Release 4.4.3 · 2026-11-06
What’s new in DENIS 4.4
Know where a device is plugged in, write and try your own rules, and trust that alerts are not lost. Back up before you update: the first start changes how stored passwords and keys are kept. Experimental parts are marked.
New in 4.4.3
- TP-Link Omada. A block made in Respond for a device that has an address can now be released; the release finds the hardware address the block was made for. An action stuck in "Removal failed" releases with Retry now after the update.
- Respond finds the controller. A device that the inventory holds in several rows (for example seen by the local capture and by an agent) is found by the controller that lists it, which is recommended and preselected.
- MikroTik Wi-Fi. A router that manages access points with CAPsMAN but has no separate Wi-Fi package, a hEX for example, is no longer reported as having no Wi-Fi package. The documentation describes what a block through the router covers and does not, and how to set up the new CAPsMAN with one connector.
New in 4.4.2
- TP-Link Omada. No longer Experimental. It was tried on a real controller with a gateway and an access point. Fixed: with a controller of the 5 series a block was refused as "no record of this client" because DENIS asked for the client in the wrong spelling of its hardware address.
- Respond places a device by its controller. A device that moved behind a router DENIS cannot see is placed by the address its controller reports, and the card says how and where the controller sees it.
- Alerts name their evidence. An address-conflict alert says what DENIS saw: the kind of packet, the capture interface, the VLAN, the Ethernet source and, when known, how the other holder was last seen.
- MikroTik Wi-Fi. A block can no longer leave an entry in the router’s access list while DENIS reports that nothing was changed. A router with no Wi-Fi package no longer offers the Wi-Fi responses. The documentation names CAPsMAN as the way to run many access points.
New in 4.4.1
- One list of rules. Every rule has the same row and the same switch: on judges and raises alerts, off does nothing. It saves at once, with Undo, for built-in, IT, OT, several-condition and MSP rules. Your own rules and the rules your MSP sent are one card.
- Processing impact. It replaces Cost and shows how much of its time budget a rule used. A rule the overload protection paused stays on and says so.
- New rules, and no trials. A rule that is new in a release arrives off and carries a mark among the others, with Turn on all, Turn on the recommended and Mark all as reviewed. Trials are gone: a rule is on or off. A rule that was in a trial when 4.4.1 started is switched off, with one notice.
- Respond. The equipment cards keep their width. A controller that lists the device as its own online client, for example TP-Link Omada, counts as being on its path and is recommended, and the card says how it sees the device.
- Cisco Catalyst stacks. A stack is read and controlled through one address, member by member. Verified on a physical Catalyst 9200L stack in the Cisco DevNet sandbox. Quarantine by VLAN on Cisco no longer carries an Experimental label.
- TP-Link Omada. Reading was tried on a real controller (5.15) with an ER605 and an EAP110 and worked. A controller without the newer client list now checks a block through the client’s own record. Omada stays Experimental until a block through DENIS has been tried.
Before you update
- Back up first. Back up the DENIS database and the file secrets.key. At the first start, 4.4 changes the format of stored passwords and keys in one step, and 4.3 cannot read it. The way back (a command, or your backup) is described in the High availability page of the documentation.
Know where a device is plugged in
- What a device hangs on. DENIS shows where a device is plugged in: access points and switches under their controller, virtual machines under their host.
- New connectors. TP-Link Omada, MikroTik Wi-Fi and the Cisco Catalyst 9800 wireless controller. When 4.4 came out all three were Experimental and not yet tried on real equipment; TP-Link Omada has since been tried on a real controller and carries no label (4.4.2).
- Tested in a lab or sandbox. UniFi Wi-Fi blocking was tested in a lab, the Cisco FDM and FMC firewall block in the Cisco DevNet sandbox on virtual devices, and AWS in a lab AWS account. Each is tested only for the actions named on the supported infrastructure page. Azure stays Experimental.
- One Respond dialog. Respond is one dialog that names the few responses that can work for this device and why one is recommended.
- Address spaces. The same address in two routing domains is no longer taken for one network. A shared hardware address can be split by an administrator.
Detections and rules of your own
- Twelve new detections. Three of them, for name poisoning and industrial networks, are Experimental. After an upgrade they arrive switched off and wait on the Rules page.
- Try before you trust. A trial mode for rules, exceptions with an expiry, a view of what a change would have done over the last days, and the reason a rule alerted or did not.
- Write your own rules. Rules with several conditions, which you can try, export, import or start from a template. Counts and sequences are Experimental and off by default.
- Rules from your MSP. An MSP can send you rules. You stay in charge: not allowed (the default), ask me, or into a trial. MSP management is no longer marked Experimental.
- Shipped lists. Shipped lists can update themselves; off by default. The abuse.ch feeds use the current ThreatFox and URLhaus interfaces.
Reliability and keys
- Alerts that are not lost. Alerts and notices go through a durable queue: a receiver that is down, a restart or a failover no longer loses a message.
- Keys you can rotate. Every customer has its own data key. You can rotate it and the master key while DENIS runs and keep a passphrase copy of the master key.
- PostgreSQL and two servers (Experimental). Two servers on one PostgreSQL database are safer, and customers can live in PostgreSQL. Both are Experimental: tested in containers and a local fault lab, not on a managed service.
Easier start and licensing
- An easier start. A Start page, one-line enrolment of agents and single-use invitations for MSP customers.
- Licensing. Licensing counts devices seen in the last 30 days. The tiers are DENIS 500, DENIS 5000 and DENIS 20000; above that a license is arranged individually.
- Security fixes. Security fixes from the code review and patch updates of libraries, among them certificate verification.
Since 4.3
What came in 4.3, the release before this one. The pictures are from the Network section it introduced, on demo data.
See your network
- A new Network section. A network map with zoom, search, groups and cable drawing that saves itself, and new Equipment, Response and Setup pages. Setup walks through discovery, the gateway, equipment, devices with several addresses, uncertain cables, write credentials and a dry run; nothing is written to equipment before you press a button of its own.
- Any managed switch over SNMP. Any managed switch with standard SNMP can now be read: ports, neighbours and the forwarding table. Port off and the quarantine VLAN on such switches are Experimental, off by default, need a write test and were tested only on simulators.
- Clients from controllers. UniFi and Meraki can show the clients they see (access point, network name, port) on the map. It only reads; it is on for a new connector, and an earlier UniFi connector reads clients once you tick it. Meraki is Experimental, and some UniFi wireless fields are marked unverified.
- Separate networks. Capture sources can be grouped into separate networks, so the same VLAN number on two networks is not taken for one. A hardware address can be marked as shared by several devices.
More than 40 new detections
Each has its own section in the detection rules documentation with what it needs, how it scores and what makes it a false alarm.
- Industrial networks. New control functions on a path, program uploads, several masters writing to one controller, a changed device identity, scanning, new protocols, remote-access paths and commands outside working hours.
- Office networks. Brute force from outside, DNS threat domains (the list needs a free abuse.ch key, entered in Settings), mining pools, VPN and anonymizer use, remote-access tools, a changed gateway and a rogue DHCPv6 server.
- Steadier under load. Detection runs on its own threads and each detection is measured. Under overload DENIS can pause the heaviest optional detections and tells you.
Know what you cannot see, and less noise
- What DENIS cannot see. A new page shows blind spots and link quality: packets dropped, packets that arrive twice, VLANs that should be mirrored but are silent, traffic seen in one direction only. Duplicate packets from SPAN or TAP copies can be counted or removed.
- Not managed. A view of the devices that none of your management, directory, scanning or endpoint tools reports. Its answers are tested against fixtures, not yet against a real tenant.
- A timeline per device. Addresses, switch port and VLAN, contacts, alerts, incidents, responses and changes of one device, in order.
- This is normal. On any alert you can say it is expected, for a time you choose, and DENIS counts what was accepted and dismissed per detection, so you can see which rules earn their place.
Access and administration
- API tokens with less reach. Scopes, expiry, rotation and an acts-as mode.
- Site administrators. An administrator limited to some sites now manages only those sites and no longer sees Users, Audit or installation settings. On upgrade, an administrator who already has such a limit becomes one; a full administrator always remains. Site-limited accounts can no longer change other sites through imports or new devices.
Equipment and response
- Palo Alto. Extended support, including an opt-in, Experimental setting that lets the firewall remove a timed block by itself (the timeout was tried on a PA-220 only as a safety net; DENIS’s use of it has not yet been run on a firewall).
- Cisco switches. Fewer missed VLAN reads and a stricter quarantine VLAN write test.
Good to know
- PostgreSQL. The 4.3 PostgreSQL code was reviewed and compiled only; 4.4 tests it (see above).
- License. An organisation may evaluate the Community edition free for 30 days from its first installation, on up to 100 devices (license clause 2A).
Planned, not in 4.4
On the roadmap, without dates. None of it is available yet.
- The run of PostgreSQL high availability on a managed service, with a long soak and a many-tenant measurement
- Further checks of MikroTik Wi-Fi (a client joining again while blocked, many access points under one manager), a block through DENIS on a wired TP-Link Omada client, Cisco Catalyst 9800 and Meraki on real equipment
- Alerts, baseline and flows per split hardware address
- 802.1X and RADIUS accounting as a data source
- Further EDR and MDM imports
- Blocking by domain or URL