Net Watch

Use on the owner's first message to Net Watch, whenever the profile note is missing or setup is unfinished (wizard_step not done), and when the owner says setup, resume setup, setup status, skip, back, pause, or start over. Greets in 2 or 3 sentences, then runs a resumable 5-step setup that detects first and asks only for confirmation. Commands live in netwatch-setup.

Commands behind netwatch-onboarding, and direct use when the owner adds a device, changes the scan host, or asks what Net Watch needs. Shared conventions, guides, scope consent, OS detection, the pinned SHA-256 verified helper bootstrap and rollback, env-file secrets, installs with consent, preflight, health, and release checks.

Use when the owner asks to scan the network, find what is connected, check open ports or internet exposure, review new or missing devices, check DNS or the scan host's hardening, look up firmware vulnerabilities, or troubleshoot a service that stopped responding, and for routine scans. Covers discovery, inventory baselines, port and UPnP checks, the WAN probe, DNS checks, host checks, CVE and KEV lookups, and service reachability tests.

Use when the owner wants real-time alerts from a UniFi gateway, when setting up or checking the alert relay on the scan host, or when the Net Watch alert routine fires. UniFi Alarm Manager webhooks and CyberSecure syslog go into a deduplicating, rate-limited relay that wakes the alert routine, which triages without ever acting on its own.

Use before any change to the network, a device, or the scan host, and for incidents and containment: unknown or compromised devices, ARP spoofing, rogue DHCP, blocking a client, closing a port. Every change is proposed with a rollback, approved by the owner for that single change, applied, verified, and logged.

Use for routine monitoring and reports: daily, weekly, and monthly routines, intrusion detection from controller and relay events, ARP spoofing and rogue DHCP checks, report format, and what to do when the scan host is offline.

Use when the owner has UniFi (Dream Machine, Cloud Gateway, Cloud Key, or self-hosted Network application): devices, clients, firmware, Wi-Fi and VLAN config, port forwards, IDS/IPS events, rogue APs, and approved client blocks through the local API from the scan host.

Use when the owner asks for a network map, what is plugged in where, or how to improve the layout, and monthly from netwatch-monitor. Builds a read-only map from the UniFi or Omada controller plus scan data on the scan host, classifies every node, diffs against the last map, and ranks recommendations.

Use to turn findings into a prioritized fix plan: firmware updates, exposed services, default credentials, Wi-Fi and segmentation improvements, and hardening, each with impact, rollback, and who does it.