- All
- Case Studies
- ChromeOS Monitoring
- Dashboard
- Linux Client
- Mac Client
- News
- Release Notes
- Success Stories
- Windows Client
All
- All
- Case Studies
- ChromeOS Monitoring
- Dashboard
- Linux Client
- Mac Client
- News
- Release Notes
- Success Stories
- Windows Client
Watchman Monitoring Webhooks Update: New Events, Payloads & UI
August 3, 2026
Hey folks! We’re happy to announce that we’ve just released a huge update to the Webhooks feature in Watchman Monitoring. Here’s what’s changed: Setting up an endpoint New “All events” firehose option. When you create an endpoint, it now defaults to receiving all events instead of making you hand-pick each one. Two-mode event selector. You choose between All events or Specific events, with validation so you can’t save a broken configuration, plus warning callouts (for Beacon-related events) when relevant. Refreshed event descriptions and a new transition reference explaining how status changes map to events, so it’s clearer what each event actually means. What ends up in the payload Webhook payloads now include richer, more meaningful fields: severity, previous_severity, mute_type, is_muted, and is_hidden. Backward compatible — the old integer fields (status_code, previous_status, new_status) are still sent alongside the new ones, so existing integrations keep working without changes. Slack-formatted messages show both the legacy and the new fields. Delivery behavior Smarter alert/warning triggers. The “Plugin alert” event (now labeled “Plugin alert / warning”) fires on more of the transitions users actually expect: entering Warning from OK or Informational, and entering Alert from OK, Informational, or Warning — so escalating from a warning to a full alert now sends an alert webhook, which it previously didn’t. It still won’t fire on de-escalations or a plugin’s first report. The underlying plugin_alert event type is unchanged, so ...
Read More →
Mac Client 7.2.1.105: Bundled Python Upgraded to 3.14
July 28, 2026
We are excited to announce that Mac Client version 7.2.1.105 will be rolling out next Tuesday (August 4, 2026). In 7.2.1.105 we have updated the copy of Python that ships inside the Watchman Monitoring Mac agent, moving it from 3.9 to the newest stable release, 3.14.6. Why we did this The agent carries its own bundled copy of Python so it does not depend on whatever version of Python is, or is not, present on a given Mac. Over time, that bundled 3.9 build started turning up in vulnerability scans. If you run endpoint security or vulnerability tooling, you may have seen it flag the Python inside the agent for known CVEs. Those flags are based on the version number rather than on anything the agent actually does, but they still create noise and questions for your team. Moving to Python 3.14.6 clears those version-based flags. As part of this work we also audited every bundled dependency for known vulnerabilities, and the built framework reports none. What to expect The update is automatic. The first time a Mac runs the new agent, it downloads and installs the updated Python framework. This is a one-time download of about 37 MB per ...
Read More →
Dashboard – Smarter Duplicate Computer Detection
July 28, 2026
We’ve shipped a dashboard update that makes Duplicate Computers a lot less noisy for Windows and Linux agents. For a while, users have been reporting machines that showed up as duplicates even though they were clearly different devices: different serial numbers, different sites, sometimes even different hardware. In most of those cases the dashboard was matching on a MAC address that wasn’t actually unique to the machine. What was going wrong On Windows and Linux, Watchman Monitoring treats two computers as likely duplicates when they share a hostname in the same group, or when they report the same system MAC address. That works when the MAC really identifies the machine. It falls apart when several unrelated computers all report the same address from somewhere else on the network path, for example: A Cisco AnyConnect (or similar) VPN virtual adapter that reuses one MAC across many clients A cellular hotspot / tether whose default MAC gets picked up as the active NIC VMware, Hyper-V, VirtualBox, and other virtualization adapters that share well-known OUI prefixes Shared docks or dongles that briefly look like “the” system MAC Separately, archived computer records were still included when building the duplicate list. That meant a wiped-and-replaced machine could keep looking like a duplicate ...
Read More →
Linux Release 4.0.11 – Kerio Connect Monitoring
July 28, 2026
We released Linux Agent 4.0.11 today. This update brings Kerio Connect Server monitoring to the new Linux agent, and fixes a quiet but important problem with how expirations reported by Linux plugins were being saved. Here’s what it does for Kerio Connect Server: Detects Kerio on its own by looking for the license file at `/opt/kerio/mailserver/`. On a host that isn’t running Kerio it reports informationally and stays out of your way, so there’s nothing to enable, deploy, or scope to a group. The plugin reads Kerio’s license file directly and reports the Base ID, license expiration, subscription expiration, licensed user count, and the registered company and contact email. Both dates are also reported as proper expirations — Connect (License) and Connect (Product) — so they land in your dashboard’s expirations list and give you the same advance renewal warning you already get for other tracked products. Kerio can be configured to run a service that isn’t actually up. The plugin reads every service set to start automatically, along with the IP addresses and ports each one is configured to bind, then checks those against the ports genuinely in a listening state on the machine. If a configured service isn’t answering, you get ...
Read More →
Linux Release 4.0.9 – Group Settings Sync and Failed Logins Reliability
July 9, 2026
We’re releasing Linux Agent 4.0.9 today. This is a focused follow-up to 4.0.7 with two reliability fixes we’ve seen on real customer Linux hosts. Upgrade through your normal package workflow: sudo apt-get update && sudo apt-get install --only-upgrade monitoringclient # Debian/Ubuntu sudo dnf upgrade monitoringclient # RHEL family After upgrading, monitoringclient version should report 4.0.9. Dashboard group changes now stick Some Linux computers were moving to a new group in the dashboard, then reporting back under the old group on the next check-in. That made it look like the dashboard was ignoring your change. 4.0.9 fixes that. Group, asset ID, and related contact fields from the dashboard are now kept in sync with what the agent reports locally. If you hit this on a host, upgrade to 4.0.9, set the group once more in the dashboard if needed, and let the next check-in run. Failed Logins recovers after journal changes On some Ubuntu and systemd-based hosts, the Failed Logins plugin could get stuck in a warning state after journald was restarted or reconfigured—even when SSH login monitoring was otherwise working fine. 4.0.9 clears that stuck state and picks the best available log source again, including falling back to /var/log/auth.log when it’s available. If Failed Logins was warning on every check-in after a journal or ...
Read More →
Linux Release 4.0.7 – Fixes to Enrollment, Dashboard Settings, and Login Plugin
June 27, 2026
We’re releasing Linux Agent 4.0.7 today. Since our last public Linux update (4.0.2), we’ve shipped several focused improvements across enrollment, hardware reporting, security monitoring, and group synchronization based on user feedback. This post covers everything in 4.0.3 through 4.0.7 so you have one place to see what’s new. Enrollment bug fix We fixed a bug that could prevent new Linux installs from enrolling successfully. Accurate installed RAM reporting Linux computers now report physical installed RAM from DMI (via dmidecode) when available, rather than relying solely on kernel-visible memory from /proc/meminfo. That matters on hosts where the kernel reports less than what’s actually installed—common with reserved memory, virtualization quirks, or certain hardware configurations. Dashboard RAM totals should now align more closely with what you’d see in asset inventory or on the box itself. The agent falls back to /proc/meminfo when DMI data isn’t available. Package metadata declares dmidecode as a recommended dependency on .deb and .rpm builds. Failed Logins monitoring restored on Linux The Failed Logins plugin is again at parity with the legacy Python Linux agent – and we’ve followed up with stability fixes for real-world log sources. What’s back: Incremental reads from /var/log/auth.log or /var/log/secure, so repeated failed SSH ...
Read More →
