Real-Time Network Change Monitoring
Know about unauthorized network configuration changes in seconds, not hours. ConnectMyAssets uses syslog-triggered detection to capture, diff, and alert on every configuration change across your entire multi-vendor fleet the moment it happens.
- ✓Syslog-triggered detection: changes detected in under 30 seconds
- ✓Automatic unauthorized change flagging with instant diff
- ✓Multi-channel alerting: email, Slack, webhook, SIEM syslog
- ✓Change attribution: user, source IP, protocol, timestamp
- ✓Drift detection dashboard with real-time compliance scoring
- ✓Change window awareness: no alert noise during planned maintenance
The Change You Did Not See Is the One That Causes the Outage
Scheduled polling runs every hour or every few hours. In that window, someone can log into a router, change an ACL, and leave. Your backup system will not know until the device next syncs. By then, traffic may have been misrouted for 45 minutes, a firewall rule may have been silently removed, or a VPN peer may have been modified without any change ticket. Real-time network change monitoring closes this window. When a config change syslog event is received, the device immediately connects to the ConnectMyAssets appliance and syncs its running configuration. Your team sees the diff in seconds, not the next morning. Security and operations teams both benefit: ops gets faster incident response, security gets near-real-time unauthorized change detection.
From Syslog Event to Alert in Under 30 Seconds
Real-time detection, instant diff, smart alerting. Every change your network makes is accounted for.
Syslog-Triggered Instant Detection
The moment a device emits a configuration change syslog event, ConnectMyAssets signals the device to immediately sync its running configuration to the ConnectMyAssets appliance. The new version is compared to the last known version as soon as it arrives. There is no waiting for a scheduled polling cycle. Detection latency is measured in seconds, not hours. This matters because the window between an unauthorized change and its detection is the window during which your network is running a configuration nobody reviewed or approved.
Unauthorized Change Flagging
Any configuration change that did not originate from a ConnectMyAssets workflow is automatically flagged as unauthorized. The diff is calculated, the device is identified, and an alert is raised immediately. Your security team sees the exact lines that changed, who was logged into the device at the time (if attribution data is available from the syslog), and can compare the change against the approved golden config. Nothing slips through unnoticed.
Multi-Channel Alerting
Alerts reach your team through the channels they actually monitor: email for asynchronous notification, Slack or Teams for real-time channel visibility, webhook for custom integrations, and syslog output for SIEM ingestion. Alert routing is configurable by severity, device group, and team. A critical unauthorized change on a core router can page the on-call engineer immediately, while a low-severity drift on a branch switch creates a ticket in your ITSM for the next business day.
Change Attribution
ConnectMyAssets enriches each detected change with attribution data: which user account made the change, from which source IP address, via which protocol (SSH, console, API), and at what time. When syslog messages carry session or user identity information, this is extracted and linked to the diff. For out-of-band changes that bypass all controls, attribution provides the forensic data your security team needs to understand the scope and origin of a potential incident.
Drift Detection Dashboard
The drift dashboard gives you a real-time view of your entire fleet: which devices are running exactly their approved configuration, which have minor deviations, and which have critical unauthorized changes. Each device shows a compliance score updated continuously as new configurations are captured. You can filter by site, vendor, device role, or severity. The dashboard is the answer to the question your security manager asks every Monday morning: "Is our network still running what we approved?"
Change Window Awareness
Not every change is unauthorized: planned maintenance windows produce expected configuration modifications. ConnectMyAssets is aware of your scheduled change windows. Changes that occur during an approved maintenance window are logged and versioned normally, but they do not trigger unauthorized change alerts. Only changes that happen outside approved windows, or without a corresponding workflow, are flagged and escalated. This eliminates alert fatigue from legitimate maintenance while keeping full visibility on unexpected changes.
How It Works
Device Emits Config Change Syslog
When an engineer, a script, or an attacker modifies the configuration of a managed device, the device emits a syslog message indicating a configuration change event. ConnectMyAssets receives this event in real time via its syslog collector. The event is parsed, the device is identified, and the device is signaled to immediately connect to the ConnectMyAssets appliance and sync its running configuration. No polling interval, no scheduled window: the sync starts the moment the device reports the change.
Instant Backup and Diff
The syslog event triggers the device to sync its running configuration to the ConnectMyAssets appliance. The device connects to ConnectMyAssets, uploads the current running configuration, and the platform stores it as a new version. The diff against the previous version is calculated immediately: every added line in green, every removed line in red. The change is enriched with attribution data extracted from the syslog event and device session logs. The entire process from syslog receipt to diff availability takes under 30 seconds for most devices.
Alert or Acknowledge
ConnectMyAssets checks whether the detected change occurred within an approved maintenance window and whether it matches an expected workflow. If the change is unauthorized, or occurs outside an approved window, an alert is sent immediately through all configured channels with the diff attached. Your team can acknowledge the alert, initiate a rollback, or escalate to a security incident. If the change is expected and authorized, it is logged, versioned, and added to the audit trail without generating noise.
Related Platform Features
Frequently Asked Questions
Common questions about real-time network change monitoring
What is the difference between polling and syslog-based real-time detection?
Polling means the device connects to the ConnectMyAssets appliance on a schedule, every hour or every few hours, syncs its configuration, and the platform compares it to the previous version. If a change happens 5 minutes after a poll, it will not be detected for up to 55 minutes. Syslog-based detection means the device itself notifies ConnectMyAssets the moment a change occurs. The device immediately connects to the ConnectMyAssets appliance, syncs its running configuration, and the diff is available within 30 seconds. For security use cases, the difference between detecting a change in 30 seconds versus 55 minutes is the difference between containing an incident quickly and discovering a breach hours later.
Does it work if the device does not support syslog?
Yes. Syslog-triggered detection is the most reactive mode, but ConnectMyAssets also supports SNMP trap-based triggering for devices that use SNMP for event notification. For devices that support neither syslog nor SNMP traps for config change events, ConnectMyAssets falls back to scheduled polling at a configurable interval. You can mix detection modes in the same fleet: syslog for modern devices that support it, SNMP traps for legacy equipment, and polling as a fallback or safety net for everything else. The platform handles the routing transparently.
How do you avoid false positives from legitimate changes generating alerts?
ConnectMyAssets uses several layers to suppress false positives. First, changes that originate from a ConnectMyAssets workflow are always marked as authorized and do not trigger unauthorized change alerts. Second, changes that occur during a defined maintenance window are logged normally but do not alert. Third, you can configure specific change patterns as expected, for example a known syslog signature from an automated script. Finally, alert thresholds can be tuned by device group so that low-sensitivity devices do not generate noise for minor deviations. The goal is zero false positives for changes your team approved, and immediate alert for everything else.
Can ConnectMyAssets block an unauthorized change?
ConnectMyAssets is a monitoring, versioning, and rollback platform, not a network access control system. It cannot intercept a CLI session and prevent a command from being executed on a device. What it can do is detect the change within seconds of it happening, alert your team immediately, and give them a one-click rollback path to restore the previous configuration. For environments that require preventive controls, ConnectMyAssets is best combined with network access control (NAC) or privileged access management (PAM) solutions that restrict who can connect to devices in the first place. ConnectMyAssets provides the detective and corrective layers.
How do I integrate alerts into our existing SIEM?
ConnectMyAssets can forward alerts to your SIEM via syslog output in RFC 5424 format, which is compatible with all major SIEM platforms including Splunk, Microsoft Sentinel, IBM QRadar, Elastic SIEM, and LogRhythm. Each alert includes the device identifier, change type (authorized or unauthorized), diff summary, attribution data, and timestamp. You can also use the ConnectMyAssets webhook integration to push structured JSON events to your SIEM's HTTP ingestion endpoint. For organizations using Splunk, a dedicated add-on is available that maps ConnectMyAssets events to the Splunk CIM network change data model.
Which vendors and devices support real-time detection?
Real-time syslog-triggered detection is supported for all vendors that emit syslog events for configuration changes, which includes the vast majority of enterprise network equipment: Cisco IOS, IOS-XE, IOS-XR, NX-OS, ASA, Juniper JunOS, Fortinet FortiOS, Palo Alto PAN-OS, Aruba AOS-CX, Check Point, and many others. SNMP trap triggering is available as an alternative for devices that prefer SNMP. For devices that do not support either syslog or SNMP trap-based config change notification, ConnectMyAssets uses scheduled polling with configurable frequency down to every 15 minutes. The detection mode for each device is shown in the inventory, so you always know which devices have real-time coverage and which rely on polling.
Stop Finding Out About Changes Hours Later
ConnectMyAssets detects every configuration change across your fleet within seconds of it happening, flags unauthorized changes immediately, and gives your team the diff, the attribution, and the rollback path, all in one place.