v4.4.3

• TP-Link Omada: a block made in Respond for a device that has an address could not be released ("Give a plain MAC address") and stayed in force until it ended by hand on the controller; the release now finds the hardware address the block was made for. An action that is stuck in "Removal failed" releases with Retry now after the update.
• Respond finds the controller of a device that the inventory holds in several rows (for example seen by the local capture and by an agent): the controller that lists it is now recommended and preselected instead of "does not know this device".
• MikroTik Wi-Fi: a router that manages access points with CAPsMAN but has no separate Wi-Fi package (a hEX, for example) is no longer reported as "no Wi-Fi package", so its clients are read and the Wi-Fi responses are offered. The documentation describes what a block through the router covers and does not, and how to set up the new CAPsMAN with one connector.

v4.4.2

• TP-Link Omada no longer carries the Experimental label. It was tried on a real controller with a gateway and an access point. Fixed: with a controller of the 5 series a block was refused as "no record of this client" because DENIS asked for the client in the wrong spelling of its hardware address.
• Respond places a device by what its controller reports as well. A device that moved behind a router DENIS cannot see is placed by the address its controller (UniFi, Omada, Meraki and the others that list clients) reports, and the card says how and where the controller sees it.
• Address-conflict alerts now say what DENIS saw: the kind of packet (an ARP reply, a DHCP acknowledgement, an mDNS announcement and so on), the capture interface, the VLAN, the Ethernet source and, when known, how the other holder of the address was last seen. Alerts raised before this version are unchanged.
• An mDNS announcement that crossed a router is no longer taken as the router claiming the announcer's address.
• MikroTik Wi-Fi: a block can no longer leave an entry in the router's access list while DENIS reports that nothing was changed, a router that has no Wi-Fi package no longer offers the Wi-Fi responses in Respond, and the documentation names CAPsMAN as the way to run many MikroTik access points with one connector.

v4.4.1

• The Rules page is one list with one model. Every rule has the same row and the same switch: on judges and raises alerts, off does nothing. It saves at once with Undo, for built-in, IT, OT, several-conditions and MSP rules alike. Your own rules and the rules your MSP sent are one card, Your rules. The settings for all rules (performance protection, the setting for new rules, learning mode, noise profiles) are folded into one place.
• Processing impact replaces Cost: it shows how much of its time budget a rule used. A rule the overload protection paused stays on and says so, with a button to run it again.
• New rules are a mark, not a section. A rule new in a release arrives off and carries New in 4.4.0 among the other rules of its group, with Turn on all, Turn on the recommended and Mark all as reviewed, each with Undo. Fixed: the switch of a rule that was still new answered on but changed nothing.
• Trials are removed. A rule is on or off. A rule that was in a trial when 4.4.1 started is switched off, with one notice naming the rules. Imported rules and rules sent by an MSP now arrive off; old rule files with trial settings still import.
• Respond: the equipment cards keep their width, long labels and method choices no longer run out of the card.
• Respond now knows when a controller (for example TP-Link Omada) lists the device as its own online client: that controller counts as being on the device's path, is recommended and needs no path warning. A controller that does not list the device is still chosen by hand.
• Cisco Catalyst stacks are read and controlled through one address, member by member, and a stack's model names every member. Verified on a physical Catalyst 9200L stack in the Cisco DevNet sandbox. Quarantine by VLAN on Cisco carries no Experimental label any more.
• TP-Link Omada: the connection, the clients and the devices of a real controller (5.15) are verified. A controller without the newer client list now checks a block through the client's own record. Omada stays Experimental until a block through DENIS is verified.

v4.4.0

Before you update: back up the DENIS database and the file secrets.key. At the first start 4.4 changes the format of stored passwords and keys in one step, and 4.3 cannot read it. The way back (a command, or your backup) is described in the High availability page.

• Connectors: DENIS shows where a device is plugged in (access points and switches under their controller, virtual machines under their host). New: TP-Link Omada, MikroTik Wi-Fi and Cisco Catalyst 9800 wireless controller (all Experimental, not yet tried on real equipment). UniFi Wi-Fi blocking, the Cisco FDM and FMC firewalls and AWS were tested in a lab and carry no label. Azure stays Experimental.
• Respond is one dialog that names the few responses that can work for this device and why one is recommended.
• Address spaces: the same address in two routing domains is no longer taken for one network. A shared hardware address can be split by an administrator.
• Twelve new detections (three, for name poisoning and industrial networks, are Experimental). After an upgrade they arrive switched off and wait on the Rules page. New: a trial mode for rules, exceptions with an expiry, a view of what a change would have done over the last days, and the reason a rule alerted or did not.
• Write your own rules with several conditions, try them, export, import or start from a template. Counts and sequences are Experimental and off by default.
• An MSP can send you rules. You stay in charge: not allowed (the default), ask me, or into a trial. MSP management is no longer marked Experimental.
• Shipped lists can update themselves; off by default. The abuse.ch feeds use the current ThreatFox and URLhaus interfaces.
• Alerts and notices go through a durable queue: a receiver that is down, a restart or a failover no longer loses a message.
• Every customer has its own data key. You can rotate it and the master key while DENIS runs and keep a passphrase copy of the master key.
• Two servers on one PostgreSQL database are safer, and customers can live in PostgreSQL (both Experimental; tested in containers and a local fault lab, not on a managed service).
• Easier start: a Start page, one-line enrolment of agents, single-use invitations for MSP customers. Licensing counts devices seen in the last 30 days (tiers DENIS 500, DENIS 5000, DENIS 20000).
• Security fixes from the code review and patch updates of libraries, among them certificate verification.

v4.3.0

• More than 40 new detections. Industrial networks: new control functions, program uploads, several masters, a changed device identity, scanning, new protocols, remote-access paths and commands outside working hours. Office networks: brute force from outside, DNS threat domains, mining pools, VPN and anonymizer use, remote-access tools, a changed gateway and a rogue DHCPv6 server. The threat-domain list needs a free abuse.ch key, entered in Settings.
• Detection runs on its own threads and each detection is measured. Under overload DENIS can pause the heaviest optional detections and tells you.
• On any alert you can say This is normal, and DENIS counts what was accepted and dismissed per detection.
• A new page, What DENIS cannot see, shows blind spots and link quality. A Not managed view lists unmanaged devices, and each device has a timeline. Duplicate packets from SPAN or TAP copies can be counted or removed.
• Any managed switch with standard SNMP can now be read. Port off and quarantine VLAN on such switches are Experimental, off by default, need a write test and were tested only on simulators.
• API tokens have scopes, expiry, rotation and an acts-as mode. Site-limited accounts can no longer change other sites through imports or new devices.
• An administrator limited to some sites is now a site administrator: they manage only those sites and no longer see Users, Audit or installation settings. On upgrade, an administrator who already has such a limit becomes one; a full administrator always remains.
• The Network section has a new map with zoom, search, groups and cable drawing that saves itself, and new Map, Equipment, Response and Setup pages.
• UniFi and Meraki can show the clients they see (access point, network name, port) on the map. It only reads; it is on for a new connector, and an earlier UniFi connector reads clients once you tick it. Meraki is Experimental.
• Capture sources can be grouped into separate networks, so the same VLAN number on two networks is not taken for one. A hardware address can be marked as shared.
• Palo Alto: extended support. Cisco switches: fewer missed VLAN reads and a stricter quarantine VLAN write test.
• PostgreSQL: the new 4.3 database code was reviewed and compiled but not yet run against a live PostgreSQL database.
• Licence: an organisation may evaluate the Community edition free for 30 days from its first installation (up to 100 devices); see LICENSE, clause 2A.

v4.2.4

• Cisco switches: a VLAN whose per-VLAN read gets no answer while other VLANs answer is now advice only. Switch off port and Move port to quarantine VLAN are refused only on a port that carries such a VLAN, and the refusal names the VLANs. A VLAN without ports never blocks anything; a trunk, whose VLANs DENIS does not read, is still refused.
• Cisco switches: when the first VLANs read give no answer, DENIS reads VLAN 1 before deciding that the switch does not answer per-VLAN reads at all, so the other VLANs are still read.
• The Switches card no longer says the tables were cut off when only some VLANs did not answer; it says that DENIS does not act on ports in those VLANs until they are read.
• The device location is incomplete only when the device's port carries a VLAN that was not read.
• Test write: when the write user may not change whether a port is on, the result says so and that Switch off port cannot work. Test write never writes a port's VLAN.
• Cisco switches: a new Test quarantine VLAN write button, in the switch details and the switch editor, writes a free port's current VLAN back to it without changing it, and says whether Move port to quarantine VLAN can work and, if not, what the write user is missing.
• Cisco switches: a device that moved to another port is no longer named on its old port when its VLAN was not read in the last poll and the old port is down or its link changed.
• Cisco switches: a trunk, a port whose mode or VLAN was not read, and every port when the list of port VLANs was cut short now count every VLAN that was not read, and a VLAN a port is in is read or named as not read even when the switch does not list it. Test quarantine VLAN write skips the VLAN write when the port has come up, and its refused message no longer says the VLAN was set.
• Switches docs: Cisco SNMPv3 and SNMPv2c setup for port actions, why some VLANs stay silent, and a troubleshooting table.
• A DHCP reply seen at one site no longer warns about the same router address at another site, and the warning for an address a DHCP server names as a router uses the DHCP replies seen at the connector's own site when no known device holds the address.
• The plan for an action on a dual-stack device's IPv4 address now says that its IPv6 traffic stays open.
• The Respond menu asks the server again after a switch is read or an action changes something, so it no longer shows an older state.

v4.2.3

• Fix: a computer that only exchanges internet traffic is no longer taken for the network's gateway. Traffic alone now supports a gateway only when DHCP, a route or a person already names it, and traffic to another private network is no longer read as a next hop.
• A gateway that DENIS only guessed (named by DHCP replies, never confirmed) now gives a warning a person ticks, and automation does not act on it. A confirmed gateway, or one with firm evidence (a route, a polled routing switch), is still refused with no way around it.
• The refusal and the warning now say which device and which address caused them.

v4.2.2

• Palo Alto: a record is closed as resolved by hand, or as not applied after an interrupted start, only when DENIS's tag is really gone from the firewall. When the group lists a device later than expected, its open sessions are ended once more before the block counts as in force.
• Respond and automation act on a device's IPv4 address when it has one; its IPv6 address is used only for a device without a current IPv4 address.
• MikroTik: End sessions reports a refusal from the router instead of saying the sessions were already gone.
• Block guard: an address that only DHCP replies name as the router now asks a person to confirm (automation does not act on it), and gateway data that cannot be read refuses the action.
• Installer: a PostgreSQL installation is recognised more reliably, including one whose database address is in the service settings. The installer stops when the service file itself names the database (keep it in /etc/denis/env), and it warns when pg_dump is missing. An agent is no longer installed over the program of a PostgreSQL master on the same machine.
• Updates on PostgreSQL: the console says when pg_dump is missing instead of failing at the backup.
• denis user scrub-backups no longer names PostgreSQL backups made after the secrets were sealed as holding readable secrets.
• Connection stability test: with ping switched off, with --passive-only or on a console that does not capture itself, nothing is sent and the result covers the browser leg only, never a false 100% loss.
• The API description now names the MSP operator sign-in, lets an API token read its own identity and says when a request can raise its MSP class.
• Devices: the search and the IP column of the device list now include the addresses of interfaces merged into a device, so a firewall seen under two addresses is found by either.

v4.2.1

• New: an OpenAPI description of the API, served by the console to signed-in users and attached as a file to every release.
• Fix: the certificate and web page check no longer connects to devices on a network whose port scan is switched off, and the connection stability test sends no pings when ping is switched off for its target's network.
• Fix: DENIS now finds all of its own objects on a Check Point management server, not only the first 500 of a kind.
• A standby node of a PostgreSQL pair now checks its secrets.key against the pair's when it starts, not only when it takes over.
• New: denis user scrub-backups seals authenticator-app secrets left readable in scheduled and manual backups; the pre-update copies are included only with --include-update-copies.
• Connector forms: the explanation under each field is now one short line, with the longer note behind an (i) next to the label. The Active responses table has its explanations on the column headers instead of inside the rows.
• Palo Alto: a block is shown as in force only when the firewall's group really contains the address.
• FortiGate: ending sessions and quarantine are now verified on real equipment; a device is no longer refused as the connector's own device because of a brief old sighting of its address.
• The Active response strip is clearer: plain headline, equal buttons, Extend within reach.
• New: a ready-made PostgreSQL build for high availability is attached to every release (denis-pg-...), no self-build needed. PostgreSQL installations built by hand: update with install.sh --postgres, not the Update button.
• Buttons that take a moment now show Please wait and cannot be clicked twice; waiting areas such as the response plan show a spinner and "Working, please wait".
• UniFi: DENIS reuses its sign-in and waits when the controller limits sign-ins. MikroTik: ending sessions reports what it removed or that the router refused, and warns when the router would keep TCP sessions alive.
• MikroTik: block, quarantine and ending sessions are verified on real equipment; UniFi: block by firewall policy is verified, block by hardware address is not recommended for wired devices.
• A device that moves between ports or networks is now judged by where it is now: old addresses no longer block or mislead Respond.

v4.2.0

• Fix: the console could stay empty after signing in when a file failed to load; files are now loaded before sign-in and retried.
• Every response plan says exactly what it covers (the address, or the flow's protocol and port) and which other addresses of the device it does not.
• Quarantine of a device that was in a protected network days ago now asks you to confirm instead of refusing.
• Extend: add time to what is left (the default) or end a set time from now, with the new end time shown before you confirm.
• Changes of a connector's safety settings are audited with old and new value; the deny-rule switch shows on only when it really is.
• MikroTik: a device block on a router with default rules is now confirmed instead of reported as not confirmed.
• FortiGate: End sessions says what FortiOS answered, and blocking a device closes its open sessions again.
• Fix: a device's Respond menu no longer closes by itself while the page refreshes in the background.
• The Respond menu shows where a device is, offers a port or firewall only when DENIS is sure, and says why an action is unavailable.
• A router or firewall seen under several hardware addresses is one device: linked when it lists them itself, or when you confirm.
• One device: DENIS says why it suggests instead of linking, or why linking is paused.
• Action notifications name the device; a bell lists what you should know.
• UniFi: sign in with an API key; block by firewall policy (verified on a Cloud Gateway Ultra).
• Uplinks and trunks: by hand only, with warnings. SNMPv3 port control is validated.
• Palo Alto: block a device in seconds, no commit, through a dynamic address group (verified on a PA-220).
• Map: the cables between switches, firewalls and access points, each marked confirmed, best guess or set by hand; fix one by dragging.
• Equipment: one row per device (a firewall that is also a switch appears once), no sideways scrolling, ordered by wiring or by hand.
• Capture: DENIS starts without a mirror link and recovers on its own; interfaces and monitored networks change in Settings without a restart.
• Your rules can prepare a block for you to approve, or block by themselves after a 7-day trial (experimental).
• Cisco switches with many VLANs are read in turns; a connector never acts on its own device.
• Security updates install automatically by default (Settings > System).
• Port scan and ping can be switched off, for all networks or one.
• Consistent help buttons across the console.