Change Tracking and Alerts

Change Tracking & Alerts

Boltarr diffs every scan against the last known state, records what changed, and can notify you. Two stages: record → alert.

Everything is always recorded to the Changes feed; alerts are the subset that push to ntfy.

Tracking — what gets recorded

Settings → 🔔 Changes → Record controls which change types are logged:

• New host · Port opened / closed · MAC changed · Hostname changed · Host offline / online
• Keep history for N days (retention).

See them in Scans → Changes (whole-network feed, click a row to jump to that host) or a host's Changes tab. Port closed is only recorded for ports a scan actually covered, so a shallow scan never false-flags a deeper scan's ports.

Alerts — what pushes to ntfy

Settings → 🔔 Changes → Alerts turns recorded changes into notifications:

• Alert for — scope by classification: Static / Dynamic / All. Unknown-classified hosts never alert. (So "Static only" pings you about your fixed-IP gear but not roaming phones.)
• Per-type toggles — choose which change types push (new host, ports, MAC, hostname, offline/online).
• Attach device MAC — adds the MAC to alerts (offline/online, scan summary, digest) — handy for spotting a roaming device that keeps its MAC while its IP hops between access points.
• Summary after each scan — one grouped ntfy message per scan.
• Daily digest — a morning roundup at a time you set.

Per-host opt-outs (don't-alert-on-MAC / offline) live in the host's Edit dialog. All alerts respect quiet hours — see Notifications.

Typical setup

• Keep all change types recorded (so the feed is complete).
• Alerts: Static scope, with New host + Port opened + Offline/online on; port-closed and hostname off (noisier). Summary-after-scan for real-time, plus the daily digest as a safety net.

Needs Notifications configured for the push part.