OverWatch collects from your whole estate, reads your logs for meaning, and correlates it into incidents you can act on — self-hosted, multi-tenant, and secure by design.
Live device inventory in OverWatch — one view across every vendor and device class.
Active polling for reachability, latency, and packet loss (ICMP), plus SNMP for CPU, memory, interfaces, and environment — with per-device OID profiles for accurate readings across vendors.
First-party collectors go beyond SNMP to pull rich, structured data straight from platform APIs — cluster and guest metrics, wireless clients and flows, storage pools and SMART, firewall sessions and traffic.
A token-secured HTTP event collector, a built-in syslog server (RFC 3164/5424), and Windows Event Log ingest feed one normalized event store — with a zero-dependency agent for tailing files.
Discover devices and fingerprint vendors automatically, map neighbor links into a live topology graph, and manage address space with built-in IPAM — subnets, host inventory, and DHCP lease ingest.
Retain metrics with downsampling, trend usage over time, and forecast days-to-full for storage pools and datastores — so capacity incidents are raised before anything actually fills.
Monitor camera and NVR estates through a vendor-neutral provider model — detection stalls, offline cameras, detector latency, and low storage all surface as signals.
Deploy lightweight collectors at remote sites. They enroll over the network with mutual-TLS, then forward normalized telemetry back to the core — so one platform covers many locations.
When the link to the core drops, telemetry spools to durable disk and replays in order on reconnect. A layered watchdog suite — including a dead-man supervisor and peer corroboration — tells node-local trouble apart from a real outage.
Build once, gate, and roll every node from inside the platform. It detects when a newer build of itself is available, can apply it on its own, and reconciles environment changes across the cluster without a rebuild.
Assemble the exact view your team needs from a catalog of live panels — the metrics that matter to you, arranged your way.
Every metric gets a self-updating baseline (an exponentially weighted moving average); the platform then flags readings that stray far from it — scored in standard deviations — with sensible floors for CPU, memory, disk, latency, and event rate. Log signatures catch known failure patterns, and everything correlates into incidents by shared entity and time.
Device-down, high latency, packet loss, interface-down, high CPU/memory — plus statistical anomalies.
Root cause, entity, severity escalation, impacted-device count, and auto-resolve.
Live feed over Socket.IO; the NOC view updates the moment something changes.
A continuously-active source that suddenly goes quiet becomes an incident within about a minute — and auto-resolves when it resumes.
OverWatch correlates brute-force attempts, port scans, and anomalous east-west traffic from logs and session data, then shows the evidence behind each call. The policy engine enforces segmentation, egress allowlists, and privileged-access rules — keyless and self-learning, with no drift tolerated.
Every containment decision links back to the signal that triggered it — no black box.
Guest VLANs isolated, only gateway-role devices may NAT, MFA on console.
An expected telemetry feed that goes quiet is flagged as a potential gap.
Your monitoring platform sees everything — so it's built to protect what it holds.
Password login with lockout, TOTP MFA with recovery codes, WebAuthn passkeys, and enterprise SSO.
Custom roles and permission keys, plus service accounts and full session-activity audit.
Device and integration secrets encrypted at rest with AES-256-GCM, keyed outside the data directory.
Capture running configs and version them only when they change — a clean history of every device.
Read and surface your firewall rulebase so policy is visible alongside the traffic it governs.
Geolocate device IPs and session endpoints on a live world map to see where traffic is really going.
Remote collectors authenticate with per-node mutual-TLS from an internal certificate authority, with live certificate issuance at enrolment.
Built-in proxies block server-side request forgery — loopback and cloud-metadata egress are refused on every request.
A modular catalog spans network, security, virtualization, storage, wireless, surveillance, and notification vendors — so coverage expands without waiting on a new release. Run it multi-tenant for MSP scale and cluster it for high availability.
Vendor coverage as installable modules across every major category.
Isolate clients and scope every device, event, and incident by tenant.
Leader-elected polling, dynamic worker nodes, and HA on your own infrastructure.
We'll walk your team through live collection, the AIOps engine, topology, and Walker — on sample data, at your pace.