Devices

The device list is the inventory: everything Nyxtrace has ever seen on the network, with what it knows about each one.

The list

Filterable by free text, VLAN, device type, minimum risk score and last-seen time. Each row carries the display name, the type, how that type was decided, the addresses, the VLANs, tags, first and last seen, the current score and the open incident count.

How the type was decided is shown, not hidden. A device type is either observed — with a confidence value — or human_confirmed, which means someone looked and said so. A confirmed classification has confidence 1 and is never overwritten by an automated judgement afterwards.

The device detail

The head of the page: name, addresses, MAC addresses, VLAN, type, owner, an optional link into your own inventory system, and the score with its history.

Below that:

Pattern of life. A week grid — hour of day by day of week — showing bytes or new destinations per cell. This is the single most useful view for a homelab: a camera that uploads at 03:00 every night looks like a pattern, and a camera that uploaded at 03:00 for the first time last night looks like a hole in one.

Peers. The internal devices this one talks to, with volumes.

Destinations. The external addresses and domains it reached, each with a first-seen timestamp — and a threat-intelligence marker if you have a list configured and it matched.

Services, domains, fingerprints, user agents. Bounded aggregates from the typed source views, each with an observation count and a last-seen time. The raw payloads behind them are never returned through the browser API.

Identity. The anchors that make up this device’s identity, with class, value, source, weight, first and last seen, how many separate days each was observed, and two markers: whether the address is a randomised privacy address, and whether the anchor class can only confirm an identity rather than establish one. Plus every merge event, with its rule, confidence, anchors and — if one happened — the split that reverted it. See device identity.

A confidence below 0.90 means the identity is derived rather than proven, and the interface says so rather than presenting it as fact.

Incidents. This device’s incident history, chronologically.

Editing a device

An analyst may set the display name, the device type, the owner and the tags. Doing so records the classification source as human_confirmed, sets confidence to 1, bumps the revision and appends to the workflow history.

Concurrent edits are caught rather than merged: a write carries the revision it was based on, and a conflicting write is rejected so you can re-read and decide, instead of one person’s change silently overwriting another’s.

Truncation is stated

The peer and destination detail walks a bounded number of flows. If it reaches that bound, the response says so with an explicit marker rather than presenting a partial list as complete. The typed aggregates stay server-side and complete.