Every ZWatch feature
Everything ZWatch does across firewalls, endpoint security, switches and Wi‑Fi, and email, in one offline console.
What sets ZWatch apart.
All in one console
Firewalls and VPN, endpoint security, switches and Wi‑Fi, and email gateways, from several vendors, in one place.
Fully offline
Built for segmented and air-gapped networks. No cloud, no internet connection, ever.
Read-only by design
ZWatch never needs administrator or write rights on any device.
Plain language
Every finding explains what happened, why it matters, how to fix it and who owns it.
Every log kept
No rolling deletion, and a full log disk never stops the platform.
Simple licensing
Licensed per firewall and endpoint security server, never per gigabyte or per event.
Firewalls and VPN
Configuration audit
Risky, unused, shadowed and overlapping rules found, each with the reason.
Policy clean-up workflow
A tracked, step-by-step plan to disable and remove rules safely.
Automatic configuration backups
The firewall sends its configuration on a schedule. Backups are encrypted at rest, with no admin access needed.
Attack-surface view
Every service exposed to the internet, and the rules that expose it.
Segmentation analysis
Which zones can talk to which, and where segmentation is too open.
Routing and SD-WAN analysis
Static routes, SD-WAN rules and member priorities evaluated the way the firewall does.
Reachability and what-if
Can A reach B? Every hop, rule and route on the path, before you change anything.
Linked firewalls
Firewalls connected by VPN or SD-WAN compared as pairs, with the gaps between them.
Access Planner
The exact rule, SD-WAN and routing changes needed for new access, per firewall.
Logs and traffic
Logs in plain language
Every log line translated into clear fields and a sentence anyone can read.
Fast log search
Search across all devices and all time in one place.
Traffic analytics
Top talkers, busiest hosts and bandwidth trends, per site and per link.
Every log kept
Nothing is deleted on a rolling basis, and the platform keeps running when disks fill.
Evidence exports
Findings exported with the original raw lines as evidence.
Syslog setup checks
Guided setup and troubleshooting in each vendor's own terms, so logs arrive correctly.
Detection and response
Attack correlation
Multi-stage attacks found across firewalls, VPN, endpoints and email.
MITRE ATT&CK mapping
Each incident step mapped to the tactic it represents.
Offline threat intelligence
Curated threat feeds shipped with every update, combined with the verdicts already in your device logs.
Behaviour analytics
Normal behaviour learned for users and hosts, with the outliers flagged.
Incident cases
Owners, status, timeline and a full audit trail for every incident.
Security score and work-list
One score for your estate and a prioritised list of what to fix first.
Threat map
Blocked attacks on a live world map by origin, with the top sources ranked.
Reports and notifications
Executive reports
A short, plain-language view of risk and progress for management.
Technical reports
Findings, evidence and fixes in full detail for engineers.
Compliance reports
Coverage per control and evidence, ready for auditors.
Scheduled delivery
Reports created and emailed automatically on the schedule you choose.
Email alerts
Instant notifications for critical findings, correlated incidents and device health, to the recipients and severity you choose.
Policy change emails
Every firewall policy change emailed with the rule before and after, side by side.
Endpoint security
Server health check
Service, database, update distribution and agent coverage checked per management server.
Recommended policy settings
The settings that close real gaps, ranked by impact.
Security assessment
A structured review of how your endpoint security is configured and used.
Detections explained
Each detection in plain words, with device, user and action taken.
Vendor-first views
Choose the vendor first, so findings and steps of different vendors are never mixed.
Licensed per server
Licensing counts endpoint security servers, not individual endpoints.
Switches and Wi‑Fi
Loop detection
Loops and topology changes traced to the switches involved.
Port errors
CRC errors, duplex and speed mismatches that point to faulty cables or network cards.
Bottlenecks
Uplinks and ports running close to capacity, and when they peak.
Wireless health
Controllers, access points and client problems in one view.
Troubleshooting per family
Checks and steps written for each device family.
Root-cause links
Network evidence feeds the incident and root-cause views automatically.
Email security add-on
Mail flow
Delivered, quarantined and rejected mail, with trends.
Phishing and malware
Lookalike domains, malicious attachments and links, with the users targeted.
Delivery problems
Delays and refusals explained, with the partner and the reason.
Linked to endpoints
A phishing message connected to the detection on the PC that opened it.
Its own settings
Separate log settings, shown or hidden as you need, licensed as an add-on.
Backup security add-on
Agentless integration
Backup servers send their events by syslog to ZWatch's own receiver. No agent and no access to the backup server. One leading backup platform is supported today, with more to follow.
Every job, every machine
Each job run with result, duration and data transferred, and each machine's backups and restore points.
Golden images
For every machine, the newest restore point you can trust: succeeded, not corrupted, clean and made before any incident, cross-checked with endpoint security.
Ransomware and tampering alerts
Attempts to delete backups, deleted repositories or restore points, four-eyes authorization switched off, malware in a backup and unapproved updates.
Restore monitoring
Who restored what and when, with alerts for restores outside working hours or of sensitive systems.
Coverage
Servers known to ZWatch that are not in any backup, flagged automatically.
Change control
Permanent version history, update requests with manager approval and email notifications, and alerts for updates made without approval.
Best-practice assessment
15 checks covering 3-2-1-1-0, recovery testing, malware detection, access control, encryption, configuration backup, supported versions, RPO and success rates.
Compliance report
A PDF for management and auditors, on demand or scheduled monthly by email.
Syslog health monitoring
Know immediately when a backup server stops reporting.
Flexible history
Filter from 24 hours to one year, or any date range. Data is kept for one year by default.
Add-on licence
Licensed as an add-on, and shown or hidden like any ZWatch module.
Unified action: Command center and Action center
Command center
One view of your security estate across every area, stating exactly what it covers.
Action center
Every open finding from every area, each with its fix, so nothing is hidden.
Root-cause grouping
Related findings grouped so one change solves them all, ranked by impact.
Compliance
Framework mapping
Findings mapped to CIS Controls, ISO/IEC 27001 and NIST CSF.
Coverage per control
See how well each control is covered, and what is missing.
Audit evidence
Evidence exports ready for internal and external auditors.
Incidents in ATT&CK terms
Incident timelines described with MITRE ATT&CK tactics.
Platform and security
Virtual appliance
One ready-to-run appliance that prepares itself on first start.
Offline updates
New features and threat intelligence delivered as packages you install.
Encrypted at rest
Configuration backups and stored data encrypted on disk.
Read-only
No administrator or write rights on any device, ever.
No stored passwords
Domain passwords and hashes are never saved or cached.
Built-in help
Help on every page, articles, troubleshooting guides and “What's the difference?” comparisons.
Multi-vendor
Several vendors per area, each shown in its own terms.
Light and dark themes
A clear interface for the operations room and the office.
Device-bound licences
You register your own device serials, and an expired licence shows only the licence page.
See ZWatch on your own network.
Ask for a trial licence and we will help you connect your first devices.