NetOutpost
Meet NetOutpost v0.1.45 preview

Your network.
On watch.

Find exposed services. Catch suspicious activity.

Use Explore to discover your devices and the services they make available on your LAN. Use Decoys—isolated honeypots—to detect unexpected activity from devices on your network. Get real-time alerts and recommendations when NetOutpost detects suspicious activity, even while you’re away.

Get NetOutpost See how it works
Network overviewTHE NETOUTPOST DASHBOARD

NetOutpost developer preview. Real application screens with fictional demonstration data.

EXPLORE & DECOYS

Know what’s exposed.
See who comes looking.

Two separate tools, working together across your network.

EXPLOREDiscovery & inventory

What can be reached
on my devices?

Explore checks real devices on your network for open ports—the entry points to services such as a camera’s web page or a server’s remote login.

  • Find devices. Check your network, known devices or a single IP. Start with common ports or choose a deeper scan.
  • Review internal exposure. See local services, risk indicators and practical advice.
  • Check your external perimeter. Optionally run an external scan to see which services are exposed on your public IP address.
  • Keep the history. Background discovery updates device names, known manufacturers, open services and IP address history.
FOR EXAMPLE

A storage server or office NAS exposes a remote login you don’t use. Explore helps you find it and decide whether it should be disabled.

Your devices and their services
New service found? Review it in Alerts.
DECOYSDetection & evidence

Is something trying
to get in?

A decoy is a honeypot: it emulates a device service on your computer. It responds to connections so you can see what a visitor tries to do inside an isolated, secure sandbox.

  • Choose from 29 included decoys. SSH, Telnet, Android ADB, router login, camera web interface, RTSP, ONVIF, Reolink, MQTT, Redis, configurable TCP, VNC, SNMP, NTP, Docker API, Elasticsearch, Hadoop YARN, Jenkins, Spark, Gitea, NAS, DVR, MongoDB, SMB, FTP, SMTP, UPnP, Apple Remote Desktop and Apple file sharing.
  • Record the interaction. Capture sign-in attempts and commands. Simulate responses without running commands or downloading files.
  • Keep watch. Available decoys are enabled by default. Monitoring continues with the app closed; settings and YAML are available when you need them.
FOR EXAMPLE

A camera tries a password on the SSH decoy, then sends a download command. NetOutpost records the sequence for you to investigate.

The services NetOutpost emulates
Unexpected interaction? Investigate it in Alerts.

Explore checks what devices expose. Decoys record activity directed at them. Neither inspects every connection on your network.

ALERTS & INVESTIGATION

Know what changed.
See what happened.

Explore flags service changes. Decoy activity shows what connected and what it tried. Alerts brings the severity, evidence and next step together.

Service changes

New or reopened services appear as Info alerts. Choose Info if you want notifications for these changes.

Decoy activity

Basic discovery activity is Low, sign-in attempts are Moderate, and suspicious commands are High. Choose which severities send notifications.

Understand the activity.
Decide what to do.

  1. Identify the device

    See the source address, known manufacturer and linked device history.

  2. Read the evidence

    Follow the timeline. Expand commands, service responses and protocol details.

  3. Take the next step

    Follow the recommended action, add a note, and acknowledge or resolve the alert.

Get notified with the app closed.

Desktop notifications in real time. Optionally add remote notifications including email, Pushover, Telegram, Discord, Slack or webhooks in Settings.

SECURITY & PRIVACY

Built to contain suspicious activity.

Decoys run in WebAssembly (WASM) sandboxes, with a separate restricted process for each session.

ISOLATION

No access to your files.

Application secrets stay outside the sandbox too. Memory and execution limits keep each session bounded.

NETWORK

No outbound connections.

Decoys cannot contact other devices or the internet. Download and execution attempts are recorded without running them.

YOUR DATA

Evidence stays local by default.

Recognized secrets are redacted by default. You choose what to retain, which notifications to send and whether to share data.

Administration is local by default. Optional remote access uses HTTPS and a login.

Privacy details

MACOS & LINUX

Get NetOutpost.

Choose the version for your computer.

DEVELOPER PREVIEW

NetOutpost 0.1.45 · build 47 · Choose your platform and review the installation notes. Installation notes ↗

Windows

COMING SOON
Linux archives & checksums
Linux ARM64 · TAR.GZLinux x86-64 · TAR.GZSHA-256 checksums

Before you start

Does the app need to stay open?

No. The background service keeps monitoring and sending notifications while your computer is awake and connected. Monitoring stops during sleep or shutdown.

What can NetOutpost see?

Discovery finds reachable devices and open services. Decoys record connections directed at them; they don’t inspect all network traffic. An alert is a reason to investigate, and NetOutpost works alongside your firewall and device updates.

How do I receive alerts?

Desktop notifications open the matching incident. You can also add email, webhooks, Pushover, Telegram, Discord or Slack. Choose the minimum alert severity in the app.

What if I take my laptop to another network?

With network protection enabled, NetOutpost detects gateway changes and pauses monitoring until you review the new network. Use it on networks you own or have permission to assess.