v26.10

Smarter threat intelligence. Faster administration. New insights. Greater visibility. And a major step forward in the Knocknoc admin and user experience.

Truthfully, this is (again) our biggest release yet. But this one hits. You'll see.

Knocknoc 26.10 is a significant leap forward for administrators and users alike. We've streamlined the portals, expanded real-time threat intelligence, simplified network management, and made it easier than ever to understand what's happening across your environment. New insights, native SIEM integrations, faster and smarter Palo and F5 integrations - it's just win.

This release is about much more than a prettier interface. It's about reducing administrative overhead, making better access decisions, identifying problems sooner, and giving security teams more control without adding complexity.

Less time managing access. More time securing what matters, from AI and human attackers.

Highlights

A better Admin experience. A faster, cleaner and more capable portal, with richer insights, smarter filtering and personalised views. More information, fewer clicks, and a genuinely better experience for admins and users.
Smarter access decisions with real-time threat intelligence. New Spur and IPinfo integrations help identify risky connections, including residential proxies, VPNs and Tor exits, after authentication but before network access opens.
Faster, more resilient access orchestration. Slow or unreachable adjacent devices no longer hold up access on healthy devices. Smarter batching reduces device writes and keeps grants moving during busy periods.
Define networks once. Reuse them everywhere. Manage trusted networks centrally, eliminate repetitive configuration and make changes across your environment with greater confidence.
Direct SIEM integrations. Send security and access logs straight to Splunk, Cribl or Microsoft Sentinel, without additional log collectors or storage pipelines.
Streamlined Palo Alto onboarding: Create API keys from the UI.
Know what's healthy, and what isn't. New system and agent health insights make it easier to spot bottlenecks, understand load impact and resolve faster.
Stronger admin security. More control over where administrators can sign in, smarter protection against account lockouts, and the ability to terminate Admin sessions on demand joins the user-session termination feature.

And that's just the start. We've also expanded network-range support across integrations, drastically improved reconciliation performance, strengthened auditing with new visibility and introduced more user self-service.

A big portal uplift

We've given the Knocknoc portals a big lift. And while they certainly look better, the real improvements go well beyond appearances. The new experience is designed to help administrators find answers faster, manage larger environments more easily, and spend less time navigating between screens.

Simpler configuration. Improved workflows reduce repetitive data entry and make everyday changes more intuitive.
Find what matters, instantly. New filtering and built-in views help surface failing access grants, stale credentials, missing MFA and other issues that deserve attention.
Your portal, your way. Save frequently used views, personalise layouts and return to the information that matters most to you.
Go from overview to investigation. Richer filtering, charts and activity information make it easier to understand what happened, when it happened and where to look next.
A smoother user experience. Clearer access information and more consistent interactions help users understand their sessions and what action, if any, is required.

The result? A portal that doesn't just show you more, but helps you do more, with less effort.

Trust Engine: Threat intelligence

Authentication tells you who someone is. It doesn't necessarily tell you whether their connection should be trusted.

With 26.10, the Knocknoc Trust Engine gains new intelligence options through Spur and IPinfo, helping organisations make more informed access decisions in real time.

Even after a user successfully authenticates, Knocknoc can assess the source of their connection before exposing the requested network resources.

Spot suspicious connections. Identify residential proxies, commercial VPNs and Tor exit nodes that may warrant additional scrutiny.
Respond based on risk. Use trust policies to block access, increase logging detail for SIEM alerting, require additional verification or shorten access duration depending on the intelligence available.
Choose your intelligence. Use Spur, IPinfo or both, with your own credentials (BYOK) or supported Knocknoc-provided options.
Bring your own threat data. Extend protection using your own blocked-address feeds, including private intelligence sources that aren't publicly accessible or are hosted inside your network and only Agent-accessible.
Make decisions more transparent. Users receive clearer information when a policy blocks, challenges or limits their access.

Stronger decisions at the moment access matters most, without adding unnecessary friction for legitimate users.

Faster orchestration. Even slow devices

We've made significant improvements to how Knocknoc processes access changes, particularly across larger deployments and busy environments. Access shouldn't slow because one particular firewall in your fleet is unreachable or having a moment.

One slow firewall won't hold up the others. Access changes are processed independently across devices, so healthy firewalls can keep granting access even when another is struggling.
Better performance during login surges. Smarter batching combines large volumes of access changes into fewer device operations, reducing unnecessary load and improving efficiency.
Graceful recovery when devices go offline. Rather than repeatedly hammering an unreachable device, Knocknoc backs off and catches up on pending changes when connectivity returns.
Faster grant confirmation. Improved processing means successful grants can be reflected promptly, even in deployments using remote databases.

For administrators, that means fewer cascading delays and less manual intervention. For users, it means access to healthy devices doesn't have to wait for an unrelated device to recover. More resilience, less device load, and a better experience when demand spikes.

Predefined networks

If you've ever had to update the same office, VPN or partner network across multiple policies and resources, you'll appreciate this one. Predefined networks let you manage commonly used network ranges centrally and reuse them throughout Knocknoc. No more maintaining the same addresses in multiple places. No more wondering which configurations need updating when a network changes.

Reduce repetitive administration. Define a network once and reference it across access configurations and security policies.
Make changes with confidence. See where networks are used before modifying them, reducing the risk of unexpected consequences.
Keep control of existing access. When removing network ranges, decide whether active access should end immediately or expire naturally.
Give users more flexibility. Where configured, users can select which network sources they need rather than opening access to every available source.
Fewer configuration mistakes. Improved validation helps catch unsupported network configurations before they become operational problems.

It's a simple concept with a big impact, especially for organisations managing many networks, users and access policies.

System and agent health

Understanding why something isn't working shouldn't require digging through multiple systems and logs. 26.10 introduces more comprehensive system and orchestration agent health reporting, giving administrators a clearer picture of their Knocknoc environment.

See your deployment's health in one place. Identify certificate, licensing, threat-intelligence, agent compatibility and server consistency issues.
Know when orchestration is falling behind. Understand pending changes, queued operations and device processing delays.
Spot trends before they become bigger problems. Historical performance information helps distinguish temporary spikes from persistent issues.
Get to the root cause faster. Clearer failure information and links to relevant troubleshooting guidance reduce investigation time.

Whether you're managing a handful of devices or a large distributed environment, the goal is the same: less time diagnosing problems and more confidence that access is working as expected.

Your events. Your SIEM.

Knocknoc already supports Graylog-compatible exports, and collectors on the server cover syslog and journald. With 26.10, send Knocknoc security and access events directly to Splunk, Splunk Cloud, Cribl and Microsoft Sentinel. For many deployments, that means eliminating additional collectors, storage buckets and custom log-forwarding pipelines.

Get events straight into your security workflows. Native integrations deliver Knocknoc activity into Splunk, Cribl and Sentinel for investigation, correlation and response.
Less infrastructure to manage. Direct delivery reduces the need for separate log transport components.
Keep existing SIEM workflows consistent. Splunk and Cribl share compatible event metadata, while Sentinel receives structured fields ready for KQL queries alongside full event details.
Send to multiple destinations simultaneously. Run supported destinations side by side, with queued and batched delivery designed to avoid slowing down access operations when a collector is unavailable.
Know your logs are flowing. A new SIEM integration view shows whether each destination is sending, waiting or failing, along with delivery history and failure details.
Keep credentials protected. Sensitive tokens remain hidden after configuration, with additional safeguards when destinations change.

Everything can be managed through the portal or the command line.

Better auditing, too

Configuration changes now capture richer before-and-after information, helping administrators and security teams see what changed, who changed it and when, without exposing sensitive values.

You can also follow session activity into the audit log and export richer identity and session information.

Better evidence, easier investigations, and less time piecing together what happened.

Palo Alto and Panorama: Easier setup.

We've continued improving our Palo Alto and Panorama integrations, with a focus on making deployment and ongoing management more predictable.

Simplify onboarding. Generate device API keys directly within the Knocknoc setup workflow.
Expanded validation. Identify configuration and permission issues during onboarding.
Avoid configuration conflicts. Detect competing configurations that could interfere with access orchestration.

Less trial and error, clearer guidance, and greater confidence when deploying or expanding integrations.

Smarter device updates

We've also expanded what Knocknoc can manage across supported network and security platforms. Network-range grants are now supported across more integrations, giving administrators greater flexibility when granting access to networks rather than individual addresses. This includes improvements across MikroTik, SonicWall, Sophos, Cisco Firepower, Azure, Cloudflare, Fortinet, nftables and ipset.

Additional improvements include:

F5 and Cloudflare: Smarter batching reduces repetitive device updates during bursts of access activity.
pfSense: New aliases use network-compatible types, while existing configurations continue working.
Better compatibility checks: Integrations identify unsupported network ranges or source formats before attempting changes.

The benefit is greater consistency across platforms, fewer unnecessary writes and less integration-specific configuration work.

Tighter admin access

Administrative access deserves additional protection, but security controls shouldn't create new operational headaches. 26.10 introduces several improvements to help protect administrative access while keeping legitimate administrators productive.

Protect against accidental lockouts. Built-in safeguards help prevent administrators from excluding their own address, with a command-line recovery option if needed.
Separate your admin portal. Give administrative access its own hostname, making it easier to apply dedicated firewall, WAF or network security policies.
Control where admins can sign in. Restrict admin logins to trusted networks, whether using passwords or SAML.
Better protection against malicious login attempts. Reduce the risk of someone elsewhere deliberately locking out your account with smarter per-user and per-browser/source rate-limiting.
Terminate sessions on demand. Sign an administrator or user out of all active sessions in one action.

Tighter controls for sensitive access, without making administration unnecessarily difficult.

Scale and performance, under the hood

There's also been substantial work behind the scenes.

Let's just say that under high load, using our internal performance testing capability, Knocknoc now efficiently handles many thousands of simultaneous logins whilst orchestrating multiple back-end control layers from multiple vendors of multiple types, without missing a beat. Anything slow is queued, anything fast is batched and ramps up, from login to revocation, reconciliation to Admins making major changes to a hot environment - Knocknoc just performs.

Not everything in a release needs a shiny new screen. These changes help keep Knocknoc dependable as deployments and workloads grow. We love this stuff.

How do I upgrade?

Upgrade your Knocknoc Server and orchestration Agents using your usual package manager or installer.

Some new capabilities require updated Agents, including network-range sources, agent health reporting, private threat-intelligence feeds and expanded Palo Alto validation.

See the updates and upgrades guide.

And as always, you're in control. Knocknoc doesn't force Server or Agent updates. You choose when to upgrade.

We're excited to get this one into your hands.

Prevent attacks, human and AI, with Knocknoc.

Release date: 28th October 2026