC to alerts (offline/online, scan summary, digest) — handy for spotting a roaming device that keeps its MAC while its IP hops between access points.
- Summary after each scan — one grouped ntfy message per scan.
- Daily digest — a morning roundup at a time you set.
Per-host opt-outs (don't-alert-on-MAC / offline) live in the host's Edit dialog. All alerts respect quiet hours — see Notifications.
- Keep all change types recorded (so the feed is complete).
- Alerts: Static scope, with New host + Port opened + Offline/online on; port-closed and hostname off (noisier). Summary-after-scan for real-time, plus the daily digest as a safety net.
Needs Notifications configured for the push part.