Every change: recorded, approved, reversible

Automatic backups and version history

Device configurations are fetched regularly over SSH or Telnet and versioned.

• Diff any version against the previous one, and restore
• A fleet-wide backup-changes view
• Mirroring to S3/MinIO to keep copies off the server

Compliance and drift detection

Define must-contain and must-not-contain rules and every configuration is re-checked after every change.

• Ready-made baselines for Cisco IOS, MikroTik RouterOS and HP/Aruba
• Compliance score per device and per site, with a daily trend
• Violations stay open as records until they're fixed

Four-eyes change approval

A change is proposed, its command text frozen, approved by a different user, then applied.

• The proposer can never approve their own change
• The full device transcript is recorded when it's applied
• An immediate drift and compliance check right after

Change calendar

The first question in every incident is “what changed?”. Config pushes, alert silences, deployments and user changes sit side by side on one calendar.

Vendor packs: a new brand without a new release

Everything the platform knows about a vendor — which sysObjectID is which model, the command that dumps a configuration, the lines of that dump that are noise, the SNMP objects worth charting, what “hardened” means — is a file now, not code.

• Seven packs ship in the box: Cisco IOS/IOS-XE, Cisco NX-OS, MikroTik RouterOS, HP/Aruba, Huawei VRP, Fortinet FortiOS and Juniper Junos
• Every file in a pack is signed: an unsigned pack installs and is marked so, a badly signed one is refused
• Switch a pack on installation-wide or for one organisation only
• The same pack drives the scheduled backup, the drift check, device inspection, the sensors and the compliance library

Knowledge that travels between installations

The data is this installation's, but what an operator decided — thresholds, log rules, rotations, dashboards, runbooks, templates — is a portable file.

• Thirteen portable kinds in one standard bundle; references travel by key, not by internal id
• A dry run before every import, item by item: created, updated, retired, skipped or failed, each with its reason
• Importing the same bundle again updates what the first import created instead of duplicating it
• No credential is ever in a bundle: a channel arrives disabled, and the report names the secret you have to supply
• A starter pack ships in the box — CPU/memory/disk rules, log rules, a NOC board, runbooks and a template. For an MSP that is the whole “one reference installation, ten customers” story