diff --git a/.gemini/skills/initiative-start/reasearch-skill.md b/.gemini/skills/initiative-start/reasearch-skill.md
index c6195d6b5..b9eac514d 100644
--- a/.gemini/skills/initiative-start/reasearch-skill.md
+++ b/.gemini/skills/initiative-start/reasearch-skill.md
@@ -21,8 +21,9 @@ Ensure all work begins with **documentation-first understanding**, **PRD validat
   1. `/CONTRIBUTING.md`
   2. `/README.md`
   3. `/.github/skills/code-standards/SKILL.md`
-  4. `/docs/**`
-  5. Related module/code context if referenced
+  4. `/.github/skills/database-patterns/SKILL.md` — read when the feature touches the `Devices` table or requires audit/history logging
+  5. `/docs/**`
+  6. Related module/code context if referenced
 
 * Extract:
 
@@ -69,6 +70,13 @@ If anything is unclear:
   * Breaking assumptions
   * Plugin or API mismatches
 
+* **If the feature writes to the `Devices` table:**
+
+  * Load `/.github/skills/database-patterns/SKILL.md`
+  * Audit all write paths listed there — confirm which are affected
+  * Determine if a SQLite trigger or Python hook is the right approach
+  * Check if `*Source` fields already solve attribution requirements
+
 * Clearly report inconsistencies before proceeding
 
 ---
diff --git a/.gemini/skills/plugin-development/plugin-skill.md b/.gemini/skills/plugin-development/plugin-skill.md
index 215d9bf22..619495f28 100644
--- a/.gemini/skills/plugin-development/plugin-skill.md
+++ b/.gemini/skills/plugin-development/plugin-skill.md
@@ -1,16 +1,86 @@
-# Plugin development skill
+---
+name: netalertx-plugin-development
+description: Create and run NetAlertX plugins. Use this when asked to create plugin, run plugin, test plugin, or develop plugin functionality.
+---
 
-1. Assess requirements
-2. Read `docs/PLUGINS_DEV.md`
-3. Confirm field mapping
-4. Ask clarifying questions
-5. code placed in `front/plugins/<new plugin name>`
+# Plugin Development
 
+## Expected Workflow
 
-Plugin prefix:
+1. Read this skill and `docs/PLUGINS_DEV.md` for full context.
+2. Find or create the plugin in `front/plugins/<code_name>/`.
+3. Read the plugin's `config.json` and `script.py` to understand its functionality.
+4. Run: `python3 front/plugins/<code_name>/script.py`
+5. Retrieve the result from `/tmp/log/plugins/last_result.<PREF>.log` quickly — the backend deletes it after processing.
 
-- has to be uppercase letters only (no underscores)
-- must be unique
-- keep short but readable if possible
+## Run a Plugin Manually
+
+```bash
+python3 front/plugins/<code_name>/script.py
+```
+
+Ensure `sys.path` includes `/app/front/plugins` and `/app/server` (as in the template).
+
+## Plugin Structure
+
+```text
+front/plugins/<code_name>/
+├── config.json      # Manifest with settings
+├── script.py        # Main script
+└── ...
+```
+
+## Plugin Prefix Rules
+
+- Uppercase letters only (no underscores, no numbers)
+- Must be unique across all plugins
+- Short but readable (e.g., `ARPSCAN`, `MQTT`, `UNIFI`)
+
+## Settings Pattern
+
+- `<PREF>_RUN`: execution phase
+- `<PREF>_RUN_SCHD`: cron-like schedule
+- `<PREF>_CMD`: script path
+- `<PREF>_RUN_TIMEOUT`: timeout in seconds
+- `<PREF>_WATCH`: columns to watch for changes
+
+## Data Contract
+
+Scripts write to `/tmp/log/plugins/last_result.<PREF>.log` using `plugin_helper.py`:
+
+```python
+from plugin_helper import Plugin_Objects
+
+plugin_objects = Plugin_Objects()
+plugin_objects.add_object(...)  # During processing
+plugin_objects.write_result_file()  # Exactly once at end
+```
+
+**Important:** The backend processes and deletes the result file almost immediately. Retrieve it quickly if inspecting output.
+
+## Execution Phases
+
+| Phase | Trigger |
+|-------|---------|
+| `once` | Once at startup |
+| `schedule` | On cron schedule |
+| `always_after_scan` | After every scan |
+| `before_name_updates` | Before name resolution |
+| `on_new_device` | When new device detected |
+| `on_notification` | When notification triggered |
+
+## Plugin Formats
+
+| Format | Purpose | Phase |
+|--------|---------|-------|
+| publisher | Send notifications | `on_notification` |
+| dev scanner | Create/manage devices | `schedule` |
+| name discovery | Discover device names | `before_name_updates` |
+| importer | Import from services | `schedule` |
+| system | Core functionality | `schedule` |
+
+## Starting Point
+
+Copy from `front/plugins/__template` and customize. Read `docs/PLUGINS_DEV.md` for the full development guide.
 
 
diff --git a/.gemini/skills/project-navigation/SKILL.md b/.gemini/skills/project-navigation/SKILL.md
index 24ef258a7..a3c273105 100644
--- a/.gemini/skills/project-navigation/SKILL.md
+++ b/.gemini/skills/project-navigation/SKILL.md
@@ -3,13 +3,56 @@ name: project-navigation
 description: Reference for the NetAlertX codebase structure, key file paths, and configuration locations. Use this when exploring the codebase or looking for specific components like the backend entry point, frontend files, or database location.
 ---
 
-# Project Navigation & Structure
+# Project Navigation
 
-## Codebase Structure & Key Paths
+## Key Paths
 
-- **Source Code:** `/workspaces/NetAlertX` (mapped to `/app` in container via symlink).
-- **Backend Entry:** `server/api_server/api_server_start.py` (Flask) and `server/__main__.py`.
-- **Frontend:** `front/` (PHP/JS).
-- **Plugins:** `front/plugins/`.
-- **Config:** `/data/config/app.conf` (runtime) or `back/app.conf` (default).
-- **Database:** `/data/db/app.db` (SQLite).
+| Component | Path |
+|-----------|------|
+| Workspace root | `/workspaces/NetAlertX` |
+| Backend entry | `server/__main__.py` |
+| API server | `server/api_server/api_server_start.py` |
+| Plugin system | `server/plugin.py` |
+| Initialization | `server/initialise.py` |
+| Frontend | `front/` |
+| Frontend JS | `front/js/common.js` |
+| Frontend PHP | `front/php/server/*.php` |
+| Plugins | `front/plugins/` |
+| Plugin template | `front/plugins/__template` |
+| Database helpers | `server/db/db_helper.py` |
+| Device model | `server/models/device_instance.py` |
+| Messaging | `server/messaging/` |
+| Workflows | `server/workflows/` |
+
+## Architecture
+
+NetAlertX uses a frontend–backend architecture: the frontend runs on **PHP + Nginx** (see `front/`), the backend is implemented in **Python** (see `server/`), and scheduled tasks are managed by a **supercronic** scheduler.
+
+## Runtime Paths
+
+| Data | Path |
+|------|------|
+| Config (runtime) | `/data/config/app.conf` |
+| Config (default) | `back/app.conf` |
+| Database | `/data/db/app.db` |
+| API JSON cache | `/tmp/api/*.json` |
+| Logs | `/tmp/log/` |
+| Plugin logs | `/tmp/log/plugins/` |
+
+## Environment Variables
+
+Use these instead of hardcoding paths:
+- `NETALERTX_DB`
+- `NETALERTX_LOG`
+- `NETALERTX_CONFIG`
+- `NETALERTX_DATA`
+- `NETALERTX_APP`
+
+## Documentation
+
+| Topic | Path |
+|-------|------|
+| Plugin development | `docs/PLUGINS_DEV.md` |
+| System settings | `docs/SETTINGS_SYSTEM.md` |
+| API docs | `docs/API_*.md` |
+| Debug guides | `docs/DEBUG_*.md` |
diff --git a/.gemini/skills/settings/SKILL.md b/.gemini/skills/settings/SKILL.md
new file mode 100644
index 000000000..0c21ce339
--- /dev/null
+++ b/.gemini/skills/settings/SKILL.md
@@ -0,0 +1,412 @@
+---
+name: nax-settings-development
+description: Best practices for creating and maintaining NetAlertX settings (config.json), including UI, validation, localization, runtime behavior, and implementation consistency.
+---
+
+# NetAlertX Settings Development
+
+This skill defines the conventions and best practices for adding or modifying settings in NetAlertX.
+
+The goal is for every setting to be:
+
+- Declarative
+- Self-documenting
+- Automatically rendered by the Settings UI
+- Fully localized
+- Backwards compatible
+- Easy to maintain
+
+---
+
+## Quick Reference
+
+**Read a setting (backend):**
+```python
+from helper import get_setting_value
+value = get_setting_value('SETTING_NAME')
+```
+Never read `app.conf` directly. Always use `get_setting_value()`.
+
+**Read a setting (frontend):**
+```javascript
+getSetting("SETTING_NAME")
+```
+
+**Add a core setting** — use `ccd()` in `server/initialise.py`:
+```python
+ccd('SETTING_NAME', 'default_value', 'description')
+```
+
+**Add a plugin setting** — define in the plugin's `config.json` under the `settings` key.
+
+| File | Purpose |
+|------|---------|
+| `/data/config/app.conf` | Runtime config (source of truth) |
+| `back/app.conf` | Default config (template) |
+
+Use `APP_CONF_OVERRIDE` for settings that must be set before startup.
+
+---
+
+# 1. Follow existing patterns
+
+Before creating a new setting:
+
+- Search for similar settings.
+- Reuse existing naming conventions.
+- Reuse existing setting types.
+- Reuse existing validation patterns.
+- Follow the style already used by similar plugins.
+
+Avoid introducing new setting types unless absolutely necessary.
+
+---
+
+# 2. Setting naming
+
+Setting keys use uppercase snake case.
+
+Good:
+
+```text
+UI_DEV_SECTIONS
+SCAN_INTERVAL
+MQTT_HOST
+```
+
+Avoid:
+
+```text
+uiDevSections
+scanInterval
+ScanInterval
+```
+
+Names should clearly describe the purpose.
+
+---
+
+# 3. Categories
+
+Place settings into the most appropriate category.
+
+Keep related settings together.
+
+Avoid creating new categories unless there is a clear need.
+
+---
+
+# 4. Choose the correct type
+
+Use the simplest type that correctly models the value.
+
+Common types include:
+
+- string
+- integer
+- float
+- boolean
+- password
+- select
+- array
+- textarea
+
+Avoid encoding structured JSON inside string settings.
+
+---
+
+# 5. Validation
+
+Always define validation whenever appropriate.
+
+Examples include:
+
+- minimum values
+- maximum values
+- regex validation
+- allowed options
+
+Reject invalid configuration rather than silently accepting it.
+
+---
+
+# 6. Defaults
+
+Provide sensible defaults that work for a fresh installation.
+
+Avoid defaults that require external services or additional configuration.
+
+A default value should exist in exactly one place.
+
+Use the `default_value` defined in `config.json`.
+
+Do not duplicate the same default value elsewhere in Python or JavaScript.
+
+---
+
+# 7. Names and descriptions
+
+Setting names should be concise.
+
+Examples:
+
+- Scan interval
+- MQTT Host
+- Hide device sections
+
+Descriptions should explain:
+
+- what the setting does
+- when it should be used
+- important side effects
+
+Avoid implementation details.
+
+Good:
+
+> Interval between network scans in seconds.
+
+Bad:
+
+> Calls scheduler.py every X seconds.
+
+---
+
+# 8. Boolean settings
+
+Boolean settings should read naturally.
+
+Prefer verbs such as:
+
+- Enable
+- Disable
+- Require
+- Allow
+- Ignore
+- Show
+- Hide
+
+Examples:
+
+- Enable MQTT
+- Require NICs Online
+- Hide Offline Devices
+
+---
+
+# 9. Select settings
+
+When users must choose from predefined values, use a select setting.
+
+Never require users to remember internal values.
+
+Each option should have a meaningful label.
+
+---
+
+# 10. Array settings
+
+Use arrays only when multiple independent values are expected.
+
+Examples:
+
+- ignored MAC addresses
+- subnet lists
+- plugin lists
+
+---
+
+# 11. Localization
+
+Every setting must have localized language strings.
+
+If the language strings are **not** defined directly inside `config.json`, they must exist in `en_us.json`.
+
+For example, for:
+
+```text
+UI_DEV_SECTIONS
+```
+
+add:
+
+```json
+"UI_DEV_SECTIONS_name": "Hide device sections",
+"UI_DEV_SECTIONS_description": "Select which UI elements to hide on the Devices page."
+```
+
+When using external language files, `config.json` must reference:
+
+```json
+"name": [
+  {
+    "string": "_GLOBAL_LANG_FILES_"
+  }
+]
+```
+
+This tells NetAlertX to resolve the display name from the language files.
+
+---
+
+# 12. Source of truth
+
+`app.conf` is the source of truth.
+
+Keep the following in mind:
+
+- User-defined values always come from `app.conf`.
+- Default values from `config.json` are only used when the setting is missing from `app.conf`.
+- Never assume settings are permanently stored in the database.
+
+---
+
+# 13. Plugin-first settings
+
+Whenever possible, define new settings inside a plugin's `config.json`.
+
+Avoid adding hardcoded application settings unless there is a compelling architectural reason.
+
+Plugin settings are the preferred and future-proof approach.
+
+---
+
+# 14. Runtime lifecycle
+
+Understand how settings flow through the application.
+
+```text
+config.json
+        │
+        │ default values
+        ▼
+app.conf (source of truth)
+        │
+        ▼
+Settings database table
+        │
+        ▼
+table_settings.json API
+        │
+        ▼
+Frontend (getSetting())
+```
+
+The database and API are runtime representations only.
+
+They are regenerated from `app.conf` during initialization.
+
+---
+
+# 15. Access
+
+Code should never read `app.conf` directly.
+
+In the Frontend, always retrieve settings through:
+
+```javascript
+getSetting("SETTING_NAME")
+```
+
+And in the backend, always retrieve settings through:
+
+```python
+get_setting_value("SETTING_NAME")
+```
+
+This guarantees the value comes from the generated settings API.
+
+---
+
+# 16. Metadata
+
+Each setting automatically has a corresponding `__metadata` entry generated in `app.conf`.
+
+Do not manually create or modify metadata entries unless working on the settings framework itself.
+
+---
+
+# 17. Backend
+
+Backend code should:
+
+- use the existing configuration helpers
+- avoid duplicated parsing logic
+- gracefully handle missing values
+- avoid hardcoded defaults
+
+---
+
+# 18. Frontend
+
+A correctly defined setting should render automatically in the existing Settings UI.
+
+Avoid writing custom JavaScript unless absolutely necessary.
+
+---
+
+# 19. Prefer configuration over code
+
+If a behaviour can reasonably be controlled through an existing setting type (boolean, select, integer, array, etc.), introduce a setting instead of hardcoding special-case logic.
+
+Configuration is preferred over implementation-specific behaviour whenever practical.
+
+---
+
+# 20. Backwards compatibility
+
+Avoid:
+
+- renaming settings
+- changing data types
+- changing semantics
+
+If unavoidable:
+
+- provide migration logic
+- preserve compatibility where possible
+
+---
+
+# 21. Documentation
+
+Every user-facing setting should eventually be documented.
+
+Include:
+
+- purpose
+- accepted values
+- default value
+- examples when useful
+
+---
+
+# 22. Pull request checklist
+
+Before submitting a PR, verify:
+
+- [ ] Setting follows existing conventions.
+- [ ] Correct category used.
+- [ ] Appropriate type selected.
+- [ ] Validation defined.
+- [ ] Sensible default provided.
+- [ ] Default defined only once.
+- [ ] Name is concise.
+- [ ] Description is clear.
+- [ ] Localization strings added.
+- [ ] `_GLOBAL_LANG_FILES_` used where appropriate.
+- [ ] Plugin-first approach followed where applicable.
+- [ ] Frontend renders automatically.
+- [ ] Backend uses existing configuration helpers.
+- [ ] No unnecessary frontend code added.
+- [ ] No duplicated parsing logic.
+- [ ] Backwards compatibility maintained.
+- [ ] Documentation updated if required.
+
+---
+
+# References
+
+- https://docs.netalertx.com/PLUGINS_DEV_SETTINGS/
+- https://docs.netalertx.com/SETTINGS_SYSTEM/
+- https://docs.netalertx.com/PLUGINS/
\ No newline at end of file
diff --git a/.gemini/skills/skills-index/SKILL.md b/.gemini/skills/skills-index/SKILL.md
new file mode 100644
index 000000000..d5272a5d9
--- /dev/null
+++ b/.gemini/skills/skills-index/SKILL.md
@@ -0,0 +1,64 @@
+---
+name: skills-index
+description: Index of all available skills across both Gemini CLI (.gemini/skills/) and GitHub Copilot (.github/skills/). Load this to find the right skill for a task, or to locate the counterpart skill in the other AI system.
+---
+
+# Skills Index — Cross-Reference
+
+Two AI assistants are configured for this project, each with their own skill directory:
+
+- **Gemini CLI** → `.gemini/skills/`
+- **GitHub Copilot** → `.github/skills/`
+
+Skills with the same purpose exist in both, sometimes under different names and with different depth. This index maps them so you can find the richer version when needed.
+
+---
+
+## Shared Skills (exist in both)
+
+| Topic | Gemini Skill | Copilot Skill | Notes |
+|-------|-------------|--------------|-------|
+| Testing | `testing-workflow` | `testing-workflow` | Gemini version emphasises full suite preference and container detection; Copilot version covers `testFailure` tool and PYTHONPATH |
+| Settings & config | `settings` | `settings-management` | Gemini version is more comprehensive (22-point guide + PR checklist); Copilot version covers `ccd()` and `get_setting_value()` usage |
+| MCP activation | `mcp-activation` | `mcp-activation` | Gemini version covers Gemini CLI session restart; Copilot version covers VS Code window reload |
+| Project navigation | `project-navigation` | `project-navigation` | Copilot version has full path tables and env vars; Gemini version is a brief reference |
+| Plugin dev | `plugin-development` | `plugin-run-development` | Copilot version is comprehensive (data contract, phases, formats); Gemini version is a brief checklist pointing to `docs/PLUGINS_DEV.md` |
+| Devcontainer | `devcontainer-management` | `devcontainer-services` + `devcontainer-setup` + `devcontainer-configs` | Gemini combines into one (uses `docker exec`); Copilot splits into 3 focused skills |
+
+---
+
+## Copilot-Only Skills
+
+No Gemini equivalent yet:
+
+| Copilot Skill | Purpose |
+|--------------|---------|
+| `api-development` | Creating REST API endpoints |
+| `authentication` | API tokens and 401/403 debugging |
+| `code-standards` | Coding conventions and style rules |
+| `database-patterns` | Device table write paths, SQLite triggers, audit logging, `*Source` attribution |
+| `database-reset` | Wipe and regenerate the database and config |
+| `docker-build` | Build Docker images for testing or production |
+| `docker-prune` | Clean unused Docker resources (destructive — requires confirmation) |
+| `sample-data` | Load synthetic device data into the devcontainer |
+
+---
+
+## Gemini-Only Skills
+
+No Copilot equivalent yet:
+
+| Gemini Skill | Purpose |
+|-------------|---------|
+| `initiative-start` | Research methodology and structured approach for new tasks |
+
+---
+
+## Adding a New Skill
+
+When adding a skill, create it in **both** directories to keep both AI systems current:
+
+- `.gemini/skills/<name>/SKILL.md` — auto-discovered by Gemini CLI via YAML frontmatter
+- `.github/skills/<name>/SKILL.md` — add an entry to the skills table in `.github/copilot-instructions.md`
+
+Keep the body content identical between both files. Only the frontmatter `name`/`description` may differ slightly to match each system's discovery heuristics.
diff --git a/.gemini/skills/testing-workflow/SKILL.md b/.gemini/skills/testing-workflow/SKILL.md
index debf79839..0b7ac7f78 100644
--- a/.gemini/skills/testing-workflow/SKILL.md
+++ b/.gemini/skills/testing-workflow/SKILL.md
@@ -75,4 +75,34 @@ The retrieved token MUST be used in all subsequent API or test calls requiring a
 If tests fail with 403 Forbidden or empty tokens:
 1. Verify server is running and use the setup script (`/workspaces/NetAlertX/.devcontainer/scripts/setup.sh`) if required.
 2. Verify `app.conf` inside the container: `cat /data/config/app.conf`
+
+## Check for Pre-Existing Failures
+
+Before attributing failures to your changes, check what was already broken:
+
+```bash
+cd /workspaces/NetAlertX; pytest test/ --tb=no -q 2>&1 | tail -20
+```
+
+Do not fix pre-existing failures unless that is the explicit goal.
+
+## PYTHONPATH
+
+The test environment is pre-configured with:
+- `/app` — primary location where Python runs in production
+- `/app/server` — symlink to `/workspaces/NetAlertX/server`
+- `/app/front/plugins` — symlink to `/workspaces/NetAlertX/front/plugins`
+- `/workspaces/NetAlertX/test`
+- `/workspaces/NetAlertX/server`
+- `/workspaces/NetAlertX`
+
+## Docker Test Image
+
+If the Dockerfile or dependencies changed, rebuild the test image before running:
+
+```bash
+docker buildx build -t netalertx-test .
+```
+
+Takes ~30 seconds; ~90 seconds if the venv stage changed.
 3. Verify Python can read it: `python3 -c "from helper import get_setting_value; print(get_setting_value('API_TOKEN'))"`
\ No newline at end of file
diff --git a/.github/copilot-instructions.md b/.github/copilot-instructions.md
index 187da1a82..0dd53bc02 100644
--- a/.github/copilot-instructions.md
+++ b/.github/copilot-instructions.md
@@ -27,6 +27,7 @@ Procedural knowledge lives in `.github/skills/`. Load the appropriate skill when
 
 | Task | Skill |
 |------|-------|
+| Find or cross-reference any skill | `skills-overview` |
 | Run tests, check failures | `testing-workflow` |
 | Start/stop/restart services | `devcontainer-services` |
 | Wipe database, fresh start | `database-reset` |
@@ -42,6 +43,7 @@ Procedural knowledge lives in `.github/skills/`. Load the appropriate skill when
 | Settings and config | `settings-management` |
 | Find files and paths | `project-navigation` |
 | Coding standards | `code-standards` |
+| Devices table write paths, SQLite triggers, audit logging, `*Source` attribution | `database-patterns` |
 
 ## Execution Protocol
 
diff --git a/.github/skills/database-patterns/SKILL.md b/.github/skills/database-patterns/SKILL.md
new file mode 100644
index 000000000..f6125158b
--- /dev/null
+++ b/.github/skills/database-patterns/SKILL.md
@@ -0,0 +1,142 @@
+---
+name: netalertx-database-patterns
+description: NetAlertX database architecture patterns. Use this when designing features that write to the Devices table, implementing audit/history logging, or choosing between trigger-based vs Python-hook approaches.
+---
+
+# Database Patterns
+
+## Devices Table — Write-Path Inventory
+
+Before implementing any feature that reads or writes the `Devices` table, audit ALL write paths. The table is modified from many locations — missing one path is a correctness bug.
+
+**Known production write paths (as of 2026-07-04):**
+
+| File | Function | Fields written |
+|---|---|---|
+| `server/models/device_instance.py` | `setDeviceData()` | All user-editable fields |
+| `server/models/device_instance.py` | `updateField()` | Any single field (workflows) |
+| `server/models/device_instance.py` | `updateDeviceColumn()` | Any single column |
+| `server/models/device_instance.py` | `deleteDevices()` etc. | DELETE operations |
+| `server/scan/device_handling.py` | `update_devices_data_from_scan()` | Scan-derived fields |
+| `server/scan/device_handling.py` | `update_vendors_from_mac()` | `devVendor`, `devVendorSource` |
+| `server/scan/device_handling.py` | Name resolution block | `devName`, `devFQDN`, `*Source` |
+| `server/scan/device_handling.py` | `update_ipv4_ipv6()` | `devPrimaryIPv4`, `devPrimaryIPv6` |
+| `server/scan/device_handling.py` | `update_icons_and_types()` | `devIcon`, `devType` |
+| `server/scan/device_handling.py` | `update_presence_from_CurrentScan()` | `devPresentLastScan` |
+| `server/scan/device_handling.py` | `update_devLastConnection_from_CurrentScan()` | `devLastConnection` |
+| `server/scan/device_handling.py` | `update_devPresentLastScan_based_on_*()` | `devPresentLastScan` |
+| `server/db/authoritative_handler.py` | `enforce_source_on_user_update()` | `*Source` columns |
+| `server/db/authoritative_handler.py` | `lock_field()` / `unlock_field()` | `*Source` columns |
+| `server/models/notification_instance.py` | `clearPendingEmailFlag()` | `devLastNotification` |
+| `front/plugins/db_cleanup/script.py` | `cleanup_database()` | DELETE operations |
+
+**Key insight:** Most scan functions use `sql.executemany()` — there is no per-row Python state available. Python hooks before/after executemany require a pre-fetch+diff pattern that is expensive and error-prone.
+
+---
+
+## `*Source` Fields — Attribution System
+
+The `FIELD_SOURCE_MAP` in `server/db/authoritative_handler.py` defines 10 fields that carry write attribution via paired `*Source` columns:
+
+```python
+FIELD_SOURCE_MAP = {
+    "devMac":           "devMacSource",
+    "devName":          "devNameSource",
+    "devFQDN":          "devFQDNSource",
+    "devLastIP":        "devLastIPSource",
+    "devVendor":        "devVendorSource",
+    "devSSID":          "devSSIDSource",
+    "devParentMAC":     "devParentMACSource",
+    "devParentPort":    "devParentPortSource",
+    "devParentRelType": "devParentRelTypeSource",
+    "devVlan":          "devVlanSource",
+}
+```
+
+`*Source` values: `'USER'`, `'LOCKED'`, `'NEWDEV'`, or a plugin prefix (e.g., `'ARPSCAN'`, `'NSLOOKUP'`).
+
+These fields are updated **in the same transaction** as the primary field. A SQLite `AFTER UPDATE` trigger can read `NEW.devNameSource` to obtain correct attribution without any extra context-passing.
+
+**Attribution rules for features that need `changedBy`:**
+
+| Field category | Attribution |
+|---|---|
+| In `FIELD_SOURCE_MAP` | `COALESCE(NULLIF(NEW.<field>Source, ''), 'system')` |
+| User-only fields (`devGroup`, `devComments`, `devFavorite`, `devOwner`, `devLocation`, etc.) | `'user:api'` — only `setDeviceData()` writes these |
+| Auto-computed fields (`devIcon`, `devType`, `devPrimaryIPv4`, `devPrimaryIPv6`) | `'system'` |
+| `*Source` fields themselves | `'system'` |
+
+---
+
+## Cross-Cutting Concerns — Prefer SQLite Triggers Over Python Hooks
+
+When a feature needs to intercept **every write** to the `Devices` table (audit logging, computed columns, cascading logic), prefer a **SQLite `AFTER UPDATE` / `AFTER INSERT` trigger** over Python-layer hooks.
+
+**Why:**
+- Triggers catch all 14+ write paths automatically, including `executemany()` bulk updates
+- Zero modifications to existing write-path functions (DRY)
+- Self-healing: future write paths are automatically covered
+- Attribution is available via `NEW.*Source` fields (see above)
+
+**When Python hooks are still appropriate:**
+- The logic needs access to Python objects, settings, or services not available in SQL
+- The feature only fires from one or two known write paths
+- The logic is too complex to express in SQL (multi-table joins with app-layer business logic)
+
+### Trigger Performance Pattern
+
+```sql
+CREATE TRIGGER trg_example
+AFTER UPDATE ON Devices
+FOR EACH ROW
+-- Guard: short-circuit entire body when feature is disabled (zero cost)
+WHEN (SELECT CAST(setValue AS INTEGER) FROM Settings WHERE setKey = 'FEATURE_ENABLED') > 0
+BEGIN
+  -- Per-field conditional insert
+  INSERT INTO SomeTable (devGUID, column, oldVal, newVal, changedBy, ts)
+  SELECT NEW.devGUID, 'devName', OLD.devName, NEW.devName,
+         COALESCE(NULLIF(NEW.devNameSource, ''), 'system'),
+         datetime('now', 'utc')
+  WHERE OLD.devName IS NOT NEW.devName
+    AND instr(',' || (SELECT setValue FROM Settings WHERE setKey = 'TRACKED_FIELDS') || ',', ',devName,') > 0;
+  -- Repeat for each tracked field...
+END;
+```
+
+**Performance:** The Settings table is tiny (~100 rows) and stays in SQLite's page cache. Per-row Settings reads inside triggers are effectively in-memory lookups. The `WHEN` guard makes the disabled state zero-cost.
+
+---
+
+## Snapshot vs Event-Sourced Audit Logging
+
+When implementing change history, always use **event-sourced (per-field rows)** not **snapshots (full row copies)**.
+
+| | Event-sourced | Snapshot |
+|---|---|---|
+| Storage | Small — only changed fields | Large — all 40+ columns every mutation |
+| Filter by field | O(log n) via index | O(n) — must diff every adjacent pair |
+| Filter by source | O(log n) via index | Not possible without diffing |
+| `changedBy` attribution | Embedded at write time | Not available without extra context |
+| Retention calculation | Simple timestamp DELETE | Same, but much higher storage |
+
+At 1000 devices, 5-min scan interval, 14-day retention: snapshot storage ≈ 280 MB/day. Event-sourced storage for the same workload is typically <1 MB/day (most scans produce no tracked field changes).
+
+---
+
+## `DevicesHistory` Table — Reference Schema
+
+```sql
+CREATE TABLE IF NOT EXISTS DevicesHistory (
+    id           INTEGER PRIMARY KEY AUTOINCREMENT,
+    devGUID      TEXT NOT NULL,
+    timestamp    DATETIME DEFAULT CURRENT_TIMESTAMP,
+    changedBy    TEXT NOT NULL,
+    changedColumn TEXT NOT NULL,
+    oldValue     TEXT,
+    newValue     TEXT,
+    FOREIGN KEY (devGUID) REFERENCES Devices(devGUID) ON DELETE CASCADE
+);
+
+CREATE INDEX IF NOT EXISTS idx_devhist_guid_column ON DevicesHistory(devGUID, changedColumn);
+CREATE INDEX IF NOT EXISTS idx_devhist_timestamp   ON DevicesHistory(timestamp);
+```
diff --git a/.github/skills/mcp-activation/SKILL.md b/.github/skills/mcp-activation/SKILL.md
index abbdb317f..106190abe 100644
--- a/.github/skills/mcp-activation/SKILL.md
+++ b/.github/skills/mcp-activation/SKILL.md
@@ -7,9 +7,14 @@ description: Enables live interaction with the NetAlertX runtime. This skill con
 
 This skill configures the environment to expose the Model Context Protocol (MCP) server to AI agents running inside the devcontainer.
 
+## Prerequisites
+
+1. **Devcontainer connected:** You must be working inside the NetAlertX devcontainer.
+2. **Backend running:** The Python backend must be running — it generates `app.conf` containing the API token. Use the `devcontainer-services` skill if it's not running.
+
 ## Usage
 
-This skill assumes you are already running within the NetAlertX devcontainer. 
+This skill assumes you are already running within the NetAlertX devcontainer.
 
 1.  **Generate Configurations:**
     Run the configuration generation script to extract the API Token and update the VS Code MCP settings.
diff --git a/.github/skills/settings-management/SKILL.md b/.github/skills/settings-management/SKILL.md
index 36d5adf64..1d41acbea 100644
--- a/.github/skills/settings-management/SKILL.md
+++ b/.github/skills/settings-management/SKILL.md
@@ -5,35 +5,175 @@ description: Manage NetAlertX configuration settings. Use this when asked to add
 
 # Settings Management
 
-## Reading Settings
+## Quick Reference
 
+**Read a setting (backend):**
 ```python
 from helper import get_setting_value
-
 value = get_setting_value('SETTING_NAME')
 ```
-
 Never hardcode ports, secrets, or configuration values. Always use `get_setting_value()`.
 
-## Adding Core Settings
-
-Use `ccd()` in `server/initialise.py`:
+**Read a setting (frontend):**
+```javascript
+getSetting("SETTING_NAME")
+```
 
+**Add a core setting** — use `ccd()` in `server/initialise.py`:
 ```python
 ccd('SETTING_NAME', 'default_value', 'description')
 ```
 
-## Adding Plugin Settings
-
-Define in plugin's `config.json` manifest under the settings section.
-
-## Config Files
+**Add a plugin setting** — define in the plugin's `config.json` under the `settings` key.
 
 | File | Purpose |
 |------|---------|
-| `/data/config/app.conf` | Runtime config (modified by app) |
+| `/data/config/app.conf` | Runtime config (source of truth, modified by app) |
 | `back/app.conf` | Default config (template) |
 
-## Environment Override
+Use `APP_CONF_OVERRIDE` for settings that must be set before startup.
+
+---
+
+# Development Guide
+
+The goal is for every setting to be:
+
+- Declarative and self-documenting
+- Automatically rendered by the Settings UI
+- Fully localized
+- Backwards compatible
+- Easy to maintain
+
+---
+
+## 1. Follow existing patterns
+
+Before creating a new setting, search for similar ones. Reuse existing naming conventions, types, and validation patterns. Follow the style already used by similar plugins. Avoid introducing new setting types unless absolutely necessary.
+
+---
+
+## 2. Setting naming
+
+Setting keys use uppercase snake case: `UI_DEV_SECTIONS`, `SCAN_INTERVAL`, `MQTT_HOST`.
+Names should clearly describe the purpose.
+
+---
+
+## 3. Categories
+
+Place settings into the most appropriate category. Keep related settings together. Avoid creating new categories unless there is a clear need.
+
+---
+
+## 4. Choose the correct type
+
+Use the simplest type that correctly models the value: `string`, `integer`, `float`, `boolean`, `password`, `select`, `array`, `textarea`. Avoid encoding structured JSON inside string settings.
+
+---
+
+## 5. Validation
+
+Always define validation whenever appropriate (min/max values, regex, allowed options). Reject invalid configuration rather than silently accepting it.
+
+---
+
+## 6. Defaults
+
+Provide sensible defaults that work for a fresh installation. The `default_value` in `config.json` is the single source of truth — do not duplicate it in Python or JavaScript.
+
+---
+
+## 7. Names and descriptions
+
+Names should be concise. Descriptions should explain what the setting does, when to use it, and any important side effects — not implementation details.
+
+---
+
+## 8. Boolean settings
+
+Prefer verbs: Enable, Disable, Require, Allow, Ignore, Show, Hide. Examples: *Enable MQTT*, *Require NICs Online*, *Hide Offline Devices*.
+
+---
+
+## 9. Select settings
+
+Use when users must choose from predefined values. Each option must have a meaningful label — never require users to remember internal values.
+
+---
+
+## 10. Array settings
+
+Use only when multiple independent values are expected (e.g., ignored MACs, subnet lists, plugin lists).
+
+---
+
+## 11. Localization
+
+Every setting must have localized language strings. If not defined directly in `config.json`, they must exist in `en_us.json`.
+
+Example for `UI_DEV_SECTIONS`:
+```json
+"UI_DEV_SECTIONS_name": "Hide device sections",
+"UI_DEV_SECTIONS_description": "Select which UI elements to hide on the Devices page."
+```
+
+When using external language files, `config.json` must reference:
+```json
+"name": [{ "string": "_GLOBAL_LANG_FILES_" }]
+```
+
+---
+
+## 12. Source of truth
+
+`app.conf` is the source of truth. User-defined values always come from `app.conf`; defaults from `config.json` apply only when a setting is absent. Never read `app.conf` directly — always go through `get_setting_value()`.
+
+---
+
+## 13. Plugin-first settings
+
+Whenever possible, define new settings inside a plugin's `config.json`. Avoid adding hardcoded application settings unless there is a compelling architectural reason.
+
+---
+
+## 14. Runtime lifecycle
+
+```text
+config.json (defaults)
+    → app.conf (source of truth)
+    → Settings database table
+    → table_settings.json API
+    → Frontend getSetting() / Backend get_setting_value()
+```
+
+The database and API are runtime representations only, regenerated from `app.conf` at init.
+
+---
+
+## 15. Backwards compatibility
+
+Avoid renaming settings, changing data types, or changing semantics. If unavoidable, provide migration logic and preserve compatibility where possible.
+
+---
+
+## 16. Pull request checklist
+
+- [ ] Follows existing naming conventions (uppercase snake case)
+- [ ] Correct category used
+- [ ] Appropriate type selected, validation defined
+- [ ] Sensible default — defined only once (in `config.json`)
+- [ ] Name concise, description clear (no implementation details)
+- [ ] Localization strings added; `_GLOBAL_LANG_FILES_` used where appropriate
+- [ ] Plugin-first approach followed where applicable
+- [ ] Frontend renders automatically without custom JavaScript
+- [ ] Backend uses `get_setting_value()` — no direct `app.conf` reads
+- [ ] Backwards compatibility maintained
+- [ ] Documentation updated if required
+
+---
+
+## References
 
-Use `APP_CONF_OVERRIDE` environment variable for settings that must be set before startup.
+- https://docs.netalertx.com/PLUGINS_DEV_SETTINGS/
+- https://docs.netalertx.com/SETTINGS_SYSTEM/
diff --git a/.github/skills/skills-overview/SKILL.md b/.github/skills/skills-overview/SKILL.md
new file mode 100644
index 000000000..f526459ec
--- /dev/null
+++ b/.github/skills/skills-overview/SKILL.md
@@ -0,0 +1,64 @@
+---
+name: skills-overview
+description: Index of all available skills across both GitHub Copilot (.github/skills/) and Gemini CLI (.gemini/skills/). Load this to find the right skill for a task, or to locate the counterpart skill in the other AI system.
+---
+
+# Skills Index — Cross-Reference
+
+Two AI assistants are configured for this project, each with their own skill directory:
+
+- **GitHub Copilot** → `.github/skills/`
+- **Gemini CLI** → `.gemini/skills/`
+
+Skills with the same purpose exist in both, sometimes under different names and with different depth. This index maps them so you can find the richer version when needed.
+
+---
+
+## Shared Skills (exist in both)
+
+| Topic | Copilot Skill | Gemini Skill | Notes |
+|-------|--------------|--------------|-------|
+| Testing | `testing-workflow` | `testing-workflow` | Copilot version covers `testFailure` tool and PYTHONPATH; Gemini version emphasises full suite preference and container detection |
+| Settings & config | `settings-management` | `settings` | Gemini version is more comprehensive (22-point guide + PR checklist); Copilot version covers `ccd()` and `get_setting_value()` usage |
+| MCP activation | `mcp-activation` | `mcp-activation` | Copilot version covers VS Code window reload; Gemini version covers Gemini CLI session restart |
+| Project navigation | `project-navigation` | `project-navigation` | Copilot version has full path tables and env vars; Gemini version is a brief reference |
+| Plugin dev | `plugin-run-development` | `plugin-development` | Copilot version is comprehensive (data contract, phases, formats); Gemini version is a brief checklist pointing to `docs/PLUGINS_DEV.md` |
+| Devcontainer | `devcontainer-services` + `devcontainer-setup` + `devcontainer-configs` | `devcontainer-management` | Copilot splits into 3 focused skills; Gemini combines into one (uses `docker exec`) |
+
+---
+
+## Copilot-Only Skills
+
+No Gemini equivalent yet:
+
+| Skill | Purpose |
+|-------|---------|
+| `api-development` | Creating REST API endpoints |
+| `authentication` | API tokens and 401/403 debugging |
+| `code-standards` | Coding conventions and style rules |
+| `database-patterns` | Device table write paths, SQLite triggers, audit logging, `*Source` attribution |
+| `database-reset` | Wipe and regenerate the database and config |
+| `docker-build` | Build Docker images for testing or production |
+| `docker-prune` | Clean unused Docker resources (destructive — requires confirmation) |
+| `sample-data` | Load synthetic device data into the devcontainer |
+
+---
+
+## Gemini-Only Skills
+
+No Copilot equivalent yet:
+
+| Skill | Purpose |
+|-------|---------|
+| `initiative-start` | Research methodology and structured approach for new tasks |
+
+---
+
+## Adding a New Skill
+
+When adding a skill, create it in **both** directories to keep both AI systems current:
+
+- `.github/skills/<name>/SKILL.md` — add an entry to the skills table in `.github/copilot-instructions.md`
+- `.gemini/skills/<name>/SKILL.md` — auto-discovered by Gemini CLI via YAML frontmatter
+
+Keep the body content identical between both files. Only the frontmatter `name`/`description` may differ slightly to match each system's discovery heuristics.
diff --git a/back/app.conf b/back/app.conf
index 4add3c212..105e4159e 100755
--- a/back/app.conf
+++ b/back/app.conf
@@ -23,6 +23,8 @@ TIMEZONE='Europe/Berlin'
 LOADED_PLUGINS=['ARPSCAN', 'AVAHISCAN', 'CSVBCKP','DBCLNP', 'DIGSCAN', 'INTRNT', 'MAINT', 'NEWDEV', 'NBTSCAN', 'NSLOOKUP','NTFPRCS', 'SETPWD', 'SMTP', 'SYNC', 'VNDRPDT', 'WORKFLOWS', 'UI']
 
 DAYS_TO_KEEP_EVENTS=90
+DEV_HIST_DAYS=1
+DEV_HIST_TRACKED=['devMac','devName','devOwner','devType','devVendor','devFavorite','devGroup','devComments','devLastIP','devFQDN','devPrimaryIPv4','devPrimaryIPv6','devVlan','devForceStatus','devStaticIP','devScan','devAlertDown','devCanSleep','devSkipRepeated','devLocation','devIsArchived','devParentMAC','devParentPort','devParentRelType','devReqNicsOnline','devIcon','devSite','devSSID','devSyncHubNode']
 # Used for generating links in emails. Make sure not to add a trailing slash!
 REPORT_DASHBOARD_URL='update_REPORT_DASHBOARD_URL_setting'
 
diff --git a/docs/API_GRAPHQL.md b/docs/API_GRAPHQL.md
index cd176f577..ff36a3f2d 100755
--- a/docs/API_GRAPHQL.md
+++ b/docs/API_GRAPHQL.md
@@ -3,6 +3,7 @@
 GraphQL queries are **read-optimized for speed**. Data may be slightly out of date until the file system cache refreshes. The GraphQL endpoints allow you to access the following objects:
 
 * Devices
+* Device History (change audit log)
 * Settings
 * Events
 * PluginsObjects
@@ -415,3 +416,101 @@ curl 'http://host:GRAPHQL_PORT/graphql' \
 * Plugin queries scope `dbCount` to the requested `plugin`/`foreignKey` so badge counts reflect per-plugin totals.
 * The schema is **read-only** — updates must be performed through other APIs or configuration management. See the other [API](API.md) endpoints for details.
 
+---
+
+## Device History Queries
+
+Device field change history is stored in `DevicesHistory` and exposed via two queries. History tracking is controlled by `DEV_HIST_DAYS` (retention window) and `DEV_HIST_TRACKED` (list of audited columns). Set `DEV_HIST_DAYS = 0` to disable tracking entirely.
+
+### `deviceHistoryGrouped` — Single Device
+
+Returns grouped change events for one device. Events are grouped by `(timestamp, changedBy)` so that simultaneous field changes are returned as a single object.
+
+```graphql
+query DeviceHistory($devGUID: String!, $changedColumn: String, $changedBy: String, $limit: Int, $offset: Int) {
+  deviceHistoryGrouped(
+    devGUID: $devGUID
+    changedColumn: $changedColumn
+    changedBy: $changedBy
+    limit: $limit
+    offset: $offset
+  ) {
+    count
+    history {
+      devGUID
+      timestamp
+      changedBy
+      changes {
+        changedColumn
+        oldValue
+        newValue
+      }
+    }
+  }
+}
+```
+
+#### Parameters
+
+| Parameter       | Type     | Required | Description                                                          |
+|-----------------|----------|----------|----------------------------------------------------------------------|
+| `devGUID`       | `String` | No       | GUID of the device to fetch history for                              |
+| `changedColumn` | `String` | No       | Filter to groups containing a change to this specific column         |
+| `changedBy`     | `String` | No       | Filter to a specific attribution source (`USER`, `ARPSCAN`, etc.)    |
+| `limit`         | `Int`    | No       | Max grouped events to return (default `50`)                          |
+| `offset`        | `Int`    | No       | Grouped-event offset for pagination (default `0`)                    |
+
+#### Response fields
+
+| Field                      | Description                                                                 |
+|----------------------------|-----------------------------------------------------------------------------|
+| `count`                    | Total number of grouped events matching the filters (use for pagination)    |
+| `history[].devGUID`        | Device GUID                                                                 |
+| `history[].timestamp`      | UTC timestamp of the change event                                           |
+| `history[].changedBy`      | Attribution: `USER`, plugin prefix (e.g. `ARPSCAN`), or `system`            |
+| `history[].changes[].changedColumn` | Column name that changed                                           |
+| `history[].changes[].oldValue`      | Value before the change (`null` for new devices)                   |
+| `history[].changes[].newValue`      | Value after the change                                              |
+
+#### `curl` Example
+
+```sh
+curl -X POST http://localhost:20212/graphql \
+  -H "Content-Type: application/json" \
+  -H "Authorization: Bearer YOUR_API_TOKEN" \
+  -d '{
+    "query": "query($devGUID:String!,$limit:Int,$offset:Int){deviceHistoryGrouped(devGUID:$devGUID,limit:$limit,offset:$offset){count history{timestamp changedBy changes{changedColumn oldValue newValue}}}}",
+    "variables": {
+      "devGUID": "your-device-guid-here",
+      "limit": 25,
+      "offset": 0
+    }
+  }'
+```
+
+---
+
+
+
+---
+
+### Filter Values Endpoint
+
+To populate dynamic filter dropdowns, fetch available `changedBy` and `changedColumn` values via the REST endpoint:
+
+```sh
+GET /devices/history/filters?devGUID=<guid>   # scoped to one device
+GET /devices/history/filters                   # all devices
+```
+
+Response:
+```json
+{
+  "success": true,
+  "data": {
+    "changedBy": ["ARPSCAN", "USER", "VNDRPDT", "system"],
+    "changedColumn": ["devLastIP", "devName", "devNameSource", "devVendor"]
+  }
+}
+```
+
diff --git a/docs/DEVICE_CHANGE_LOG.md b/docs/DEVICE_CHANGE_LOG.md
new file mode 100644
index 000000000..c2f3b25f1
--- /dev/null
+++ b/docs/DEVICE_CHANGE_LOG.md
@@ -0,0 +1,73 @@
+# Change log
+
+The **_Change log_** provides a historical record of changes made to your devices. It allows you to see **what changed, when it changed, and what caused the change**, making it easier to troubleshoot unexpected updates, audit configuration changes, and understand how device information evolves over time.
+
+![Device Change log](./img/DEVICE_MANAGEMENT/device_change_log.png)
+
+## What is recorded?
+
+Whenever a tracked device property changes, NetAlertX records:
+
+* **Time** the change occurred
+* **Source** that made the change
+* **Device** that was updated
+* **Field** that changed
+* **Previous value**
+* **New value**
+
+Related changes that occur at the same time are grouped together into a single event, making it easy to see all updates from one scan or user action.
+
+## Understanding the Source column
+
+The **Source** column identifies what caused the change.
+
+Depending on the field, the source may be:
+
+* A discovery plugin such as **ARPSCAN**, **NSLOOKUP**, **UNIFIAPI**, or another plugin that supplied the information.
+* **user:api** for changes made manually through the NetAlertX interface or API.
+* **system** for values calculated or maintained internally by NetAlertX.
+
+This helps distinguish between information discovered automatically and changes made by users.
+
+## Filtering the history
+
+The _Change log_ includes filters to help locate specific events.
+
+You can filter by:
+
+* **Source** to view changes made by a specific plugin or user.
+* **Changed Field** to display changes to a particular device property, such as IP address or hostname.
+
+You can also use the search box to quickly find matching devices by GUID, values, or fields.
+
+## Viewing grouped changes
+
+A single action often updates multiple properties on a device.
+
+Instead of showing each field as a separate record, the _Change log_ groups related updates together. For example, a network scan might update both a device's IP address and hostname at the same time. These changes appear together in one entry with each modified field listed underneath.
+
+## Retention
+
+The amount of history retained is controlled by the **Device History Days (`DEV_HIST_DAYS`)** setting.
+
+Older history entries are automatically removed once they exceed the configured retention period. this is maintained by the `DBCLNP` plugin.
+
+Setting this value to **0** disables _Change log_ recording entirely.
+
+## Choosing what to track
+
+Not every device property needs to be recorded.
+
+The **Tracked Device History Fields (`DEV_HIST_TRACKED`)** setting lets you choose exactly which device fields should be monitored. Tracking only the fields that are important for your environment can significantly reduce database growth while keeping the most useful audit information.
+
+## Performance considerations
+
+Recording history introduces additional database writes whenever tracked fields change. For most installations the overhead is minimal, but on larger networks it can generate a substantial amount of historical data.
+
+If you want to reduce storage usage or improve performance, consider:
+
+* Tracking only the device fields that matter to you.
+* Reducing the history retention period.
+* Disabling the _Change log_ entirely by setting **`DEV_HIST_DAYS`** to **0**.
+
+These settings allow you to balance historical visibility with database size and performance. For more tips on how to optimize system resource use check the [performance guide](./PERFORMANCE.md).
diff --git a/docs/DEVICE_PRESENCE.md b/docs/DEVICE_PRESENCE.md
new file mode 100644
index 000000000..89133678e
--- /dev/null
+++ b/docs/DEVICE_PRESENCE.md
@@ -0,0 +1,45 @@
+## Presence View
+
+![Device presence](./img/DEVICE_MANAGEMENT/device_presence.png)
+
+The **Presence View** provides a visual timeline of when each device was detected on your network, making it easy to understand activity over time instead of relying only on the current status.
+
+Use this view to answer questions such as:
+
+* When was this device first discovered?
+* When was it last seen online?
+* How often does this device connect to the network?
+* Has the device been continuously online or only appearing intermittently?
+* When did the device disappear or return?
+
+The timeline makes it easy to identify recurring activity patterns, unexpected outages, or devices that only appear at certain times of the day or week.
+
+### Timeline Views
+
+The timeline can be displayed at different time scales depending on the level of detail you need:
+
+* **Week** – View recent activity with the highest level of detail.
+* **Month** – Review activity across the past month.
+* **Year** – Get a long-term overview of device presence and seasonal patterns.
+
+Switch between these views using the **Week**, **Month**, and **Year** buttons above the timeline.
+
+### Timeline Legend
+
+The timeline uses color coding to indicate device presence:
+
+* <div class="presenceOnlineNow presenceKeyBoxes" style="display:inline-block;vertical-align:middle;"></div> **Now online** – The device was detected during the most recent scan and is currently online.
+* <div class="presenceOnlinePast presenceKeyBoxes" style="display:inline-block;vertical-align:middle;"></div> **Past online** – The device was online previously but is currently offline.
+* <div class="presenceOnlinePastMiss presenceKeyBoxes" style="display:inline-block;vertical-align:middle;"></div> **Past online (mismatch)** – Historical activity was detected, but the beginning of the session could not be determined or conflicting data was encountered.
+
+### Typical Uses
+
+The Presence View is especially useful for:
+
+* Troubleshooting intermittent connectivity issues.
+* Identifying devices that frequently disconnect and reconnect.
+* Understanding occupancy or usage patterns for phones, laptops, IoT devices, and other network equipment.
+* Verifying when visitors' devices or temporary equipment were present on the network.
+* Reviewing historical presence without searching through individual events or logs.
+
+Unlike the Device Details page, which shows the current state of a device, the Presence View focuses on **when** devices were active, providing valuable historical context at a glance. To investigate exactly **what** changed during a device's lifetime, see the [Change Log](./DEVICE_CHANGE_LOG.md).
diff --git a/docs/PERFORMANCE.md b/docs/PERFORMANCE.md
index 8abd4d349..a6c74f6dd 100755
--- a/docs/PERFORMANCE.md
+++ b/docs/PERFORMANCE.md
@@ -132,6 +132,14 @@ When **any** name-resolution plugin has `devName` in its `SET_ALWAYS` list, the
 
 The actual number of DB rows updated is logged at `verbose` level under `[Update Device Name] SET_ALWAYS re-resolve - DB rows updated`.
 
+
+---
+
+## Disable change log tracking
+
+To improve performance, you can reduce or disable change log tracking. Use the `DEV_HIST_TRACKED` setting to limit tracking to specific columns, and adjust `DEV_HIST_DAYS` to control how long history is retained. Setting `DEV_HIST_DAYS` to `0` disables history tracking entirely.
+
+
 ---
 
 ## Storing Temporary Files in Memory
diff --git a/docs/SETTINGS_SYSTEM.md b/docs/SETTINGS_SYSTEM.md
index bcc0f46c8..0991da46d 100755
--- a/docs/SETTINGS_SYSTEM.md
+++ b/docs/SETTINGS_SYSTEM.md
@@ -36,6 +36,37 @@ Plugin settings are loaded dynamically from the `config.json` of individual plug
 
 ![Screen 1][screen1]
 
+### Localization
+
+Every setting must have localized language strings.
+
+If the language strings are **not** defined directly inside `config.json`, they must exist in `en_us.json`.
+
+For example, for:
+
+```text
+UI_DEV_SECTIONS
+```
+
+add:
+
+```json
+"UI_DEV_SECTIONS_name": "Hide device sections",
+"UI_DEV_SECTIONS_description": "Select which UI elements to hide on the Devices page."
+```
+
+When using external language files, `config.json` must reference:
+
+```json
+"name": [
+  {
+    "string": "_GLOBAL_LANG_FILES_"
+  }
+]
+```
+
+This tells NetAlertX to resolve the display name from the language files.
+
 ### Settings Process flow
 
 The process flow is mostly managed by the [initialise.py](/server/initialise.py) file.
diff --git a/docs/WHERE_NETALERTX_FITS.md b/docs/WHERE_NETALERTX_FITS.md
new file mode 100644
index 000000000..5f3dd7150
--- /dev/null
+++ b/docs/WHERE_NETALERTX_FITS.md
@@ -0,0 +1,314 @@
+# Where NetAlertX Fits
+
+Understanding where NetAlertX fits in your network management toolkit makes it easier to get the most from it.
+
+Modern networks are typically managed using several specialized tools. One application may monitor uptime, another may capture packets, another may enforce firewall rules, while another documents the network.
+
+NetAlertX fills a different role: it provides **continuous network visibility** by discovering devices, maintaining an accurate asset inventory, detecting changes, and notifying you when something important happens.
+
+It answers one of the most common questions in network administration:
+
+> **What is on my network, and what has changed?**
+
+---
+
+## What NetAlertX Does
+
+NetAlertX continuously discovers devices using one or more discovery plugins and builds a living inventory of your network.
+
+Depending on your configuration, it can collect information including:
+
+* IP addresses
+* MAC addresses
+* Hostnames
+* Vendors
+* Device types
+* Open ports
+* Network interfaces
+* Parent/child relationships
+* First and last seen timestamps
+* Custom metadata
+
+Because discovery runs continuously, your inventory stays up to date automatically.
+
+Learn more about the available discovery methods in the [Plugins](./PLUGINS.md) documentation.
+
+---
+
+## Detecting Change
+
+Knowing what exists on your network is useful.
+
+Knowing **what changed** is often even more valuable.
+
+NetAlertX continuously records changes such as:
+
+* New devices
+* Devices going offline or coming back online
+* IP address changes
+* Hostname changes
+* Vendor identification
+* Open port changes (via the `NMAP` [plugin](./PLUGINS.md))
+* Devices returning after long periods offline
+* Configuration updates
+
+These changes become events that can be viewed historically, filtered, searched, or used to trigger automation.
+
+---
+
+## Notifications
+
+![Global notification settings](./img/NOTIFICATIONS/Global-notification-settings.png)
+
+Not every event deserves immediate attention.
+
+NetAlertX lets you choose which events [generate notifications](./NOTIFICATIONS.md) so that important alerts stand out without creating unnecessary noise.
+
+Examples include:
+
+* Unknown devices joining the network
+* Critical infrastructure becoming unavailable
+* IP address changes
+* Port changes
+* Custom workflow events
+
+Notification publishers can be enabled independently, allowing NetAlertX to integrate with your existing communication channels.
+
+---
+
+## Automation
+
+![Workflow Action target](./img/WORKFLOWS/actions_target.png)
+
+As networks grow, manually responding to every event quickly becomes impractical.
+
+NetAlertX includes a [workflow engine](./WORKFLOWS.md) that can automatically react to events.
+
+Typical automations include:
+
+* Mark trusted devices automatically
+* Assign devices to groups
+* Update fields
+* Archive old devices with the same IP
+* Assign devices to the right parent node
+
+Automation helps keep device management consistent while reducing repetitive administrative work.
+
+---
+
+## Device Relationships
+
+![Hover relationships detail](./img/NETWORK_TREE/Network_tree_setup_hover.png)
+
+Networks are more than collections of independent devices.
+
+Devices often depend on one another.
+
+Examples include:
+
+* Access points connected to switches
+* Virtual machines hosted by physical servers
+* Containers running on hosts
+* Network interfaces belonging to a parent device
+* IoT gateways connected to sensors
+
+NetAlertX supports [device relationships](./NETWORK_TREE.md) to better represent how devices are connected and how they depend on each other.
+
+---
+
+## Historical Visibility
+
+![Device presence](./img/DEVICE_MANAGEMENT/device_presence.png)
+
+Many monitoring systems focus only on the current state.
+
+NetAlertX also records historical information, helping you understand how devices behave over time.
+
+You can answer questions like:
+
+* When was this device first discovered?
+* When was it last online?
+* How does its network presence change over time?
+* Which configuration attributes have changed?
+
+Historical data provides operational context without requiring a separate logging platform.
+
+Two key views help explore this history:
+
+* **Presence View** – when a device was active on the network
+* **Change log** – what changed in the device’s configuration over time
+
+---
+
+## Change log
+
+![Device change log](./img/DEVICE_MANAGEMENT/device_change_log.png)
+
+The **Change log** records all tracked changes to device attributes, showing what changed and when it happened.
+
+Each entry includes:
+
+* Timestamp of the change
+* Previous and new values
+* Source of the change (plugin, workflow, or user action)
+
+You can filter, search, and sort changes to quickly investigate events such as IP changes, hostname updates, VLAN changes, or device classification updates.
+
+| View              | Answers             |
+| ----------------- | ------------------- |
+| **Presence View** | When was it active? |
+| **Change log**    | What changed?       |
+
+
+---
+
+## Plugin Architecture
+
+![Action target](./img/plugins_json_settings.png) 
+
+Every environment is different.
+
+Some users prefer simple ARP scanning.
+
+Others rely on:
+
+* SNMP
+* DHCP leases
+* Router integrations
+* Pi-hole
+* Virtualization platforms
+* Cloud services
+* External asset inventories
+
+NetAlertX is built around a plugin architecture that allows multiple discovery sources to work together, improving accuracy while remaining flexible.
+
+See the complete list in [Plugins](./PLUGINS.md).
+
+---
+
+## Integrations
+
+NetAlertX is designed to complement your existing infrastructure rather than replace it.
+
+It integrates with many popular platforms, including:
+
+* Home Assistant
+* Pi-hole
+* MQTT
+* Notification services
+* REST APIs
+* Custom workflows
+
+This allows NetAlertX to become part of your existing automation and monitoring ecosystem.
+
+---
+
+## How NetAlertX Compares
+
+The following diagram illustrates how NetAlertX complements other common network tools.
+
+| Need | Typical Tool | NetAlertX Role |
+| --- | --- | --- |
+| Device discovery | ✅ | **Core capability** |
+| Asset inventory | ✅ | **Core capability** |
+| Detect network changes | ✅ | **Core capability** |
+| Historical device tracking | ✅ | **Core capability** |
+| Notifications | ✅ | **Core capability** |
+| Automation | ✅ | **Core capability** |
+| Packet inspection | Wireshark | Not intended |
+| Firewall enforcement | pfSense, OPNsense | Not intended |
+| IDS/IPS | Suricata, Snort | Not intended |
+| Network documentation | NetBox, NetMap | Complements them |
+| Uptime monitoring | Uptime Kuma, Nagios | Complements them |
+
+NetAlertX works best alongside these tools, providing the continuously updated device inventory that many monitoring platforms lack.
+
+---
+
+## Typical Deployments
+
+### 🏠 Home Networks
+
+Monitor:
+
+* Family devices
+* Smart home equipment
+* NAS systems
+* TVs and media devices
+* Game consoles
+* IoT devices
+
+Receive alerts whenever new or unknown devices join your network.
+
+---
+
+### 🧪 Homelabs
+
+Track constantly changing environments including:
+
+* Docker containers
+* Virtual machines
+* Kubernetes nodes
+* Development systems
+* Test networks
+
+Maintain an accurate inventory without manual documentation.
+
+---
+
+### 🏢 Small Businesses
+
+Maintain visibility across office networks by tracking:
+
+* Unauthorized devices and shadow IT
+* Office infrastructure and critical core systems
+* Real-time asset inventory drift
+
+---
+
+### 🌍 Remote Sites
+
+Deploy NetAlertX at branch offices or remote locations to maintain local visibility while monitoring multiple sites centrally.
+
+---
+
+## What NetAlertX Is Designed To Do
+
+NetAlertX is designed to excel at:
+
+* Continuous device discovery
+* Asset inventory
+* Network visibility
+* Change detection
+* Historical tracking
+* Notifications
+* Workflow automation
+* Plugin extensibility
+
+By focusing on these capabilities, NetAlertX remains lightweight, flexible, and easy to integrate into existing environments.
+
+---
+
+## What NetAlertX Is Not
+
+NetAlertX is **not** intended to replace:
+
+* Firewalls
+* Packet analyzers
+* IDS/IPS platforms
+* Configuration management systems
+* Network documentation platforms
+* Dedicated uptime monitoring systems
+
+Instead, it complements these tools by providing continuous awareness of the devices connected to your network.
+
+---
+
+## Next Steps
+
+Now that you understand where NetAlertX fits, continue with one of the following guides:
+
+* **[Installation](INSTALLATION.md)** — Install NetAlertX on your platform.
+* **[Plugins](./PLUGINS.md)** — Configure device discovery.
+* **[Features](FEATURES.md)** — Explore everything NetAlertX can do.
+* **[API](API.md)** — Integrate NetAlertX with your own applications.
\ No newline at end of file
diff --git a/docs/img/DEVICE_MANAGEMENT/device_change_log.png b/docs/img/DEVICE_MANAGEMENT/device_change_log.png
new file mode 100644
index 000000000..7166d7d92
Binary files /dev/null and b/docs/img/DEVICE_MANAGEMENT/device_change_log.png differ
diff --git a/docs/img/DEVICE_MANAGEMENT/device_presence.png b/docs/img/DEVICE_MANAGEMENT/device_presence.png
new file mode 100644
index 000000000..493a31d3c
Binary files /dev/null and b/docs/img/DEVICE_MANAGEMENT/device_presence.png differ
diff --git a/docs/index.md b/docs/index.md
index 720842a29..dc8e80e98 100755
--- a/docs/index.md
+++ b/docs/index.md
@@ -56,6 +56,23 @@ hide:
 
 ---
 
+## What is NetAlertX?
+
+NetAlertX continuously discovers the devices on your network, builds a living asset inventory, detects changes, and alerts you when something important happens.
+
+Whether you're monitoring a home network, homelab, business, or remote site, NetAlertX helps answer questions like:
+
+- What devices are currently connected?
+- Has a new or unknown device appeared?
+- Which servers or services are offline?
+- Has a device changed IP address, hostname, or open ports?
+- When was a device first or last seen?
+
+Unlike packet analyzers or firewall appliances, NetAlertX focuses on **network visibility**, **asset discovery**, **change detection**, **historical tracking**, and **automation**.
+
+> [!TIP]
+> **New to NetAlertX?** Start with **[Where NetAlertX Fits](./WHERE_NETALERTX_FITS)** to understand how it complements the rest of your network tools.
+
 ## Help and Support
 
 If you need help or run into issues, here are some resources to guide you:
diff --git a/docs/stylesheets/custom.css b/docs/stylesheets/custom.css
index a8585d21a..f7105106c 100644
--- a/docs/stylesheets/custom.css
+++ b/docs/stylesheets/custom.css
@@ -14,6 +14,19 @@
  * limitations under the License.
  */
 
+ :root {
+  --color-white: #fff;
+  --color-aqua: #00c0ef;
+  --color-lightblue: #3c8dbc;
+  --color-blue: #0060df;
+  --color-green: #00a65a;
+  --color-yellow: #f39c12;
+  --color-red: #dd4b39;
+  --color-gray: #8c8c8c;
+  --color-darkgray: #3f3e3e;
+  --color-lightgray: #bec5cb;
+  --color-black: #000;
+}
 
 /* --- HERO SECTION --- */
 .hero-wrapper {
@@ -143,3 +156,25 @@ p.hero-description {
 .learn-more-btn:hover {
   opacity: 0.8;
 }
+
+/* key presence styles */
+.presenceOnlineNow{
+  background-color: var(--color-green);
+}
+
+.presenceOnlinePast{
+  background-color: var(--color-blue);
+}
+
+.presenceOnlinePastMiss{
+  background-color: var(--color-yellow);
+}
+
+.presenceKeyBoxes
+{
+  width: 10px;
+  height: 10px;
+  display: inline-block;
+  /* background: #fff; */
+  opacity: .75;
+}
diff --git a/front/changeLog.php b/front/changeLog.php
new file mode 100644
index 000000000..92aa75822
--- /dev/null
+++ b/front/changeLog.php
@@ -0,0 +1,11 @@
+<?php
+require 'php/templates/header.php';
+?>
+<div class="content-wrapper changeHistoryPage spinnerTarget" id="changeHistoryPage">
+<?php
+  require 'changeLogCore.php';
+?>
+</div>
+
+
+<?php require 'php/templates/footer.php'; ?>
diff --git a/front/changeLogCore.php b/front/changeLogCore.php
new file mode 100644
index 000000000..4b47f52a6
--- /dev/null
+++ b/front/changeLogCore.php
@@ -0,0 +1,409 @@
+<script>
+  showSpinner();
+</script>
+
+<?php require 'php/templates/skel_change_log.php'; ?>
+
+<section class="content change-log">
+  <!-- Help link -->
+  <span class="helpIcon">
+    <a target="_blank" href="https://docs.netalertx.com/DEVICE_CHANGE_LOG">
+      <i class="fa fa-circle-question"></i>
+    </a>
+  </span>
+
+  <div class="row">
+    <div class="col-xs-12">
+      <div class="box">
+      
+        <!-- Filter Bar -->      
+        <div class="box-header" style="display:flex; gap:10px; flex-wrap:wrap; align-items:center;">
+          <select id="filterChangedBy" class="form-control" style="width:200px;">
+            <option value=""><?= lang('device_history_col_source'); ?> - All</option>
+          </select>
+
+          <select id="filterChangedColumn" class="form-control" style="width:200px;">
+            <option value=""><?= lang('device_history_col_dropdown'); ?> - All</option>
+          </select>
+
+          <?= lang('device_history_col_changes'); ?>
+        </div>
+
+        <!-- Data Table -->
+        <div class="box-body">
+          <table id="changeHistoryTable" class="table table-bordered table-striped">
+            <thead>
+              <tr>
+                <th><?= lang('device_history_col_time'); ?></th>
+                <th><?= lang('device_history_col_source'); ?></th>
+                <th><?= lang('gen_device'); ?></th>
+                <th><?= lang('device_history_table_title_changes'); ?></th>
+              </tr>
+            </thead>
+
+            <tbody id="changeHistoryBody">
+              <tr>
+                <td colspan="4" class="text-center">
+                  <i class="fa fa-spinner fa-spin"></i>
+                </td>
+              </tr>
+            </tbody>
+          </table>
+        </div>
+
+      </div>
+    </div>
+  </div>
+</section>
+
+<script>
+  /**
+   * =========================
+   * State
+   * =========================
+   */
+  let historyTable = null;
+  let changeLogPageInitialized = false;
+
+  const urlMac = getMacFromUrl();
+
+  /**
+   * =========================
+   * Table Initialization
+   * =========================
+   */
+  function initializeHistoryTable() {
+
+    historyTable = $('#changeHistoryTable').DataTable({
+
+      processing: false,
+      serverSide: true,
+      paging: true,
+      searching: true,
+      ordering: true,
+      info: true,
+      autoWidth: false,
+
+      pageLength: getSetting("UI_DEFAULT_PAGE_SIZE"),
+      lengthMenu: getLengthMenu(getSetting("UI_DEFAULT_PAGE_SIZE")),
+
+      /**
+       * Server-side AJAX loader (GraphQL)
+       */
+      ajax: function (dtRequest, callback) {
+
+        showSpinner();
+
+        // DataTables paging
+        const limit = parseInt(dtRequest.length, 10) || 50;
+        const start = parseInt(dtRequest.start, 10) || 0;
+        const page = Math.floor(start / limit) + 1;
+        const search = dtRequest.search?.value || null;
+        const order = dtRequest.order?.[0];
+
+        const apiBaseUrl = getApiBase();
+        const url = `${apiBaseUrl}/graphql`;
+
+        console.log(url);
+
+        // Resolve device filter from MAC if present
+        let devGUID = null;
+        if (urlMac) {
+          devGUID = getDevDataByMac(urlMac, "devGUID");
+        }
+
+        // Column mapping for sorting
+        const columns = [
+          "timestamp",
+          "changedBy",
+          "devGUID",
+          null
+        ];
+
+        const sort = [];
+
+        if (order) {
+          const field = columns[order.column];
+          if (field) {
+            sort.push({
+              field: field,
+              order: order.dir
+            });
+          }
+        }
+
+        /**
+         * GraphQL query
+         */
+        const query = `
+          query(
+            $devGUID:String,
+            $changedColumn:String,
+            $changedBy:String,
+            $options:PageQueryOptionsInput
+          ){
+            deviceHistoryGrouped(
+              devGUID:$devGUID
+              changedColumn:$changedColumn
+              changedBy:$changedBy
+              options:$options
+            ){
+              count
+              history{
+                devGUID
+                timestamp
+                changedBy
+                changes{
+                  changedColumn
+                  oldValue
+                  newValue
+                }
+              }
+            }
+          }
+        `;
+
+        $.ajax({
+          url: url,
+          method: "POST",
+          contentType: "application/json",
+          headers: {
+            Authorization: "Bearer " + getSetting("API_TOKEN")
+          },
+
+          data: JSON.stringify({
+            query,
+            variables: {
+              changedBy: $('#filterChangedBy').val() || null,
+              changedColumn: $('#filterChangedColumn').val() || null,
+              devGUID: devGUID,
+              options: {
+                page,
+                limit,
+                sort,
+                search
+              }
+            }
+          }),
+
+          success: function (resp) {
+
+            const result = resp?.data?.deviceHistoryGrouped;
+
+            callback({
+              data: result?.history || [],
+              recordsTotal: result?.count || 0,
+              recordsFiltered: result?.count || 0
+            });
+
+            hideSpinner();
+            hideChangeLogSkeleton();
+          },
+
+          error: function (xhr, textStatus, errorThrown) {
+
+            console.error("History GraphQL request failed", {
+              status: xhr.status,
+              statusText: xhr.statusText,
+              textStatus,
+              errorThrown,
+              response: xhr.responseText,
+              variables: {
+                changedBy: $('#filterChangedBy').val() || null,
+                changedColumn: $('#filterChangedColumn').val() || null,
+                devGUID,
+                options: {
+                  page,
+                  limit,
+                  sort,
+                  search
+                }
+              }
+            });
+
+            callback({
+              data: [],
+              recordsTotal: 0,
+              recordsFiltered: 0
+            });
+          }
+        });
+      },
+
+      /**
+       * Column definitions
+       */
+      columns: [
+        { data: "timestamp" },
+        { data: "changedBy" },
+        { data: "devGUID" },
+        { data: "changes" }
+      ],
+
+      columnDefs: [
+        {
+          targets: 0,
+          render: data => localizeTimestamp(data)
+        },
+        {
+          targets: 1,
+          render: data => escHtml(data)
+        },
+        {
+          targets: 2,
+          render: function (data) {
+
+            const guid = escHtml(data);
+            const mac = getDevDataByGuid(guid, "devMac");
+            const name = getDevDataByGuid(guid, "devName");
+
+            return `
+              <a href="deviceDetails.php?mac=${mac}" data-guid="${guid}">
+                ${name} (${guid})
+              </a>`;
+          }
+        },
+        {
+          targets: 3,
+          orderable: false,
+          searchable: false,
+
+          render: function (changes) {
+
+            if (!Array.isArray(changes)) return "";
+
+            return changes.map(c => `
+              <div>
+                <code>${escHtml(c.changedColumn)}</code>:
+                <span class="text-danger">${escHtml(c.oldValue || "∅")}</span>
+                →
+                <span class="text-success">${escHtml(c.newValue || "∅")}</span>
+              </div>
+            `).join("");
+          }
+        }
+      ],
+
+      language: {
+        processing: '<i class="fa fa-spinner fa-spin"></i>',
+        emptyTable: "<?= lang('device_history_empty_state'); ?>"
+      }
+    });
+  }
+
+  /**
+   * =========================
+   * Filters
+   * =========================
+   */
+  function bindHistoryFilters() {
+
+    $('#filterChangedBy, #filterChangedColumn').on('change', function () {
+      if (historyTable) {
+        showSpinner();
+        historyTable.ajax.reload(null, true);
+      }
+    });
+  }
+
+  function populateFilters() {
+
+    const apiBaseUrl = getApiBase();
+    const apiEndpoint = '/devices/history/filters';
+
+    let queryString = "";
+
+    if (urlMac) {
+      queryString += `?devGUID=${getDevDataByMac(urlMac, "devGUID")}`;
+    }
+
+    const url = `${apiBaseUrl}/${apiEndpoint}${queryString}`;
+
+    $.ajax({
+      url,
+      method: 'GET',
+      headers: {
+        Authorization: 'Bearer ' + getSetting('API_TOKEN')
+      },
+
+      success: function (resp) {
+
+        if (!resp.data) return;
+
+        const byEl = document.getElementById('filterChangedBy');
+        const colEl = document.getElementById('filterChangedColumn');
+
+        (resp.data.changedBy || []).forEach(v => byEl.add(new Option(v, v)));
+        (resp.data.changedColumn || []).forEach(v => colEl.add(new Option(v, v)));
+
+        if ($.fn.dataTable.isDataTable('#changeHistoryTable')) {
+          $('#changeHistoryTable').DataTable().ajax.reload();
+        }
+      }
+    });
+  }
+
+  /**
+   * =========================
+   * Helpers
+   * =========================
+   */
+
+  function escHtml(str) {
+    if (str === null || str === undefined) return '';
+    return String(str)
+      .replace(/&/g, '&amp;')
+      .replace(/</g, '&lt;')
+      .replace(/>/g, '&gt;')
+      .replace(/"/g, '&quot;');
+  }
+
+  function getMacFromUrl() {
+    return new URLSearchParams(window.location.search).get('mac');
+  }
+
+  /**
+   * =========================
+   * Page Init
+   * =========================
+   */
+  function initChangeLogPage() {
+
+    if ($('#panHistory').length !== 0 && !$('#panHistory:visible').length) {
+      return;
+    }
+
+    if (changeLogPageInitialized) return;
+    changeLogPageInitialized = true;
+
+    showChangeLogSkeleton();
+    showSpinner();
+
+    populateFilters();
+    initializeHistoryTable();
+    bindHistoryFilters();
+  }
+
+  initLazyTab('#panHistory', function () {
+    waitForAppReady(function () {
+      initChangeLogPage();
+    });
+  });
+
+  /**
+   * =========================
+   * Skeleton UI
+   * =========================
+   */
+  function hideChangeLogSkeleton() {
+    $('#change-log-skeleton').fadeOut(0, function () {
+      $(this).hide();
+    });
+  }
+
+  function showChangeLogSkeleton() {
+    $('#change-log-skeleton')
+      .stop(true, true)
+      .fadeIn(0);
+  }
+</script>
\ No newline at end of file
diff --git a/front/css/app.css b/front/css/app.css
index b851c5ed6..facd9d994 100755
--- a/front/css/app.css
+++ b/front/css/app.css
@@ -1001,6 +1001,19 @@ height: 50px;
     opacity: .75;
 }
 
+#presencePage .helpIcon{
+    top: 2px;
+    display: initial;
+    font-size: x-small;
+}
+
+.calendarHelpIcon{
+    display: block;
+    position: absolute;
+    font-size: x-small;
+    top: -5px;
+}
+
 /* --------------------------------------------------------- */
 /*                         report                            */
 /* --------------------------------------------------------- */
@@ -2206,6 +2219,12 @@ textarea[readonly],
     padding-top: 20px;
 }
 
+.pluginsCore .helpIcon
+{
+    margin-left: -20px;
+    font-size: x-small;
+}
+
 /*Hidden special button*/
 
 @media (max-width: 365px) {
@@ -2636,7 +2655,29 @@ table.dataTable tbody > tr.selected
     background-color: rgba(140, 140, 140, 0.05);
 }
 
-/* ===== Loading Skeleton ===== */
+/* -----------------------------------------------------------------------------
+   Change log
+----------------------------------------------------------------------------- */
+
+.change-log .helpIcon{
+    left: 15px;
+    font-size: x-small;
+}
+
+#panHistory
+{
+    min-height:850px
+}
+
+#panHistory .change-log-skeleton-class 
+{
+    margin-left: 0px;
+    width: calc(100% - 40px);
+}
+
+/* -----------------------------------------------------------------------------
+   Loading Skeletons
+----------------------------------------------------------------------------- */
 
 /* Custom properties (overridden in dark-patch.css for Dark/System themes) */
 :root {
@@ -2677,7 +2718,7 @@ table.dataTable tbody > tr.selected
 
 /* Page-level overlay base */
 #settings-skeleton, #devices-skeleton, #device-details-skeleton,
-#events-skeleton, #presence-skeleton, #report-skeleton, #skel-app-events,
+#events-skeleton, #presence-skeleton, #report-skeleton, #skel-app-events, #change-log-skeleton
 #notifications-skeleton, #workflows-skeleton, #plugins-skeleton, .skel-tab-pane {
     position: absolute;
     top: 0;
@@ -2699,6 +2740,7 @@ table.dataTable tbody > tr.selected
 #notifications-skeleton  { margin: 15px; top: 50px; min-height: 400px; }
 #workflows-skeleton      { top: 50px; width: 770px; margin: 0 auto; min-height: 300px; }
 #plugins-skeleton        { top: 50px; padding: 0; min-height: 400px; }
+#change-log-skeleton     { display: block;  min-height: 400px;  z-index: 1; position: absolute; margin-left: 15px; padding-top: 15px; width:100%;}
 #skel-tab-sessions, #skel-tab-events, #skel-tab-presence {margin: -10px;  padding: 20px;}
 
 /* Hide scrollbars */
diff --git a/front/deviceDetails.php b/front/deviceDetails.php
index e6236527d..5e0b76e43 100755
--- a/front/deviceDetails.php
+++ b/front/deviceDetails.php
@@ -111,6 +111,14 @@
                     </span>
                 </a>
                 </li>
+              <li>
+                <a id="tabHistory" href="#panHistory" data-toggle="tab">
+                  <i class="fa fa-clock-rotate-left"></i>
+                    <span class="dev-detail-tab-name">
+                      <?= lang('device_history_tab_title');?>
+                    </span>
+                </a>
+                </li>
 
               <div class="btn-group pull-right">
                 <button type="button" class="btn btn-default"  style="padding: 10px; min-width: 30px;"
@@ -159,7 +167,12 @@
                 ?>
               </div>
 
-            </div>
+              <div class="tab-pane fade" id="panHistory">
+                <?php
+                  // Include the other page
+                  include 'changeLogCore.php';
+                ?>
+              </div>
             <!-- /.tab-content -->
           </div>
           <!-- /.nav-tabs-custom -->
@@ -596,9 +609,17 @@ function hideDeviceDetailsSkeleton() {
   if (typeof hideSessionsTabSkeleton === 'function') hideSessionsTabSkeleton();
   if (typeof hidePresenceTabSkeleton === 'function') hidePresenceTabSkeleton();
   if (typeof hideEventsTabSkeleton   === 'function') hideEventsTabSkeleton();
+  $('#skel-tab-history').hide();
 }, 15000);
 }
 
+
+// Load history when the tab becomes visible
+$(document).on('shown.bs.tab', 'a[id="tabHistory"]', function() {
+  _histPage  = 0;
+  // loadHistoryData();
+});
+
 </script>
 
 
diff --git a/front/deviceDetailsPresence.php b/front/deviceDetailsPresence.php
index 31d4741f6..36d5915cd 100755
--- a/front/deviceDetailsPresence.php
+++ b/front/deviceDetailsPresence.php
@@ -21,6 +21,11 @@
 
 
 <!-- Calendar -->
+<span class="calendarHelpIcon">
+  <a target="_blank" href="https://docs.netalertx.com/DEVICE_PRESENCE">
+    <i class="fa fa-circle-question"></i>
+  </a>
+</span>
 <div id="calendar">
 </div>
 
diff --git a/front/js/cache.js b/front/js/cache.js
index dcae0d188..8fb675e64 100644
--- a/front/js/cache.js
+++ b/front/js/cache.js
@@ -509,6 +509,45 @@ function getDevDataByMac(macAddress, dbColumn) {
   return null; // Return a default value if MAC address is not found
 }
 
+
+// -----------------------------------------------------------------------------
+// Get a device property using GUID as key and DB column name as parameter
+function getDevDataByGuid(devGUID, dbColumn) {
+
+  const sessionDataKey = CACHE_KEYS.DEVICES_ALL;
+  const devicesCache = getCache(sessionDataKey);
+
+  if (!devicesCache || devicesCache == "") {
+    console.warn(`[getDevDataByGuid] Cache key "${sessionDataKey}" is empty — cache may not be initialized yet.`);
+    return null;
+  }
+
+  const devices = parseDeviceCache(devicesCache);
+
+  if (devices.length === 0) {
+    return null;
+  }
+
+  const guid = devGUID?.toLowerCase();
+  
+
+  for (const device of devices) {
+
+    if ((device["devGUID"] || "").toLowerCase() === guid) {
+
+      if (dbColumn) {
+        return device[dbColumn];
+      }
+
+      return device;
+    }
+  }
+
+  console.error("⚠ Device with GUID not found: " + devGUID);
+  return null;
+}
+
+
 // -----------------------------------------------------------------------------
 /**
  * Fetches the full device list from table_devices.json and stores it in
diff --git a/front/js/common.js b/front/js/common.js
index 006bad8fe..765d34387 100755
--- a/front/js/common.js
+++ b/front/js/common.js
@@ -1175,6 +1175,82 @@ function isSQLQuery(query) {
   return sqlRegex.test(query);
 }
 
+/**
+ * Lazy tab initializer
+ * - Ensures a tab is only initialized once
+ * - Waits until tab is visible in DOM
+ * - Uses polling (compatible with your existing architecture)
+ */
+
+function waitForAppReady(cb) {
+
+  if (window.__appReady) {
+    cb();
+    return;
+  }
+
+  const t = setInterval(() => {
+
+    if (window.__appReady) {
+      clearInterval(t);
+      cb();
+    }
+
+  }, 50);
+}
+
+function initLazyTab(selector, initFn, intervalMs = 200) {
+
+  const stateKey = `__lazy_init_${selector}`;
+  let initialized = false;
+
+  function runner() {
+
+    // prevent duplicate execution
+    if (initialized || window[stateKey]) return;
+
+    const $el = $(selector);
+
+    // ---------------------------------------------------------
+    // CASE 1: element does not exist → standalone page variant
+    // run immediately (no DOM dependency)
+    // ---------------------------------------------------------
+    if (!$el.length) {
+      initialized = true;
+      window[stateKey] = true;
+
+      try {
+        initFn();
+      } catch (e) {
+        console.error("Lazy init (no-element) failed:", selector, e);
+      }
+      return;
+    }
+
+    // ---------------------------------------------------------
+    // CASE 2: element exists AND is visible → run immediately
+    // ---------------------------------------------------------
+    if ($el.is(':visible')) {
+      initialized = true;
+      window[stateKey] = true;
+
+      try {
+        initFn();
+      } catch (e) {
+        console.error("Lazy init (visible) failed:", selector, e);
+      }
+      return;
+    }
+
+    // ---------------------------------------------------------
+    // CASE 3: element exists but hidden → wait for visibility
+    // (tab mode)
+    // ---------------------------------------------------------
+    setTimeout(runner, intervalMs);
+  }
+
+  runner();
+}
 
 // -------------------------------------------------------------------
 // Get corresponding plugin setting object
diff --git a/front/js/ui_components.js b/front/js/ui_components.js
index 917ff8607..8d3bdc1c3 100755
--- a/front/js/ui_components.js
+++ b/front/js/ui_components.js
@@ -1164,5 +1164,5 @@ function getLengthMenu(newEntry) {
   return [values, labels];
 }
 
-
+window.__appReady = true;
 console.log("init ui_components.js")
\ No newline at end of file
diff --git a/front/php/templates/header.php b/front/php/templates/header.php
index 67d453874..577ba986e 100755
--- a/front/php/templates/header.php
+++ b/front/php/templates/header.php
@@ -332,14 +332,14 @@ function update_servertime() {
 
         <!-- Monitoring menu item -->
 
-        <li class=" treeview <?php if (in_array (basename($_SERVER['SCRIPT_NAME']), array('presence.php', 'report.php', 'events.php', 'userNotifications.php' ) ) ){ echo 'active menu-open'; } ?>">
+        <li class=" treeview <?php if (in_array (basename($_SERVER['SCRIPT_NAME']), array('presence.php', 'report.php', 'events.php', 'userNotifications.php', 'changeLog.php' ) ) ){ echo 'active menu-open'; } ?>">
           <a href="#">
           <i class="fa fa-fw fa-chart-bar"></i> <span><?= lang('Navigation_Monitoring');?></span>
             <span class="pull-right-container">
               <i class="fa fa-angle-left pull-right"></i>
             </span>
           </a>
-          <ul class="treeview-menu " style="display: <?php if (in_array (basename($_SERVER['SCRIPT_NAME']), array('presence.php', 'report.php', 'events.php', 'userNotifications.php' ) ) ){ echo 'block'; } else {echo 'none';} ?>;">
+          <ul class="treeview-menu " style="display: <?php if (in_array (basename($_SERVER['SCRIPT_NAME']), array('presence.php', 'report.php', 'events.php', 'userNotifications.php', 'changeLog.php' ) ) ){ echo 'block'; } else {echo 'none';} ?>;">
             <li>
               <a href="presence.php">  <?= lang("Navigation_Presence");?> </a>
             </li>
@@ -352,6 +352,9 @@ function update_servertime() {
             <li>
               <a href="userNotifications.php"> <?= lang("Navigation_Notifications");?> </a>
             </li>
+            <li>
+              <a href="changeLog.php"> <?= lang("Navigation_ChangeHistory");?> </a>
+            </li>
 
           </ul>
         </li>
diff --git a/front/php/templates/language/ar_ar.json b/front/php/templates/language/ar_ar.json
index 1fa339e58..a04dbe680 100644
--- a/front/php/templates/language/ar_ar.json
+++ b/front/php/templates/language/ar_ar.json
@@ -68,6 +68,10 @@
     "DAYS_TO_KEEP_EVENTS_name": "مدة الاحتفاظ بالأحداث",
     "DEEP_SLEEP_description": "",
     "DEEP_SLEEP_name": "",
+    "DEV_HIST_DAYS_description": "",
+    "DEV_HIST_DAYS_name": "",
+    "DEV_HIST_TRACKED_description": "",
+    "DEV_HIST_TRACKED_name": "",
     "DISCOVER_PLUGINS_description": "اكتشاف المكونات الإضافية المتاحة",
     "DISCOVER_PLUGINS_name": "اكتشاف المكونات الإضافية",
     "DevDetail_Children_Title": "علاقات الأطفال",
@@ -525,6 +529,7 @@
     "NETWORK_DEVICE_TYPES_name": "أنواع أجهزة الشبكة",
     "Navigation_About": "حول",
     "Navigation_AppEvents": "أحداث التطبيق",
+    "Navigation_ChangeHistory": "",
     "Navigation_Devices": "الأجهزة",
     "Navigation_Donations": "التبرعات",
     "Navigation_Events": "الأحداث",
@@ -742,6 +747,9 @@
     "VERSION_name": "الإصدار",
     "WF_Action_Add": "إضافة إجراء",
     "WF_Action_field": "حقل الإجراء",
+    "WF_Action_target": "",
+    "WF_Action_target_conditions": "",
+    "WF_Action_token_hint": "",
     "WF_Action_type": "نوع الإجراء",
     "WF_Action_value": "قيمة الإجراء",
     "WF_Actions": "الإجراءات",
@@ -769,7 +777,15 @@
     "add_icon_event_tooltip": "تلميح إضافة أيقونة",
     "add_option_event_tooltip": "تلميح إضافة خيار",
     "copy_icons_event_tooltip": "تلميح نسخ الأيقونات",
+    "device_history_col_changes": "",
+    "device_history_col_dropdown": "",
+    "device_history_col_source": "",
+    "device_history_col_time": "",
+    "device_history_empty_state": "",
+    "device_history_tab_title": "",
+    "device_history_table_title_changes": "",
     "devices_old": "الأجهزة القديمة",
+    "gen_device": "",
     "general_event_description": "وصف الحدث العام",
     "general_event_title": "عنوان الحدث العام",
     "go_to_device_event_tooltip": "انتقل إلى الجهاز",
@@ -804,6 +820,7 @@
     "settings_publishers_label": "الناشرون",
     "settings_readonly": "لا يمكن قراءة أو كتابة <code>app.conf</code>. حاول إعادة تشغيل الحاوية واقرأ <a href=\"https://docs.netalertx.com/FILE_PERMISSIONS\" target=\"_blank\">وثائق أذونات الملفات</a>",
     "settings_saved": "تم حفظ الإعدادات. جارٍ إعادة التحميل... <br/><i class=\"ion ion-ios-loop-strong fa-spin fa-2x fa-fw\"></i> <br/>",
+    "settings_saved_background": "",
     "settings_system_icon": "فا-سوليد فا-جير",
     "settings_system_label": "نظام",
     "settings_update_item_warning": "قم بتحديث القيمة أدناه. احرص على اتباع التنسيق السابق. <b>لم يتم إجراء التحقق.</b>",
diff --git a/front/php/templates/language/ca_ca.json b/front/php/templates/language/ca_ca.json
index 4e28136cd..1c22b95f8 100644
--- a/front/php/templates/language/ca_ca.json
+++ b/front/php/templates/language/ca_ca.json
@@ -68,6 +68,10 @@
     "DAYS_TO_KEEP_EVENTS_name": "Esborrar esdeveniments més vells de",
     "DEEP_SLEEP_description": "Redueix l'ús de la CPU ampliant els temps d'espera inactiu entre els cicles de processament. Quan està activat, les exploracions es poden retardar fins a 1 minut i la interfície d'usuari pot ser menys sensible.",
     "DEEP_SLEEP_name": "Son profund",
+    "DEV_HIST_DAYS_description": "",
+    "DEV_HIST_DAYS_name": "",
+    "DEV_HIST_TRACKED_description": "",
+    "DEV_HIST_TRACKED_name": "",
     "DISCOVER_PLUGINS_description": "Desactiva aquesta opció per accelerar la inicialització i l'estalvi de configuració. Quan està desactivat, els connectors no es descobreixen, i no podeu afegir nous connectors a la configuració <code>LOADED_PLUGINS</code>.",
     "DISCOVER_PLUGINS_name": "Descobreix els plugins",
     "DevDetail_Children_Title": "Relacions filles",
@@ -525,6 +529,7 @@
     "NETWORK_DEVICE_TYPES_name": "Tipus de dispositiu de xarxa",
     "Navigation_About": "Sobre",
     "Navigation_AppEvents": "Esdeveniments de l'Aplicació",
+    "Navigation_ChangeHistory": "",
     "Navigation_Devices": "Dispositius",
     "Navigation_Donations": "Donacions",
     "Navigation_Events": "Esdeveniments",
@@ -742,6 +747,9 @@
     "VERSION_name": "Versió o timestamp",
     "WF_Action_Add": "Afegir Acció",
     "WF_Action_field": "Camp",
+    "WF_Action_target": "",
+    "WF_Action_target_conditions": "",
+    "WF_Action_token_hint": "",
     "WF_Action_type": "Tipus",
     "WF_Action_value": "Valor",
     "WF_Actions": "Accions",
@@ -769,7 +777,15 @@
     "add_icon_event_tooltip": "Afegir nova icona",
     "add_option_event_tooltip": "Afegir nou valor",
     "copy_icons_event_tooltip": "Sobreescriure icones de tots els dispositius amb el mateix tipus de dispositiu",
+    "device_history_col_changes": "",
+    "device_history_col_dropdown": "",
+    "device_history_col_source": "",
+    "device_history_col_time": "",
+    "device_history_empty_state": "",
+    "device_history_tab_title": "",
+    "device_history_table_title_changes": "",
     "devices_old": "Refrescant…",
+    "gen_device": "",
     "general_event_description": "L'esdeveniment que has desencadenat pot trigar un temps fins que acabin els processos de fons. L'execució acabarà una cop buida la cua d'execució (Comprova el registre d'errors <a href='/maintenance.php#tab_Logging'></a> si hi ha problemes). <br/> <br/> Cua d'execució:",
     "general_event_title": "Execució d'un esdeveniment ad-hoc",
     "go_to_device_event_tooltip": "Navegar al dispositiu",
@@ -804,8 +820,9 @@
     "settings_publishers_label": "Editors",
     "settings_readonly": "No es pot LLEGIR o ESCRIURE <code>app.conf</code>. Prova de reiniciar el contenidor i llegir la <a href=\"https://docs.netalertx.com/FILE_PERMISSIONS\" target=\"_blank\"> documentació de permisos d'arxiu</a>",
     "settings_saved": "<br/>Configuració guardada. <br/> Recàrregant ... <br/><i class=\"ion ion-ios-loop-strong fa-spin fa-2x fa-fw\"></i> <br/>",
+    "settings_saved_background": "",
     "settings_system_icon": "fa-solid fa-gear",
     "settings_system_label": "Sistema",
     "settings_update_item_warning": "Actualitza el valor sota. Sigues curós de seguir el format anterior. <b>No hi ha validació.</b>",
     "test_event_tooltip": "Deseu els canvis primer abans de comprovar la configuració."
-}
+}
\ No newline at end of file
diff --git a/front/php/templates/language/cs_cz.json b/front/php/templates/language/cs_cz.json
index a0cfe8325..1f2383084 100644
--- a/front/php/templates/language/cs_cz.json
+++ b/front/php/templates/language/cs_cz.json
@@ -68,6 +68,10 @@
     "DAYS_TO_KEEP_EVENTS_name": "Odstranit události starší než",
     "DEEP_SLEEP_description": "Snižuje využití CPU prodloužením čekacích časů mezi cykly zpracování. Pokud je povoleno, skeny mohou být opožděny až o 1 minutu a UI může být méně responzivní.",
     "DEEP_SLEEP_name": "Hluboký spánek",
+    "DEV_HIST_DAYS_description": "",
+    "DEV_HIST_DAYS_name": "",
+    "DEV_HIST_TRACKED_description": "",
+    "DEV_HIST_TRACKED_name": "",
     "DISCOVER_PLUGINS_description": "Zakažte tuto volbu pro urychlení inicializace a ukládání nastavení. Když je volba zakázána, pluginy nejsou vyhledávány a nemůžete tak přidávat nové pluginy do nastavení <code>LOADED_PLUGINS</code>.",
     "DISCOVER_PLUGINS_name": "Vyhledat pluginy",
     "DevDetail_Children_Title": "Podřízené vazby",
@@ -525,6 +529,7 @@
     "NETWORK_DEVICE_TYPES_name": "",
     "Navigation_About": "",
     "Navigation_AppEvents": "",
+    "Navigation_ChangeHistory": "",
     "Navigation_Devices": "",
     "Navigation_Donations": "",
     "Navigation_Events": "",
@@ -742,6 +747,9 @@
     "VERSION_name": "",
     "WF_Action_Add": "",
     "WF_Action_field": "",
+    "WF_Action_target": "",
+    "WF_Action_target_conditions": "",
+    "WF_Action_token_hint": "",
     "WF_Action_type": "",
     "WF_Action_value": "",
     "WF_Actions": "",
@@ -769,7 +777,15 @@
     "add_icon_event_tooltip": "Přidat novou ikonu",
     "add_option_event_tooltip": "Přidat novou hodnotu",
     "copy_icons_event_tooltip": "Přepiš ikony všech zařízení za stejný typ zařízení",
+    "device_history_col_changes": "",
+    "device_history_col_dropdown": "",
+    "device_history_col_source": "",
+    "device_history_col_time": "",
+    "device_history_empty_state": "",
+    "device_history_tab_title": "",
+    "device_history_table_title_changes": "",
     "devices_old": "Obnovuji…",
+    "gen_device": "",
     "general_event_description": "",
     "general_event_title": "",
     "go_to_device_event_tooltip": "",
@@ -804,8 +820,9 @@
     "settings_publishers_label": "",
     "settings_readonly": "",
     "settings_saved": "",
+    "settings_saved_background": "",
     "settings_system_icon": "",
     "settings_system_label": "",
     "settings_update_item_warning": "",
     "test_event_tooltip": ""
-}
+}
\ No newline at end of file
diff --git a/front/php/templates/language/de_de.json b/front/php/templates/language/de_de.json
index 154dac9ce..df8d6f49d 100644
--- a/front/php/templates/language/de_de.json
+++ b/front/php/templates/language/de_de.json
@@ -72,6 +72,10 @@
     "DAYS_TO_KEEP_EVENTS_name": "Ereignisse löschen, die älter sind als",
     "DEEP_SLEEP_description": "Senkt die CPU-Auslastung, indem die Wartezeiten im Leerlauf zwischen den Verarbeitungszyklen verlängert werden. Bei Aktivierung können sich Scans um bis zu 1 Minute verzögern, und die Benutzeroberfläche reagiert möglicherweise weniger schnell.",
     "DEEP_SLEEP_name": "Tiefschlaf",
+    "DEV_HIST_DAYS_description": "",
+    "DEV_HIST_DAYS_name": "",
+    "DEV_HIST_TRACKED_description": "",
+    "DEV_HIST_TRACKED_name": "",
     "DISCOVER_PLUGINS_description": "Deaktiviere diese Option, um Initialisierung und Speichern der Einstellungen zu beschleunigen. Wenn es deaktiviert ist, werden keine neuen Plugins gefunden und es können keine manuell hinzugefügt werden.",
     "DISCOVER_PLUGINS_name": "Entdecke Erweiterungen",
     "DevDetail_Children_Title": "Beziehungen zu untergeordneten Elementen",
@@ -553,6 +557,7 @@
     "NTFY_icon": "<i class=\"fa fa-terminal\"></i>",
     "Navigation_About": "Über",
     "Navigation_AppEvents": "App-Ereignisse",
+    "Navigation_ChangeHistory": "",
     "Navigation_Devices": "Geräte",
     "Navigation_Donations": "Spenden",
     "Navigation_Events": "Ereignisse",
@@ -813,6 +818,9 @@
     "WEBHOOK_URL_name": "Target URL",
     "WF_Action_Add": "",
     "WF_Action_field": "",
+    "WF_Action_target": "",
+    "WF_Action_target_conditions": "",
+    "WF_Action_token_hint": "",
     "WF_Action_type": "",
     "WF_Action_value": "",
     "WF_Actions": "Aktionen",
@@ -842,7 +850,15 @@
     "add_icon_event_tooltip": "Neues Symbol hinzufügen",
     "add_option_event_tooltip": "Neuen Wert hinzufügen",
     "copy_icons_event_tooltip": "Icons aller Geräte mit demselben Gerätetyp überschreiben",
+    "device_history_col_changes": "",
+    "device_history_col_dropdown": "",
+    "device_history_col_source": "",
+    "device_history_col_time": "",
+    "device_history_empty_state": "",
+    "device_history_tab_title": "",
+    "device_history_table_title_changes": "",
     "devices_old": "Aktualisiert...",
+    "gen_device": "",
     "general_event_description": "Das Ereignis, das Sie ausgelöst haben, könnte eine Weile dauern, bis Hintergrundprozesse abgeschlossen sind. Die Ausführung endet, wenn die unten ausgeführte Warteschlangen abgearbeitet ist. (Siehe <a href='/maintenance.php#tab_Logging'>error log</a>, wenn Probleme auftreten.)<br/> <br/> Ausführungsschlange:",
     "general_event_title": "",
     "go_to_device_event_tooltip": "",
@@ -877,8 +893,9 @@
     "settings_publishers_label": "Veröffentlicher",
     "settings_readonly": "",
     "settings_saved": "<br/>Einstellungen gespeichert. <br/> Wird geladen... <br/><i class=\"ion ion-ios-loop-strong fa-spin fa-2x fa-fw\"></i> <br/>",
+    "settings_saved_background": "",
     "settings_system_icon": "",
     "settings_system_label": "System",
     "settings_update_item_warning": "",
     "test_event_tooltip": "Speichere die Änderungen, bevor Sie die Einstellungen testen."
-}
+}
\ No newline at end of file
diff --git a/front/php/templates/language/en_us.json b/front/php/templates/language/en_us.json
index 63478f085..bc4c54fcc 100755
--- a/front/php/templates/language/en_us.json
+++ b/front/php/templates/language/en_us.json
@@ -68,6 +68,10 @@
     "DAYS_TO_KEEP_EVENTS_name": "Delete events older than",
     "DEEP_SLEEP_description": "Lowers CPU usage by extending idle wait times between processing cycles. When enabled, scans may be delayed by up to 1 minute and the UI might become less responsive.",
     "DEEP_SLEEP_name": "Deep sleep",
+    "DEV_HIST_DAYS_description": "Number of days to retain device field change history. Set to 0 to completely disable the auditing engine and reduce resource usage.",
+    "DEV_HIST_DAYS_name": "Column changes retention (Days)",
+    "DEV_HIST_TRACKED_description": "Devices columns to monitor for changes. Add or remove field names to control what gets audited in the change log.",
+    "DEV_HIST_TRACKED_name": "Tracked column changes",
     "DISCOVER_PLUGINS_description": "Disable this option to speed up initialization and settings saving. When disabled, plugins are not discovered, and you cannot add new plugins to the <code>LOADED_PLUGINS</code> setting.",
     "DISCOVER_PLUGINS_name": "Discover plugins",
     "DevDetail_Children_Title": "Children Relationships",
@@ -525,6 +529,7 @@
     "NETWORK_DEVICE_TYPES_name": "Network device types",
     "Navigation_About": "About",
     "Navigation_AppEvents": "App events",
+    "Navigation_ChangeHistory": "Change log",
     "Navigation_Devices": "Devices",
     "Navigation_Donations": "Donations",
     "Navigation_Events": "Events",
@@ -772,7 +777,15 @@
     "add_icon_event_tooltip": "Add new icon",
     "add_option_event_tooltip": "Add new value",
     "copy_icons_event_tooltip": "Overwrite icons of all devices with the same device type",
+    "device_history_col_changes": "Select which columns are tracked via the <a href=\"/settings.php#DEV_HIST_TRACKED\"  target=\"_blank\"><code>DEV_HIST_TRACKED</code></a> setting.",
+    "device_history_col_dropdown": "Columns",
+    "device_history_col_source": "Modified By",
+    "device_history_col_time": "Timestamp",
+    "device_history_empty_state": "No property changes recorded within the configured retention window.",
+    "device_history_tab_title": "Change log",
+    "device_history_table_title_changes": "Changes",
     "devices_old": "Refreshing…",
+    "gen_device": "Device",
     "general_event_description": "The event you have triggered might take a while until background processes finish. The execution ended once the below execution queue empties (Check the <a href='/maintenance.php#tab_Logging'>error log</a> if you encounter issues). <br/> <br/> Execution queue:",
     "general_event_title": "Executing an ad-hoc event",
     "go_to_device_event_tooltip": "Navigate to the device",
diff --git a/front/php/templates/language/es_es.json b/front/php/templates/language/es_es.json
index 571bed08c..22dc552e9 100644
--- a/front/php/templates/language/es_es.json
+++ b/front/php/templates/language/es_es.json
@@ -70,6 +70,10 @@
     "DAYS_TO_KEEP_EVENTS_name": "Eliminar eventos anteriores a",
     "DEEP_SLEEP_description": "Reduce el uso de la CPU al extender los tiempos de espera entre los ciclos de procesamiento. Cuando se habilita, los análisis pueden retrasarse hasta un minuto y la interfaz de usuario puede volverse menos reactiva.",
     "DEEP_SLEEP_name": "Sueño profundo",
+    "DEV_HIST_DAYS_description": "",
+    "DEV_HIST_DAYS_name": "",
+    "DEV_HIST_TRACKED_description": "",
+    "DEV_HIST_TRACKED_name": "",
     "DISCOVER_PLUGINS_description": "Desactive esta opción para acelerar la inicialización y el ahorro de ajustes. Cuando está desactivado, los plugins no se descubren y no puede añadir nuevos plugins a la configuración <code>LOADED_PLUGINS</code>.",
     "DISCOVER_PLUGINS_name": "Descubrir plugins",
     "DevDetail_Children_Title": "Relaciones hijo",
@@ -551,6 +555,7 @@
     "NTFY_icon": "<i class=\"fa fa-terminal\"></i>",
     "Navigation_About": "Acerca de",
     "Navigation_AppEvents": "Eventos de la aplicación",
+    "Navigation_ChangeHistory": "",
     "Navigation_Devices": "Dispositivos",
     "Navigation_Donations": "Donaciones",
     "Navigation_Events": "Eventos",
@@ -810,6 +815,9 @@
     "WEBHOOK_URL_name": "URL de destino",
     "WF_Action_Add": "Agregar acción",
     "WF_Action_field": "Campo",
+    "WF_Action_target": "",
+    "WF_Action_target_conditions": "",
+    "WF_Action_token_hint": "",
     "WF_Action_type": "Tipo",
     "WF_Action_value": "Valor",
     "WF_Actions": "Acciones",
@@ -840,7 +848,15 @@
     "add_icon_event_tooltip": "Agregar nuevo icono",
     "add_option_event_tooltip": "Añadir nuevo valor",
     "copy_icons_event_tooltip": "Sobrescribir los iconos de todos los dispositivos con el mismo tipo de dispositivo",
+    "device_history_col_changes": "",
+    "device_history_col_dropdown": "",
+    "device_history_col_source": "",
+    "device_history_col_time": "",
+    "device_history_empty_state": "",
+    "device_history_tab_title": "",
+    "device_history_table_title_changes": "",
     "devices_old": "Refrescando . . .",
+    "gen_device": "",
     "general_event_description": "El evento que ha activado puede tardar un poco hasta que finalicen los procesos en segundo plano. La ejecución finalizó una vez que se vacía la cola de ejecución a continuación (consulte el <a href='/maintenance.php#tab_Logging'>registro de errores</a> si encuentra problemas). <br/> <br/> Cola de ejecución:",
     "general_event_title": "Ejecutar un evento ad-hoc",
     "go_to_device_event_tooltip": "Navegar al dispositivo",
@@ -875,8 +891,9 @@
     "settings_publishers_label": "Editores",
     "settings_readonly": "No se puede LEER ni ESCRIBIR <code>app.conf</code>. Intente reiniciar el contenedor y lea la <a href=\"https://docs.netalertx.com/FILE_PERMISSIONS\" target=\"_blank\">documentación de permisos de archivo</a>",
     "settings_saved": "<br/>Ajustes guardados. <br/> Recargando. . . <br/><i class=\"ion ion-ios-loop-strong fa-spin fa-2x fa-fw\"></i> <br/>",
+    "settings_saved_background": "",
     "settings_system_icon": "fa-solid fa-gear",
     "settings_system_label": "Sistema",
     "settings_update_item_warning": "Actualice el valor a continuación. Tenga cuidado de seguir el formato anterior. <b>O la validación no se realiza.</b>",
     "test_event_tooltip": "Guarda tus cambios antes de probar nuevos ajustes."
-}
+}
\ No newline at end of file
diff --git a/front/php/templates/language/fa_fa.json b/front/php/templates/language/fa_fa.json
index 57388f34c..9f8962fcd 100644
--- a/front/php/templates/language/fa_fa.json
+++ b/front/php/templates/language/fa_fa.json
@@ -68,6 +68,10 @@
     "DAYS_TO_KEEP_EVENTS_name": "",
     "DEEP_SLEEP_description": "",
     "DEEP_SLEEP_name": "",
+    "DEV_HIST_DAYS_description": "",
+    "DEV_HIST_DAYS_name": "",
+    "DEV_HIST_TRACKED_description": "",
+    "DEV_HIST_TRACKED_name": "",
     "DISCOVER_PLUGINS_description": "",
     "DISCOVER_PLUGINS_name": "",
     "DevDetail_Children_Title": "",
@@ -525,6 +529,7 @@
     "NETWORK_DEVICE_TYPES_name": "",
     "Navigation_About": "",
     "Navigation_AppEvents": "",
+    "Navigation_ChangeHistory": "",
     "Navigation_Devices": "",
     "Navigation_Donations": "",
     "Navigation_Events": "",
@@ -742,6 +747,9 @@
     "VERSION_name": "",
     "WF_Action_Add": "",
     "WF_Action_field": "",
+    "WF_Action_target": "",
+    "WF_Action_target_conditions": "",
+    "WF_Action_token_hint": "",
     "WF_Action_type": "",
     "WF_Action_value": "",
     "WF_Actions": "",
@@ -769,7 +777,15 @@
     "add_icon_event_tooltip": "",
     "add_option_event_tooltip": "",
     "copy_icons_event_tooltip": "",
+    "device_history_col_changes": "",
+    "device_history_col_dropdown": "",
+    "device_history_col_source": "",
+    "device_history_col_time": "",
+    "device_history_empty_state": "",
+    "device_history_tab_title": "",
+    "device_history_table_title_changes": "",
     "devices_old": "",
+    "gen_device": "",
     "general_event_description": "",
     "general_event_title": "",
     "go_to_device_event_tooltip": "",
@@ -804,6 +820,7 @@
     "settings_publishers_label": "",
     "settings_readonly": "",
     "settings_saved": "",
+    "settings_saved_background": "",
     "settings_system_icon": "",
     "settings_system_label": "",
     "settings_update_item_warning": "",
diff --git a/front/php/templates/language/fi_fi.json b/front/php/templates/language/fi_fi.json
index db1019341..5a2fda63b 100644
--- a/front/php/templates/language/fi_fi.json
+++ b/front/php/templates/language/fi_fi.json
@@ -68,6 +68,10 @@
     "DAYS_TO_KEEP_EVENTS_name": "",
     "DEEP_SLEEP_description": "",
     "DEEP_SLEEP_name": "",
+    "DEV_HIST_DAYS_description": "",
+    "DEV_HIST_DAYS_name": "",
+    "DEV_HIST_TRACKED_description": "",
+    "DEV_HIST_TRACKED_name": "",
     "DISCOVER_PLUGINS_description": "",
     "DISCOVER_PLUGINS_name": "",
     "DevDetail_Children_Title": "",
@@ -525,6 +529,7 @@
     "NETWORK_DEVICE_TYPES_name": "",
     "Navigation_About": "",
     "Navigation_AppEvents": "",
+    "Navigation_ChangeHistory": "",
     "Navigation_Devices": "",
     "Navigation_Donations": "",
     "Navigation_Events": "",
@@ -742,6 +747,9 @@
     "VERSION_name": "",
     "WF_Action_Add": "",
     "WF_Action_field": "",
+    "WF_Action_target": "",
+    "WF_Action_target_conditions": "",
+    "WF_Action_token_hint": "",
     "WF_Action_type": "",
     "WF_Action_value": "",
     "WF_Actions": "",
@@ -769,7 +777,15 @@
     "add_icon_event_tooltip": "",
     "add_option_event_tooltip": "",
     "copy_icons_event_tooltip": "",
+    "device_history_col_changes": "",
+    "device_history_col_dropdown": "",
+    "device_history_col_source": "",
+    "device_history_col_time": "",
+    "device_history_empty_state": "",
+    "device_history_tab_title": "",
+    "device_history_table_title_changes": "",
     "devices_old": "",
+    "gen_device": "",
     "general_event_description": "",
     "general_event_title": "",
     "go_to_device_event_tooltip": "",
@@ -804,6 +820,7 @@
     "settings_publishers_label": "",
     "settings_readonly": "",
     "settings_saved": "",
+    "settings_saved_background": "",
     "settings_system_icon": "",
     "settings_system_label": "",
     "settings_update_item_warning": "",
diff --git a/front/php/templates/language/fr_fr.json b/front/php/templates/language/fr_fr.json
index 75ee77ee0..6907d66f0 100644
--- a/front/php/templates/language/fr_fr.json
+++ b/front/php/templates/language/fr_fr.json
@@ -68,6 +68,10 @@
     "DAYS_TO_KEEP_EVENTS_name": "Supprimer les événements plus anciens que",
     "DEEP_SLEEP_description": "Diminue l'utilisation du processeur, en augmentant les temps de repos entre les cycles de calcul. Quand activé, les scans peuvent être retardés jusqu'à 1 minute, et l'interface peut être moins réactive.",
     "DEEP_SLEEP_name": "Veille profonde",
+    "DEV_HIST_DAYS_description": "",
+    "DEV_HIST_DAYS_name": "",
+    "DEV_HIST_TRACKED_description": "",
+    "DEV_HIST_TRACKED_name": "",
     "DISCOVER_PLUGINS_description": "Désactivez cette option pour accélérer le démarrage et l'enregistrement de paramètres. Quand elle est désactivée, les plugins ne sont pas découverts, et vous ne pouvez près ajouter de nouveaux plugins au paramètre <code>LOADED_PLUGINS</code>.",
     "DISCOVER_PLUGINS_name": "Découvrir des plugins",
     "DevDetail_Children_Title": "Relations avec les éléments inférieurs",
@@ -525,6 +529,7 @@
     "NETWORK_DEVICE_TYPES_name": "Type d'appareil réseau",
     "Navigation_About": "À propos",
     "Navigation_AppEvents": "Événements de l'appli",
+    "Navigation_ChangeHistory": "",
     "Navigation_Devices": "Appareils",
     "Navigation_Donations": "Dons",
     "Navigation_Events": "Évènements",
@@ -742,6 +747,9 @@
     "VERSION_name": "Version ou Timestamp",
     "WF_Action_Add": "Ajouter une action",
     "WF_Action_field": "Champ",
+    "WF_Action_target": "Appliquer l'action à",
+    "WF_Action_target_conditions": "Cibler des conditions de l'appareil",
+    "WF_Action_token_hint": "Utiliser <code>{{trigger.COLUMN}}</code> pour référencer l'appareil déclencheur (par ex. <code>{{trigger.devLastIP}}</code>, <code>{{trigger.devMac}}</code>)",
     "WF_Action_type": "Type",
     "WF_Action_value": "Valeur",
     "WF_Actions": "Actions",
@@ -769,7 +777,15 @@
     "add_icon_event_tooltip": "Ajouter une nouvelle icône",
     "add_option_event_tooltip": "Ajouter une nouvelle valeur",
     "copy_icons_event_tooltip": "Remplace les icônes de tous les appareils du même type",
+    "device_history_col_changes": "",
+    "device_history_col_dropdown": "",
+    "device_history_col_source": "",
+    "device_history_col_time": "",
+    "device_history_empty_state": "",
+    "device_history_tab_title": "",
+    "device_history_table_title_changes": "",
     "devices_old": "Rafraichissement…",
+    "gen_device": "",
     "general_event_description": "L'événement que vous avez lancé peut prendre du temps avant que les tâches de fond ne soit terminées. La durée d'exécution finira une fois que la file d'exécution ci-dessous sera vide (consulter les <a href='/maintenance.php#tab_Logging'>journaux d'erreur</a> si vous rencontrez des erreurs). <br/> <br/> File d'exécution :",
     "general_event_title": "Lancement d'un événement sur mesure",
     "go_to_device_event_tooltip": "Naviguer vers cet appareil",
@@ -804,12 +820,9 @@
     "settings_publishers_label": "Passerelles de publication",
     "settings_readonly": "Impossible de LIRE ou ÉCRIRE <code>app.conf</code>. Essayer de relancer le container et lire la <a href=\"https://docs.netalertx.com/FILE_PERMISSIONS\" target=\"_blank\">documentation sur les droits des fichiers</a>",
     "settings_saved": "<br/>Paramètres enregistrés. <br/> Rechargement... <br/><i class=\"ion ion-ios-loop-strong fa-spin fa-2x fa-fw\"></i> <br/>",
+    "settings_saved_background": "Paramètres enregistrés. Les changements sont en cours d'application en arrière-plan.",
     "settings_system_icon": "fa-solid fa-gear",
     "settings_system_label": "Système",
     "settings_update_item_warning": "Mettre à jour la valeur ci-dessous. Veillez à bien suivre le même format qu'auparavant. <b>Il n'y a pas de pas de contrôle.</b>",
-    "test_event_tooltip": "Enregistrer d'abord vos modifications avant de tester vôtre paramétrage.",
-    "WF_Action_target": "Appliquer l'action à",
-    "WF_Action_target_conditions": "Cibler des conditions de l'appareil",
-    "WF_Action_token_hint": "Utiliser <code>{{trigger.COLUMN}}</code> pour référencer l'appareil déclencheur (par ex. <code>{{trigger.devLastIP}}</code>, <code>{{trigger.devMac}}</code>)",
-    "settings_saved_background": "Paramètres enregistrés. Les changements sont en cours d'application en arrière-plan."
-}
+    "test_event_tooltip": "Enregistrer d'abord vos modifications avant de tester vôtre paramétrage."
+}
\ No newline at end of file
diff --git a/front/php/templates/language/he_il.json b/front/php/templates/language/he_il.json
index db1019341..5a2fda63b 100644
--- a/front/php/templates/language/he_il.json
+++ b/front/php/templates/language/he_il.json
@@ -68,6 +68,10 @@
     "DAYS_TO_KEEP_EVENTS_name": "",
     "DEEP_SLEEP_description": "",
     "DEEP_SLEEP_name": "",
+    "DEV_HIST_DAYS_description": "",
+    "DEV_HIST_DAYS_name": "",
+    "DEV_HIST_TRACKED_description": "",
+    "DEV_HIST_TRACKED_name": "",
     "DISCOVER_PLUGINS_description": "",
     "DISCOVER_PLUGINS_name": "",
     "DevDetail_Children_Title": "",
@@ -525,6 +529,7 @@
     "NETWORK_DEVICE_TYPES_name": "",
     "Navigation_About": "",
     "Navigation_AppEvents": "",
+    "Navigation_ChangeHistory": "",
     "Navigation_Devices": "",
     "Navigation_Donations": "",
     "Navigation_Events": "",
@@ -742,6 +747,9 @@
     "VERSION_name": "",
     "WF_Action_Add": "",
     "WF_Action_field": "",
+    "WF_Action_target": "",
+    "WF_Action_target_conditions": "",
+    "WF_Action_token_hint": "",
     "WF_Action_type": "",
     "WF_Action_value": "",
     "WF_Actions": "",
@@ -769,7 +777,15 @@
     "add_icon_event_tooltip": "",
     "add_option_event_tooltip": "",
     "copy_icons_event_tooltip": "",
+    "device_history_col_changes": "",
+    "device_history_col_dropdown": "",
+    "device_history_col_source": "",
+    "device_history_col_time": "",
+    "device_history_empty_state": "",
+    "device_history_tab_title": "",
+    "device_history_table_title_changes": "",
     "devices_old": "",
+    "gen_device": "",
     "general_event_description": "",
     "general_event_title": "",
     "go_to_device_event_tooltip": "",
@@ -804,6 +820,7 @@
     "settings_publishers_label": "",
     "settings_readonly": "",
     "settings_saved": "",
+    "settings_saved_background": "",
     "settings_system_icon": "",
     "settings_system_label": "",
     "settings_update_item_warning": "",
diff --git a/front/php/templates/language/id_id.json b/front/php/templates/language/id_id.json
index db1019341..5a2fda63b 100644
--- a/front/php/templates/language/id_id.json
+++ b/front/php/templates/language/id_id.json
@@ -68,6 +68,10 @@
     "DAYS_TO_KEEP_EVENTS_name": "",
     "DEEP_SLEEP_description": "",
     "DEEP_SLEEP_name": "",
+    "DEV_HIST_DAYS_description": "",
+    "DEV_HIST_DAYS_name": "",
+    "DEV_HIST_TRACKED_description": "",
+    "DEV_HIST_TRACKED_name": "",
     "DISCOVER_PLUGINS_description": "",
     "DISCOVER_PLUGINS_name": "",
     "DevDetail_Children_Title": "",
@@ -525,6 +529,7 @@
     "NETWORK_DEVICE_TYPES_name": "",
     "Navigation_About": "",
     "Navigation_AppEvents": "",
+    "Navigation_ChangeHistory": "",
     "Navigation_Devices": "",
     "Navigation_Donations": "",
     "Navigation_Events": "",
@@ -742,6 +747,9 @@
     "VERSION_name": "",
     "WF_Action_Add": "",
     "WF_Action_field": "",
+    "WF_Action_target": "",
+    "WF_Action_target_conditions": "",
+    "WF_Action_token_hint": "",
     "WF_Action_type": "",
     "WF_Action_value": "",
     "WF_Actions": "",
@@ -769,7 +777,15 @@
     "add_icon_event_tooltip": "",
     "add_option_event_tooltip": "",
     "copy_icons_event_tooltip": "",
+    "device_history_col_changes": "",
+    "device_history_col_dropdown": "",
+    "device_history_col_source": "",
+    "device_history_col_time": "",
+    "device_history_empty_state": "",
+    "device_history_tab_title": "",
+    "device_history_table_title_changes": "",
     "devices_old": "",
+    "gen_device": "",
     "general_event_description": "",
     "general_event_title": "",
     "go_to_device_event_tooltip": "",
@@ -804,6 +820,7 @@
     "settings_publishers_label": "",
     "settings_readonly": "",
     "settings_saved": "",
+    "settings_saved_background": "",
     "settings_system_icon": "",
     "settings_system_label": "",
     "settings_update_item_warning": "",
diff --git a/front/php/templates/language/it_it.json b/front/php/templates/language/it_it.json
index a9ec3324f..0dbd404ee 100644
--- a/front/php/templates/language/it_it.json
+++ b/front/php/templates/language/it_it.json
@@ -68,6 +68,10 @@
     "DAYS_TO_KEEP_EVENTS_name": "Elimina eventi più vecchi di",
     "DEEP_SLEEP_description": "Riduce l'utilizzo della CPU estendendo i tempi di attesa tra i cicli di elaborazione. Quando questa opzione è abilitata, le scansioni potrebbero subire ritardi fino a 1 minuto e l'interfaccia utente potrebbe risultare meno reattiva.",
     "DEEP_SLEEP_name": "Sonno profondo",
+    "DEV_HIST_DAYS_description": "",
+    "DEV_HIST_DAYS_name": "",
+    "DEV_HIST_TRACKED_description": "",
+    "DEV_HIST_TRACKED_name": "",
     "DISCOVER_PLUGINS_description": "Disattiva questa opzione per velocizzare l'inizializzazione e il salvataggio delle impostazioni. Quando è disattivata, i plugin non vengono scoperti e non puoi aggiungere nuovi plugin all'impostazione <code>LOADED_PLUGINS</code>.",
     "DISCOVER_PLUGINS_name": "Scopri i plugin",
     "DevDetail_Children_Title": "Relazioni tra figli",
@@ -525,6 +529,7 @@
     "NETWORK_DEVICE_TYPES_name": "Tipi di dispositivi di rete",
     "Navigation_About": "Informazioni su",
     "Navigation_AppEvents": "Eventi app",
+    "Navigation_ChangeHistory": "",
     "Navigation_Devices": "Dispositivi",
     "Navigation_Donations": "Donazioni",
     "Navigation_Events": "Eventi",
@@ -742,6 +747,9 @@
     "VERSION_name": "Versione o marca temporale",
     "WF_Action_Add": "Aggiungi azione",
     "WF_Action_field": "Campo",
+    "WF_Action_target": "Applica azione a",
+    "WF_Action_target_conditions": "Stato dispositivi di destinazione",
+    "WF_Action_token_hint": "Usa <code>{{trigger.COLUMN}}</code> per fare riferimento al dispositivo di attivazione (ad esempio <code>{{trigger.devLastIP}}</code>, <code>{{trigger.devMac}}</code>)",
     "WF_Action_type": "Tipo",
     "WF_Action_value": "Valore",
     "WF_Actions": "Azioni",
@@ -769,7 +777,15 @@
     "add_icon_event_tooltip": "Aggiungi nuova icona",
     "add_option_event_tooltip": "Aggiungi nuovo valore",
     "copy_icons_event_tooltip": "Sovrascrivi le icone di tutti i dispositivi con lo stesso tipo di dispositivo",
+    "device_history_col_changes": "",
+    "device_history_col_dropdown": "",
+    "device_history_col_source": "",
+    "device_history_col_time": "",
+    "device_history_empty_state": "",
+    "device_history_tab_title": "",
+    "device_history_table_title_changes": "",
     "devices_old": "Aggiornamento…",
+    "gen_device": "",
     "general_event_description": "L'evento che hai attivato potrebbe richiedere del tempo prima che i processi in background vengano completati. L'esecuzione è terminata una volta che la coda di esecuzione sottostante si è svuotata (controlla il <a href='/maintenance.php#tab_Logging'>log degli errori</a> se riscontri problemi). <br/> <br/> Coda di esecuzione:",
     "general_event_title": "Esecuzione di un evento ad-hoc",
     "go_to_device_event_tooltip": "Naviga al dispositivo",
@@ -804,12 +820,9 @@
     "settings_publishers_label": "Editori",
     "settings_readonly": "Impossibile LEGGERE o SCRIVERE <code>app.conf</code>. Prova a riavviare il contenitore e leggi la <a href=\"https://docs.netalertx.com/FILE_PERMISSIONS\" target=\"_blank\">documentazione sulle autorizzazioni dei file</a>",
     "settings_saved": "<br/>Impostazioni salvate. <br/> Aggiornamento in corso… <br/> <i class=\"ion ion-ios-loop-strong fa-spin fa-2x fa-fw\"></i> <br/>",
+    "settings_saved_background": "Impostazioni salvate. Le modifiche vengono applicate in background.",
     "settings_system_icon": "fa-solid fa-gear",
     "settings_system_label": "Sistema",
     "settings_update_item_warning": "Aggiorna il valore qui sotto. Fai attenzione a seguire il formato precedente. <b>La convalida non viene eseguita.</b>",
-    "test_event_tooltip": "Salva le modifiche prima di provare le nuove impostazioni.",
-    "WF_Action_target": "Applica azione a",
-    "WF_Action_target_conditions": "Stato dispositivi di destinazione",
-    "WF_Action_token_hint": "Usa <code>{{trigger.COLUMN}}</code> per fare riferimento al dispositivo di attivazione (ad esempio <code>{{trigger.devLastIP}}</code>, <code>{{trigger.devMac}}</code>)",
-    "settings_saved_background": "Impostazioni salvate. Le modifiche vengono applicate in background."
-}
+    "test_event_tooltip": "Salva le modifiche prima di provare le nuove impostazioni."
+}
\ No newline at end of file
diff --git a/front/php/templates/language/ja_jp.json b/front/php/templates/language/ja_jp.json
index ee0be090c..2aa31f983 100644
--- a/front/php/templates/language/ja_jp.json
+++ b/front/php/templates/language/ja_jp.json
@@ -68,6 +68,10 @@
     "DAYS_TO_KEEP_EVENTS_name": "古いイベントの削除",
     "DEEP_SLEEP_description": "処理サイクル間のアイドル待機時間を延長することで、CPU使用率を低減します。この機能を有効にすると、スキャンが最大1分間遅延したり、UIの反応が悪くなったりする場合があります。",
     "DEEP_SLEEP_name": "ディープスリープ",
+    "DEV_HIST_DAYS_description": "",
+    "DEV_HIST_DAYS_name": "",
+    "DEV_HIST_TRACKED_description": "",
+    "DEV_HIST_TRACKED_name": "",
     "DISCOVER_PLUGINS_description": "このオプションを無効にすると、初期化と設定の保存が高速化されます。無効にした場合、プラグインは検出されず、<code>LOADED_PLUGINS</code> 設定に新しいプラグインを追加することはできません。",
     "DISCOVER_PLUGINS_name": "プラグインの検出",
     "DevDetail_Children_Title": "親子関係",
@@ -525,6 +529,7 @@
     "NETWORK_DEVICE_TYPES_name": "ネットワーク機器の種別",
     "Navigation_About": "概要",
     "Navigation_AppEvents": "アプリイベント",
+    "Navigation_ChangeHistory": "",
     "Navigation_Devices": "デバイス",
     "Navigation_Donations": "寄付",
     "Navigation_Events": "イベント",
@@ -742,6 +747,9 @@
     "VERSION_name": "バージョンまたはタイムスタンプ",
     "WF_Action_Add": "アクションを追加",
     "WF_Action_field": "フィールド",
+    "WF_Action_target": "",
+    "WF_Action_target_conditions": "",
+    "WF_Action_token_hint": "",
     "WF_Action_type": "種別",
     "WF_Action_value": "値",
     "WF_Actions": "アクション",
@@ -769,7 +777,15 @@
     "add_icon_event_tooltip": "アイコンの追加",
     "add_option_event_tooltip": "値の追加",
     "copy_icons_event_tooltip": "同じ種別の全デバイスにアイコンを上書き",
+    "device_history_col_changes": "",
+    "device_history_col_dropdown": "",
+    "device_history_col_source": "",
+    "device_history_col_time": "",
+    "device_history_empty_state": "",
+    "device_history_tab_title": "",
+    "device_history_table_title_changes": "",
     "devices_old": "リフレッシュ中…",
+    "gen_device": "",
     "general_event_description": "トリガーされたイベントは、バックグラウンド処理が完了するまで時間がかかる場合があります。以下の実行キューが空になると処理は終了します（問題が発生した場合は <a href='/maintenance.php#tab_Logging'>エラーログ</a> を確認してください）。<br/> <br/> 実行キュー:",
     "general_event_title": "アドホックイベントの実行",
     "go_to_device_event_tooltip": "デバイスに移動",
@@ -804,6 +820,7 @@
     "settings_publishers_label": "パブリッシャー",
     "settings_readonly": "<code>app.conf</code> の読み取りまたは書き込みができません。コンテナを再起動し、<a href=\"https://docs.netalertx.com/FILE_PERMISSIONS\" target=\"_blank\">ファイルの権限に関するドキュメント</a> を参照してください",
     "settings_saved": "<br/>設定が保存されました。<br/> 再読込中…<br/><i class=\"ion ion-ios-loop-strong fa-spin fa-2x fa-fw\"></i><br/>",
+    "settings_saved_background": "",
     "settings_system_icon": "fa-solid fa-gear",
     "settings_system_label": "システム",
     "settings_update_item_warning": "以下の値を更新してください。以前のフォーマットに従うよう注意してください。<b>検証は行われません。</b>",
diff --git a/front/php/templates/language/nb_no.json b/front/php/templates/language/nb_no.json
index 535c877d7..8862e0091 100644
--- a/front/php/templates/language/nb_no.json
+++ b/front/php/templates/language/nb_no.json
@@ -68,6 +68,10 @@
     "DAYS_TO_KEEP_EVENTS_name": "Slett hendelser eldre enn",
     "DEEP_SLEEP_description": "",
     "DEEP_SLEEP_name": "",
+    "DEV_HIST_DAYS_description": "",
+    "DEV_HIST_DAYS_name": "",
+    "DEV_HIST_TRACKED_description": "",
+    "DEV_HIST_TRACKED_name": "",
     "DISCOVER_PLUGINS_description": "",
     "DISCOVER_PLUGINS_name": "",
     "DevDetail_Children_Title": "",
@@ -525,6 +529,7 @@
     "NETWORK_DEVICE_TYPES_name": "Nettverksenhetstyper",
     "Navigation_About": "Om",
     "Navigation_AppEvents": "",
+    "Navigation_ChangeHistory": "",
     "Navigation_Devices": "Enheter",
     "Navigation_Donations": "Donasjoner",
     "Navigation_Events": "Hendelser",
@@ -742,6 +747,9 @@
     "VERSION_name": "",
     "WF_Action_Add": "",
     "WF_Action_field": "",
+    "WF_Action_target": "",
+    "WF_Action_target_conditions": "",
+    "WF_Action_token_hint": "",
     "WF_Action_type": "",
     "WF_Action_value": "",
     "WF_Actions": "",
@@ -769,7 +777,15 @@
     "add_icon_event_tooltip": "",
     "add_option_event_tooltip": "",
     "copy_icons_event_tooltip": "",
+    "device_history_col_changes": "",
+    "device_history_col_dropdown": "",
+    "device_history_col_source": "",
+    "device_history_col_time": "",
+    "device_history_empty_state": "",
+    "device_history_tab_title": "",
+    "device_history_table_title_changes": "",
     "devices_old": "Oppdaterer...",
+    "gen_device": "",
     "general_event_description": "Hendelsen du har utløst kan ta en stund til før bakgrunnsprosesser er ferdig. Utførelsen ble avsluttet når utførelseskøen nedenfor tømmes (sjekk <a  href='/maintenance.php#tab_Logging'>Feillogg</a> Hvis du møter problemer). <br/> <br/> Utførelseskø:",
     "general_event_title": "Utfører en ad-hoc hendelse",
     "go_to_device_event_tooltip": "",
@@ -804,6 +820,7 @@
     "settings_publishers_label": "Utgivere",
     "settings_readonly": "",
     "settings_saved": "<br/>Innstillinger lagret. <br/> Laster inn på nytt... <br/><i class=\"ion ion-ios-loop-strong fa-spin fa-2x fa-fw\"></i><br/>",
+    "settings_saved_background": "",
     "settings_system_icon": "fa-solid fa-gear",
     "settings_system_label": "System",
     "settings_update_item_warning": "Oppdater verdien nedenfor. Pass på å følge forrige format. <b>Validering etterpå utføres ikke.</b>",
diff --git a/front/php/templates/language/pl_pl.json b/front/php/templates/language/pl_pl.json
index e28a2a31e..23ffd4dec 100644
--- a/front/php/templates/language/pl_pl.json
+++ b/front/php/templates/language/pl_pl.json
@@ -68,6 +68,10 @@
     "DAYS_TO_KEEP_EVENTS_name": "Usuń zdarzenia starsze niż",
     "DEEP_SLEEP_description": "",
     "DEEP_SLEEP_name": "",
+    "DEV_HIST_DAYS_description": "",
+    "DEV_HIST_DAYS_name": "",
+    "DEV_HIST_TRACKED_description": "",
+    "DEV_HIST_TRACKED_name": "",
     "DISCOVER_PLUGINS_description": "Wyłącz tę opcję, aby przyspieszyć inicjalizację i zapisywanie ustawień. Po wyłączeniu wtyczki nie są wykrywane i nie można dodawać nowych wtyczek do ustawienia <code>LOADED_PLUGINS</code>.",
     "DISCOVER_PLUGINS_name": "Wykryj wtyczki",
     "DevDetail_Children_Title": "",
@@ -525,6 +529,7 @@
     "NETWORK_DEVICE_TYPES_name": "Typy urządzeń sieciowych",
     "Navigation_About": "Informacje o",
     "Navigation_AppEvents": "Zdarzenia aplikacji",
+    "Navigation_ChangeHistory": "",
     "Navigation_Devices": "Urządzenia",
     "Navigation_Donations": "Darowizny",
     "Navigation_Events": "Zdarzenia",
@@ -742,6 +747,9 @@
     "VERSION_name": "Wersja lub sygnatura czasowa",
     "WF_Action_Add": "Dodaj akcję",
     "WF_Action_field": "Pole",
+    "WF_Action_target": "",
+    "WF_Action_target_conditions": "",
+    "WF_Action_token_hint": "",
     "WF_Action_type": "Typ",
     "WF_Action_value": "Wartość",
     "WF_Actions": "Akcja",
@@ -769,7 +777,15 @@
     "add_icon_event_tooltip": "Dodaj nową ikonę",
     "add_option_event_tooltip": "Dodaj nową wartość",
     "copy_icons_event_tooltip": "Nadpisz ikony wszystkich urządzeń tego samego typu",
+    "device_history_col_changes": "",
+    "device_history_col_dropdown": "",
+    "device_history_col_source": "",
+    "device_history_col_time": "",
+    "device_history_empty_state": "",
+    "device_history_tab_title": "",
+    "device_history_table_title_changes": "",
     "devices_old": "Odświeżanie…",
+    "gen_device": "",
     "general_event_description": "Zdarzenie, które wywołałeś, może potrwać chwilę, zanim zakończą się procesy w tle. Wykonanie zostanie zakończone, gdy poniższa kolejka wykonania zostanie opróżniona (jeśli napotkasz problemy, sprawdź <a href='/maintenance.php#tab_Logging'>dziennik błędów</a>). <br/><br/>Kolejka wykonania:",
     "general_event_title": "Wykonywanie zdarzenia ad-hoc",
     "go_to_device_event_tooltip": "",
@@ -804,6 +820,7 @@
     "settings_publishers_label": "Wydawcy",
     "settings_readonly": "Nie można ODCZYTAĆ ani ZAPISAĆ pliku <code>app.conf</code>. Spróbuj ponownie uruchomić kontener i zapoznaj się z <a href=\"https://docs.netalertx.com/FILE_PERMISSIONS\" target=\"_blank\">dokumentacją dotyczącą uprawnień do plików</a>",
     "settings_saved": "<br/>Ustawienia zapisane. <br/>Trwa ponowne ładowanie… <br/><i class=\"ion ion-ios-loop-strong fa-spin fa-2x fa-fw\"></i> <br/>",
+    "settings_saved_background": "",
     "settings_system_icon": "fa-solid fa-gear",
     "settings_system_label": "System",
     "settings_update_item_warning": "Zaktualizuj wartość poniżej. Uważaj, aby zachować poprzedni format. <b>Walidacja nie jest wykonywana.</b>",
diff --git a/front/php/templates/language/pt_br.json b/front/php/templates/language/pt_br.json
index 1b1f148fb..4f68ca7e3 100644
--- a/front/php/templates/language/pt_br.json
+++ b/front/php/templates/language/pt_br.json
@@ -68,6 +68,10 @@
     "DAYS_TO_KEEP_EVENTS_name": "Excluir eventos mais antigos que",
     "DEEP_SLEEP_description": "",
     "DEEP_SLEEP_name": "",
+    "DEV_HIST_DAYS_description": "",
+    "DEV_HIST_DAYS_name": "",
+    "DEV_HIST_TRACKED_description": "",
+    "DEV_HIST_TRACKED_name": "",
     "DISCOVER_PLUGINS_description": "Desative esta opção para acelerar a inicialização e a gravação de definições. Quando desativada, os plug-ins não são descobertos e não é possível adicionar novos plug-ins à definição<code>LOADED_PLUGINS</code>.",
     "DISCOVER_PLUGINS_name": "Descobrir plugins",
     "DevDetail_Children_Title": "",
@@ -525,6 +529,7 @@
     "NETWORK_DEVICE_TYPES_name": "Tipos de dispositivo de rede",
     "Navigation_About": "Sobre a",
     "Navigation_AppEvents": "",
+    "Navigation_ChangeHistory": "",
     "Navigation_Devices": "Dispositivos",
     "Navigation_Donations": "Doações",
     "Navigation_Events": "Eventos",
@@ -742,6 +747,9 @@
     "VERSION_name": "",
     "WF_Action_Add": "",
     "WF_Action_field": "",
+    "WF_Action_target": "",
+    "WF_Action_target_conditions": "",
+    "WF_Action_token_hint": "",
     "WF_Action_type": "",
     "WF_Action_value": "",
     "WF_Actions": "",
@@ -769,7 +777,15 @@
     "add_icon_event_tooltip": "",
     "add_option_event_tooltip": "",
     "copy_icons_event_tooltip": "",
+    "device_history_col_changes": "",
+    "device_history_col_dropdown": "",
+    "device_history_col_source": "",
+    "device_history_col_time": "",
+    "device_history_empty_state": "",
+    "device_history_tab_title": "",
+    "device_history_table_title_changes": "",
     "devices_old": "",
+    "gen_device": "",
     "general_event_description": "",
     "general_event_title": "",
     "go_to_device_event_tooltip": "",
@@ -804,6 +820,7 @@
     "settings_publishers_label": "",
     "settings_readonly": "",
     "settings_saved": "",
+    "settings_saved_background": "",
     "settings_system_icon": "",
     "settings_system_label": "",
     "settings_update_item_warning": "",
diff --git a/front/php/templates/language/pt_pt.json b/front/php/templates/language/pt_pt.json
index a56293256..d667b5926 100644
--- a/front/php/templates/language/pt_pt.json
+++ b/front/php/templates/language/pt_pt.json
@@ -68,6 +68,10 @@
     "DAYS_TO_KEEP_EVENTS_name": "Apagar eventos mais antigos que",
     "DEEP_SLEEP_description": "Diminui a utilização do CPU ao prolongar tempos de espera ociosos entre ciclos de processamento. Quando ativo, análises podem ser atrasadas por até 1 minuto e o UI pode ficar menos responsivo.",
     "DEEP_SLEEP_name": "Sleep profundo",
+    "DEV_HIST_DAYS_description": "",
+    "DEV_HIST_DAYS_name": "",
+    "DEV_HIST_TRACKED_description": "",
+    "DEV_HIST_TRACKED_name": "",
     "DISCOVER_PLUGINS_description": "Desative esta opção para acelerar a inicialização e a gravação de definições. Quando desativada, os plug-ins não são descobertos e não é possível adicionar novos plug-ins à definição <code>LOADED_PLUGINS</code>.",
     "DISCOVER_PLUGINS_name": "Descobrir plugins",
     "DevDetail_Children_Title": "Relacionamentos de crianças",
@@ -525,6 +529,7 @@
     "NETWORK_DEVICE_TYPES_name": "Tipos de dispositivo de rede",
     "Navigation_About": "Sobre a",
     "Navigation_AppEvents": "Eventos de aplicações",
+    "Navigation_ChangeHistory": "",
     "Navigation_Devices": "Dispositivos",
     "Navigation_Donations": "Doações",
     "Navigation_Events": "Eventos",
@@ -742,6 +747,9 @@
     "VERSION_name": "Versão ou data e hora",
     "WF_Action_Add": "Adicionar Ação",
     "WF_Action_field": "Campo",
+    "WF_Action_target": "",
+    "WF_Action_target_conditions": "",
+    "WF_Action_token_hint": "",
     "WF_Action_type": "Tipo",
     "WF_Action_value": "Valor",
     "WF_Actions": "Ações",
@@ -769,7 +777,15 @@
     "add_icon_event_tooltip": "Adicionar novo ícone",
     "add_option_event_tooltip": "Adicionar novo valor",
     "copy_icons_event_tooltip": "Sobrescrever ícones de todos os dispositivos com o mesmo tipo de dispositivo",
+    "device_history_col_changes": "",
+    "device_history_col_dropdown": "",
+    "device_history_col_source": "",
+    "device_history_col_time": "",
+    "device_history_empty_state": "",
+    "device_history_tab_title": "",
+    "device_history_table_title_changes": "",
     "devices_old": "A atualizar…",
+    "gen_device": "",
     "general_event_description": "O evento que ativou pode demorar algum tempo até que os processos de planos de fundo terminem. A execução acabou uma vez que a lista de execução abaixo fica vazia (Verifique o <a href='/maintenance.php#tab_Logging'>registo de erros</a> se encontrar problemas). <br/> <br/> Lista de execução:",
     "general_event_title": "A executar um evento ad-hoc",
     "go_to_device_event_tooltip": "Navegar para o dispositivo",
@@ -804,8 +820,9 @@
     "settings_publishers_label": "Editores",
     "settings_readonly": "Não foi possível LÊR ou ESCREVER na <code>app.conf</code>. Tente reiniciar o contentoer e ler a <a href=\"https://docs.netalertx.com/FILE_PERMISSIONS\" target=\"_blank\">documentação de permissões de ficheiro</a>",
     "settings_saved": "<br/>Definições guardadas.<br/> A recarregar...<br/><i class=\"ion ion-ios-loop-strong fa-spin fa-2x fa-fw\"></i><br/>",
+    "settings_saved_background": "",
     "settings_system_icon": "fa-solid fa-gear",
     "settings_system_label": "Sistema",
     "settings_update_item_warning": "Atualize o valor abaixo. Tenha cuidado em seguir o formato anterior. <b>Validação não é efetuada.</b>",
     "test_event_tooltip": "Guarde as alterações antes de testar as definições."
-}
+}
\ No newline at end of file
diff --git a/front/php/templates/language/ru_ru.json b/front/php/templates/language/ru_ru.json
index 6f20cc554..07ca5ed64 100644
--- a/front/php/templates/language/ru_ru.json
+++ b/front/php/templates/language/ru_ru.json
@@ -68,6 +68,10 @@
     "DAYS_TO_KEEP_EVENTS_name": "Удалить события старше",
     "DEEP_SLEEP_description": "Снижает нагрузку на процессор за счет увеличения времени ожидания между циклами обработки. При включении, сканирование может быть отложено до 1 минуты, а пользовательский интерфейс может стать менее отзывчивым.",
     "DEEP_SLEEP_name": "Глубокий сон",
+    "DEV_HIST_DAYS_description": "",
+    "DEV_HIST_DAYS_name": "",
+    "DEV_HIST_TRACKED_description": "",
+    "DEV_HIST_TRACKED_name": "",
     "DISCOVER_PLUGINS_description": "Отключите эту опцию, чтобы ускорить инициализацию и сохранение настроек. При отключении этой опции плагины не обнаруживаются, и вы не можете добавлять новые плагины в параметр <code>LOADED_PLUGINS</code>.",
     "DISCOVER_PLUGINS_name": "Обзор плагинов",
     "DevDetail_Children_Title": "Дочерние отношения",
@@ -525,6 +529,7 @@
     "NETWORK_DEVICE_TYPES_name": "Типы сетевых устройств",
     "Navigation_About": "О NetAlertX",
     "Navigation_AppEvents": "События приложения",
+    "Navigation_ChangeHistory": "",
     "Navigation_Devices": "Устройства",
     "Navigation_Donations": "Пожертвования",
     "Navigation_Events": "События",
@@ -742,6 +747,9 @@
     "VERSION_name": "Версия или временная метка",
     "WF_Action_Add": "Добавить действие",
     "WF_Action_field": "Поле",
+    "WF_Action_target": "",
+    "WF_Action_target_conditions": "",
+    "WF_Action_token_hint": "",
     "WF_Action_type": "Тип",
     "WF_Action_value": "Значение",
     "WF_Actions": "Действия",
@@ -769,7 +777,15 @@
     "add_icon_event_tooltip": "Добавить новую иконку",
     "add_option_event_tooltip": "Добавить новое значение",
     "copy_icons_event_tooltip": "Заменить иконки всех устройств с одним и тем же типом устройства",
+    "device_history_col_changes": "",
+    "device_history_col_dropdown": "",
+    "device_history_col_source": "",
+    "device_history_col_time": "",
+    "device_history_empty_state": "",
+    "device_history_tab_title": "",
+    "device_history_table_title_changes": "",
     "devices_old": "Актуализируется…",
+    "gen_device": "",
     "general_event_description": "Событие, которое вы инициировали, может занять некоторое время, прежде чем фоновые процессы завершатся. Выполнение завершится, как только очередь выполнения, указанная ниже, опустеет (Проверьте <a href='/maintenance.php#tab_Logging'>журнал ошибок</a> при возникновении проблем). <br/> <br/>· · Очередь выполнения:",
     "general_event_title": "Выполнение специального события",
     "go_to_device_event_tooltip": "Перейти к устройству",
@@ -804,6 +820,7 @@
     "settings_publishers_label": "Уведомления",
     "settings_readonly": "Невозможно ПРОЧИТАТЬ или ЗАПИСАТЬ <code>app.conf</code>. Попробуйте перезапустить контейнер и прочитать <a href=\"https://docs.netalertx.com/FILE_PERMISSIONS\" target=\"_blank\">документацию по разрешениям файлов</a>",
     "settings_saved": "<br/>Настройки сохранены. <br/> Перезагрузка... <br/><i class=\"ion ion-ios-loop-strong fa-spin fa-2x fa-fw\"></i> <br/>",
+    "settings_saved_background": "",
     "settings_system_icon": "fa-solid fa-gear",
     "settings_system_label": "Система",
     "settings_update_item_warning": "Обновить значение ниже. Будьте осторожны, следуя предыдущему формату. <b>Проверка не выполняется.</b>",
diff --git a/front/php/templates/language/sv_sv.json b/front/php/templates/language/sv_sv.json
index db1019341..5a2fda63b 100644
--- a/front/php/templates/language/sv_sv.json
+++ b/front/php/templates/language/sv_sv.json
@@ -68,6 +68,10 @@
     "DAYS_TO_KEEP_EVENTS_name": "",
     "DEEP_SLEEP_description": "",
     "DEEP_SLEEP_name": "",
+    "DEV_HIST_DAYS_description": "",
+    "DEV_HIST_DAYS_name": "",
+    "DEV_HIST_TRACKED_description": "",
+    "DEV_HIST_TRACKED_name": "",
     "DISCOVER_PLUGINS_description": "",
     "DISCOVER_PLUGINS_name": "",
     "DevDetail_Children_Title": "",
@@ -525,6 +529,7 @@
     "NETWORK_DEVICE_TYPES_name": "",
     "Navigation_About": "",
     "Navigation_AppEvents": "",
+    "Navigation_ChangeHistory": "",
     "Navigation_Devices": "",
     "Navigation_Donations": "",
     "Navigation_Events": "",
@@ -742,6 +747,9 @@
     "VERSION_name": "",
     "WF_Action_Add": "",
     "WF_Action_field": "",
+    "WF_Action_target": "",
+    "WF_Action_target_conditions": "",
+    "WF_Action_token_hint": "",
     "WF_Action_type": "",
     "WF_Action_value": "",
     "WF_Actions": "",
@@ -769,7 +777,15 @@
     "add_icon_event_tooltip": "",
     "add_option_event_tooltip": "",
     "copy_icons_event_tooltip": "",
+    "device_history_col_changes": "",
+    "device_history_col_dropdown": "",
+    "device_history_col_source": "",
+    "device_history_col_time": "",
+    "device_history_empty_state": "",
+    "device_history_tab_title": "",
+    "device_history_table_title_changes": "",
     "devices_old": "",
+    "gen_device": "",
     "general_event_description": "",
     "general_event_title": "",
     "go_to_device_event_tooltip": "",
@@ -804,6 +820,7 @@
     "settings_publishers_label": "",
     "settings_readonly": "",
     "settings_saved": "",
+    "settings_saved_background": "",
     "settings_system_icon": "",
     "settings_system_label": "",
     "settings_update_item_warning": "",
diff --git a/front/php/templates/language/tr_tr.json b/front/php/templates/language/tr_tr.json
index 6927d117d..810b29fd8 100644
--- a/front/php/templates/language/tr_tr.json
+++ b/front/php/templates/language/tr_tr.json
@@ -68,6 +68,10 @@
     "DAYS_TO_KEEP_EVENTS_name": "Şu tarihten eski olayları sil",
     "DEEP_SLEEP_description": "",
     "DEEP_SLEEP_name": "",
+    "DEV_HIST_DAYS_description": "",
+    "DEV_HIST_DAYS_name": "",
+    "DEV_HIST_TRACKED_description": "",
+    "DEV_HIST_TRACKED_name": "",
     "DISCOVER_PLUGINS_description": "Bu seçeneği devre dışı bırakmak, başlatma süresini ve ayarların kaydedilmesini hızlandırır. Devre dışı bırakıldığında, eklentiler keşfedilmez ve <code>LOADED_PLUGINS</code> ayarına yeni eklentiler eklenemez.",
     "DISCOVER_PLUGINS_name": "Eklentileri keşfet",
     "DevDetail_Children_Title": "",
@@ -525,6 +529,7 @@
     "NETWORK_DEVICE_TYPES_name": "Ağ aygıtı türleri",
     "Navigation_About": "Hakkında",
     "Navigation_AppEvents": "Uygulama Etkinlikleri",
+    "Navigation_ChangeHistory": "",
     "Navigation_Devices": "Cihazlar",
     "Navigation_Donations": "Bağış",
     "Navigation_Events": "Olay",
@@ -742,6 +747,9 @@
     "VERSION_name": "",
     "WF_Action_Add": "",
     "WF_Action_field": "",
+    "WF_Action_target": "",
+    "WF_Action_target_conditions": "",
+    "WF_Action_token_hint": "",
     "WF_Action_type": "",
     "WF_Action_value": "",
     "WF_Actions": "",
@@ -769,7 +777,15 @@
     "add_icon_event_tooltip": "",
     "add_option_event_tooltip": "",
     "copy_icons_event_tooltip": "",
+    "device_history_col_changes": "",
+    "device_history_col_dropdown": "",
+    "device_history_col_source": "",
+    "device_history_col_time": "",
+    "device_history_empty_state": "",
+    "device_history_tab_title": "",
+    "device_history_table_title_changes": "",
     "devices_old": "Yenileniyor...",
+    "gen_device": "",
     "general_event_description": "",
     "general_event_title": "",
     "go_to_device_event_tooltip": "",
@@ -804,6 +820,7 @@
     "settings_publishers_label": "",
     "settings_readonly": "<code>app.conf</code> OKUNAMIYOR veya YAZILAMIYOR. Konteyner'ı yeniden başlatmayı deneyin ve <a href=\"https://docs.netalertx.com/FILE_PERMISSIONS\" target=\"_blank\">file permissions documentation</a> dosyasını okuyun",
     "settings_saved": "",
+    "settings_saved_background": "",
     "settings_system_icon": "",
     "settings_system_label": "Sistem",
     "settings_update_item_warning": "",
diff --git a/front/php/templates/language/uk_ua.json b/front/php/templates/language/uk_ua.json
index 041782b25..44fae3cea 100644
--- a/front/php/templates/language/uk_ua.json
+++ b/front/php/templates/language/uk_ua.json
@@ -68,6 +68,10 @@
     "DAYS_TO_KEEP_EVENTS_name": "Видалити події, старші за",
     "DEEP_SLEEP_description": "",
     "DEEP_SLEEP_name": "",
+    "DEV_HIST_DAYS_description": "",
+    "DEV_HIST_DAYS_name": "",
+    "DEV_HIST_TRACKED_description": "",
+    "DEV_HIST_TRACKED_name": "",
     "DISCOVER_PLUGINS_description": "Вимкніть цю опцію, щоб прискорити ініціалізацію та збереження налаштувань. Якщо вимкнено, плагіни не виявляються, і ви не можете додавати нові плагіни до параметра <code>LOADED_PLUGINS</code>.",
     "DISCOVER_PLUGINS_name": "Відкрийте для себе плагіни",
     "DevDetail_Children_Title": "Стосунки з дітьми",
@@ -525,6 +529,7 @@
     "NETWORK_DEVICE_TYPES_name": "Типи мережевих пристроїв",
     "Navigation_About": "Про",
     "Navigation_AppEvents": "События приложения",
+    "Navigation_ChangeHistory": "",
     "Navigation_Devices": "Пристрої",
     "Navigation_Donations": "Пожертви",
     "Navigation_Events": "Події",
@@ -742,6 +747,9 @@
     "VERSION_name": "Версія або позначка часу",
     "WF_Action_Add": "Додати дію",
     "WF_Action_field": "Поле",
+    "WF_Action_target": "",
+    "WF_Action_target_conditions": "",
+    "WF_Action_token_hint": "",
     "WF_Action_type": "Тип",
     "WF_Action_value": "Значення",
     "WF_Actions": "Дії",
@@ -769,7 +777,15 @@
     "add_icon_event_tooltip": "додати новий значок",
     "add_option_event_tooltip": "Додати нове значення",
     "copy_icons_event_tooltip": "Перезаписати піктограми всіх пристроїв одним типом пристрою",
+    "device_history_col_changes": "",
+    "device_history_col_dropdown": "",
+    "device_history_col_source": "",
+    "device_history_col_time": "",
+    "device_history_empty_state": "",
+    "device_history_tab_title": "",
+    "device_history_table_title_changes": "",
     "devices_old": "Освіжає…",
+    "gen_device": "",
     "general_event_description": "Подія, яку ви ініціювали, може зайняти деякий час, поки завершаться фонові процеси. Виконання завершилося, коли наведена нижче черга виконання спорожнилася (перевірте <a href='/maintenance.php#tab_Logging'>журнал помилок</a>, якщо виникнуть проблеми). <br/> <br/> Черга виконання:",
     "general_event_title": "Виконання спеціальної події",
     "go_to_device_event_tooltip": "Перейдіть до пристрою",
@@ -804,6 +820,7 @@
     "settings_publishers_label": "Видавці",
     "settings_readonly": "Неможливо ЧИТАТИ або ЗАПИСАТИ <code>app.conf</code>. Спробуйте перезапустити контейнер і прочитайте <a href=\"https://docs.netalertx.com/FILE_PERMISSIONS\" target=\"_blank\">документацію щодо дозволів на файли</a>",
     "settings_saved": "<br/>Налаштування збережено. <br/> Перезавантаження… <br/><i class=\"ion ion-ios-loop-strong fa-spin fa-2x fa-fw\"></i> <br/>",
+    "settings_saved_background": "",
     "settings_system_icon": "фа-твердий фа-передача",
     "settings_system_label": "Система",
     "settings_update_item_warning": "Оновіть значення нижче. Слідкуйте за попереднім форматом. <b>Перевірка не виконана.</b>",
diff --git a/front/php/templates/language/vi_vn.json b/front/php/templates/language/vi_vn.json
index db1019341..5a2fda63b 100644
--- a/front/php/templates/language/vi_vn.json
+++ b/front/php/templates/language/vi_vn.json
@@ -68,6 +68,10 @@
     "DAYS_TO_KEEP_EVENTS_name": "",
     "DEEP_SLEEP_description": "",
     "DEEP_SLEEP_name": "",
+    "DEV_HIST_DAYS_description": "",
+    "DEV_HIST_DAYS_name": "",
+    "DEV_HIST_TRACKED_description": "",
+    "DEV_HIST_TRACKED_name": "",
     "DISCOVER_PLUGINS_description": "",
     "DISCOVER_PLUGINS_name": "",
     "DevDetail_Children_Title": "",
@@ -525,6 +529,7 @@
     "NETWORK_DEVICE_TYPES_name": "",
     "Navigation_About": "",
     "Navigation_AppEvents": "",
+    "Navigation_ChangeHistory": "",
     "Navigation_Devices": "",
     "Navigation_Donations": "",
     "Navigation_Events": "",
@@ -742,6 +747,9 @@
     "VERSION_name": "",
     "WF_Action_Add": "",
     "WF_Action_field": "",
+    "WF_Action_target": "",
+    "WF_Action_target_conditions": "",
+    "WF_Action_token_hint": "",
     "WF_Action_type": "",
     "WF_Action_value": "",
     "WF_Actions": "",
@@ -769,7 +777,15 @@
     "add_icon_event_tooltip": "",
     "add_option_event_tooltip": "",
     "copy_icons_event_tooltip": "",
+    "device_history_col_changes": "",
+    "device_history_col_dropdown": "",
+    "device_history_col_source": "",
+    "device_history_col_time": "",
+    "device_history_empty_state": "",
+    "device_history_tab_title": "",
+    "device_history_table_title_changes": "",
     "devices_old": "",
+    "gen_device": "",
     "general_event_description": "",
     "general_event_title": "",
     "go_to_device_event_tooltip": "",
@@ -804,6 +820,7 @@
     "settings_publishers_label": "",
     "settings_readonly": "",
     "settings_saved": "",
+    "settings_saved_background": "",
     "settings_system_icon": "",
     "settings_system_label": "",
     "settings_update_item_warning": "",
diff --git a/front/php/templates/language/zh_cn.json b/front/php/templates/language/zh_cn.json
index 0dfbdbb63..2a5b1efaa 100644
--- a/front/php/templates/language/zh_cn.json
+++ b/front/php/templates/language/zh_cn.json
@@ -68,6 +68,10 @@
     "DAYS_TO_KEEP_EVENTS_name": "删除早于",
     "DEEP_SLEEP_description": "",
     "DEEP_SLEEP_name": "",
+    "DEV_HIST_DAYS_description": "",
+    "DEV_HIST_DAYS_name": "",
+    "DEV_HIST_TRACKED_description": "",
+    "DEV_HIST_TRACKED_name": "",
     "DISCOVER_PLUGINS_description": "禁用此选项可加快初始化和设置保存的速度。当禁用时，插件不会被发现，并且您无法将新插件添加到 <code>LOADED_PLUGINS</code>设置中。",
     "DISCOVER_PLUGINS_name": "发现插件",
     "DevDetail_Children_Title": "子代关系",
@@ -525,6 +529,7 @@
     "NETWORK_DEVICE_TYPES_name": "网络设备类型",
     "Navigation_About": "关于",
     "Navigation_AppEvents": "应用事件",
+    "Navigation_ChangeHistory": "",
     "Navigation_Devices": "设备",
     "Navigation_Donations": "捐款",
     "Navigation_Events": "事件",
@@ -742,6 +747,9 @@
     "VERSION_name": "本号或时间戳",
     "WF_Action_Add": "添加动作",
     "WF_Action_field": "字段",
+    "WF_Action_target": "",
+    "WF_Action_target_conditions": "",
+    "WF_Action_token_hint": "",
     "WF_Action_type": "类型",
     "WF_Action_value": "值",
     "WF_Actions": "动作",
@@ -769,7 +777,15 @@
     "add_icon_event_tooltip": "添加新图标",
     "add_option_event_tooltip": "添加新值",
     "copy_icons_event_tooltip": "覆盖所有同类设备的图标",
+    "device_history_col_changes": "",
+    "device_history_col_dropdown": "",
+    "device_history_col_source": "",
+    "device_history_col_time": "",
+    "device_history_empty_state": "",
+    "device_history_tab_title": "",
+    "device_history_table_title_changes": "",
     "devices_old": "刷新中…",
+    "gen_device": "",
     "general_event_description": "您触发的事件可能需要一段时间才能完成后台进程。一旦以下执行队列清空，执行就会结束（如果遇到问题，请检查<a href='/maintenance.php#tab_Logging'>错误日志</a>）。<br/> <br/> 执行队列：",
     "general_event_title": "执行自组织网络事件",
     "go_to_device_event_tooltip": "前往设备页面",
@@ -804,8 +820,9 @@
     "settings_publishers_label": "出版商",
     "settings_readonly": "无法读或写<code>app.conf</code>。请尝试重启容器并阅读<a href=\"https://docs.netalertx.com/FILE_PERMISSIONS\" target=\"_blank\">文件权限文档</a>",
     "settings_saved": "<br/>设置已保存。<br/> 正在加载…<br/><i class=\"ion ion-ios-loop-strong fa-spin fa-2x fa-fw\"></i> <br/>",
+    "settings_saved_background": "",
     "settings_system_icon": "fa-solid fa-gear",
     "settings_system_label": "系统",
     "settings_update_item_warning": "更新下面的值。请注意遵循先前的格式。<b>未执行验证。</b>",
     "test_event_tooltip": "在测试设置之前，请先保存更改。"
-}
+}
\ No newline at end of file
diff --git a/front/php/templates/skel_change_log.php b/front/php/templates/skel_change_log.php
new file mode 100644
index 000000000..c51c0b643
--- /dev/null
+++ b/front/php/templates/skel_change_log.php
@@ -0,0 +1,26 @@
+<!-- Change log Table Skeleton === -->
+<div id="change-log-skeleton" class=" change-log-skeleton-class">
+    <section class="box">
+        <div class="skel-table-box ">
+        <div class="skel-table-header-row">
+            <?php for ($j = 0; $j < 5; $j++): ?>
+            <span class="skel-th skel-shimmer"></span>
+            <?php endfor; ?>
+        </div>
+        <?php
+            $rowWidths = array_fill(0, 20, [15, 14, 18, 12, 20]);
+            foreach ($rowWidths as $widths):
+        ?>
+        <div class="skel-tr">
+            <?php foreach ($widths as $w): ?>
+            <span class="skel-td skel-shimmer" style="flex:1; max-width:<?= $w ?>%"></span>
+            <?php endforeach; ?>
+        </div>
+        <?php endforeach; ?>
+        </div>
+        <div class="skel-form-footer-left" style="padding:8px 0;">
+            <span class="skel-form-btn skel-shimmer"></span>
+            <span class="skel-form-btn skel-shimmer"></span>
+        </div>
+    </section>
+</div>
\ No newline at end of file
diff --git a/front/plugins/db_cleanup/script.py b/front/plugins/db_cleanup/script.py
index 844a28c16..cae8ec287 100755
--- a/front/plugins/db_cleanup/script.py
+++ b/front/plugins/db_cleanup/script.py
@@ -13,6 +13,7 @@
 import conf  # noqa: E402 [flake8 lint suppression]
 from pytz import timezone  # noqa: E402 [flake8 lint suppression]
 from database import get_temp_db_connection  # noqa: E402 [flake8 lint suppression]
+from models.device_history_instance import DevicesHistoryInstance  # noqa: E402 [flake8 lint suppression]
 
 # Make sure the TIMEZONE for logging is correct
 conf.tz = timezone(get_setting_value("TIMEZONE"))
@@ -34,6 +35,7 @@ def main():
     HRS_TO_KEEP_OFFDEV = int(get_setting_value("HRS_TO_KEEP_OFFDEV"))
     DAYS_TO_KEEP_EVENTS = int(get_setting_value("DAYS_TO_KEEP_EVENTS"))
     CLEAR_NEW_FLAG = get_setting_value("CLEAR_NEW_FLAG")
+    DEV_HIST_DAYS = int(get_setting_value("DEV_HIST_DAYS") or 14)
 
     mylog("verbose", [f"[{pluginName}] In script"])
 
@@ -45,6 +47,7 @@ def main():
         HRS_TO_KEEP_OFFDEV,
         PLUGINS_KEEP_HIST,
         CLEAR_NEW_FLAG,
+        DEV_HIST_DAYS,
     )
 
     mylog("verbose", [f"[{pluginName}] Cleanup complete"])
@@ -62,6 +65,7 @@ def cleanup_database(
     HRS_TO_KEEP_OFFDEV,
     PLUGINS_KEEP_HIST,
     CLEAR_NEW_FLAG,
+    DEV_HIST_DAYS=14,
 ):
     """
     Cleaning out old records from the tables that don't need to keep all data.
@@ -156,6 +160,16 @@ def cleanup_database(
 
     conn.commit()
 
+    # -----------------------------------------------------
+    # Cleanup DevicesHistory
+    if DEV_HIST_DAYS > 0:
+        try:
+            mylog("verbose", f"[{pluginName}] DevicesHistory: Delete rows older than {DEV_HIST_DAYS} days")
+            deleted = DevicesHistoryInstance().prune_history(DEV_HIST_DAYS)
+            mylog("verbose", f"[{pluginName}] DevicesHistory deleted rows: {deleted}")
+        except Exception as e:
+            mylog("none", f"[{pluginName}] DevicesHistory cleanup failed: {e}")
+
     # -----------------------------------------------------
     # Cleanup New Devices
     if HRS_TO_KEEP_NEWDEV != 0:
diff --git a/front/pluginsCore.php b/front/pluginsCore.php
index a8f36686e..c71b8d3b9 100755
--- a/front/pluginsCore.php
+++ b/front/pluginsCore.php
@@ -8,8 +8,11 @@
 ?>
 
 <!-- Main content ---------------------------------------------------------- -->
- <?php require 'php/templates/skel_plugins.php'; ?>
-<section class="content">
+<?php require 'php/templates/skel_plugins.php'; ?>
+<section class="content pluginsCore">
+  <span class="helpIcon"> 
+    <a target="_blank" href="https://docs.netalertx.com/PLUGINS"><i class="fa fa-circle-question"></i></a>
+  </span>
   <div class="plugin-filters hidden" >
     <div class="input-group col-sm-12">
       <label class="col-sm-3"><?= lang('Plugins_Filters_Mac');?></label>
diff --git a/front/presence.php b/front/presence.php
index 2dc2da995..4a074e124 100755
--- a/front/presence.php
+++ b/front/presence.php
@@ -22,6 +22,7 @@
 
 <!-- Page ------------------------------------------------------------------ -->
   <div class="content-wrapper" id="presencePage">
+
 <?php require 'php/templates/skel_presence.php'; ?>
 
 <!-- Main content ---------------------------------------------------------- -->
@@ -128,9 +129,11 @@
 
 <!-- Calendar -------------------------------------------------------------- -->
       <div class="row">
+        
         <div class="col-lg-12 col-sm-12 col-xs-12">
+        
           <div id="tableDevicesBox" class="box" style="min-height: 500px">
-
+            
             <!-- box-header -->
             <div class="box-header">
               <h3 id="tableDevicesTitle" class="box-title text-gray">Devices</h3>
@@ -145,6 +148,11 @@
                   <div class="presenceOnlinePastMiss presenceKeyBoxes"></div> <?= lang('Presence_Key_OnlinePastMiss');?>
                 </span>
               </div>
+              <span class="helpIcon">
+                <a target="_blank" href="https://docs.netalertx.com/DEVICE_PRESENCE">
+                  <i class="fa fa-circle-question"></i>
+                </a>
+              </span>
             </div>
 
             <!-- box-body -->
@@ -456,7 +464,7 @@ function getDevicesPresence (status) {
   // Set title and color
   $('#tableDevicesTitle')[0].className = 'box-title text-'+ color;
   $('#tableDevicesBox')[0].className = 'box box-'+ color;
-  $('#tableDevicesTitle').html (tableTitle);
+  $('#tableDevicesTitle').html (`${tableTitle}  ${getString("Device_TableHead_PresentLastScan")}`);
 
   const apiToken = getSetting("API_TOKEN");
 
diff --git a/front/workflows.php b/front/workflows.php
index 633590a01..5395d9a8b 100755
--- a/front/workflows.php
+++ b/front/workflows.php
@@ -6,9 +6,11 @@
 
 
 <!-- Page ------------------------------------------------------------------ -->
-<div class="content-wrapper" id="wf-content-wrapper">
+<div id="wf-content-wrapper" class="content-wrapper spinnerTarget" >
 <?php require 'php/templates/skel_workflows.php'; ?>
-<span class="helpIcon"> <a target="_blank" href="https://docs.netalertx.com/WORKFLOWS"><i class="fa fa-circle-question"></i></a></span>
+<span class="helpIcon"> 
+  <a target="_blank" href="https://docs.netalertx.com/WORKFLOWS"><i class="fa fa-circle-question"></i></a>
+</span>
 <?php
    require 'workflowsCore.php';
 ?>
diff --git a/mkdocs.yml b/mkdocs.yml
index 2d1ebc1c1..2a16e5081 100755
--- a/mkdocs.yml
+++ b/mkdocs.yml
@@ -74,7 +74,10 @@ nav:
         - Device display settings: DEVICE_DISPLAY_SETTINGS.md
         - Device views filtering: DEVICE_FILTERS.md
         - Session info: SESSION_INFO.md
-        - Field Lock/Unlock: DEVICE_FIELD_LOCK.md
+        - Field Lock/Unlock: DEVICE_FIELD_LOCK.md        
+      - Device auditing:
+        - Change log: DEVICE_CHANGE_LOG.md
+        - Presence: DEVICE_PRESENCE.md
         - Device source fields: DEVICE_SOURCE_FIELDS.md
       - Icons and network topology:
         - Icons: ICONS.md
diff --git a/server/api_server/api_server_start.py b/server/api_server/api_server_start.py
index f13423979..f4867ed21 100755
--- a/server/api_server/api_server_start.py
+++ b/server/api_server/api_server_start.py
@@ -6,6 +6,7 @@
 
 from flask import Flask, redirect, request, jsonify, url_for, Response
 from models.device_instance import DeviceInstance  # noqa: E402
+from models.device_history_instance import DevicesHistoryInstance  # noqa: E402
 from flask_cors import CORS
 from werkzeug.exceptions import HTTPException
 
@@ -772,6 +773,20 @@ def api_devices_totals(payload=None):
     return jsonify(device_handler.getTotals())
 
 
+@app.route("/devices/history/filters", methods=["GET"])
+@validate_request(
+    operation_id="get_device_history_filters",
+    summary="Get Device History Filter Values",
+    description="Return distinct changedBy and changedColumn values available in DevicesHistory. Optionally scope to a single device with ?devGUID=<guid>.",
+    tags=["devices"],
+    auth_callable=is_authorized
+)
+def api_devices_history_filters(payload=None):
+    dev_guid = request.args.get("devGUID") or None
+    filters = DevicesHistoryInstance().get_available_filter_values(devGUID=dev_guid)
+    return jsonify({"success": True, "data": filters})
+
+
 @app.route("/devices/totals/named", methods=["GET"])
 @validate_request(
     operation_id="get_device_totals_named",
diff --git a/server/api_server/graphql_endpoint.py b/server/api_server/graphql_endpoint.py
index e950a2044..b401874f4 100755
--- a/server/api_server/graphql_endpoint.py
+++ b/server/api_server/graphql_endpoint.py
@@ -26,13 +26,16 @@
     PluginQueryOptionsInput, PluginEntry,
     PluginsObjectsResult, PluginsEventsResult, PluginsHistoryResult,
     EventQueryOptionsInput, EventEntry, EventsResult,
+    DeviceHistoryChange, GroupedDeviceHistory, DeviceHistoryResult,
 )
 from .graphql_helpers import (  # noqa: E402 [flake8 lint suppression]
     mixed_type_sort_key,
     apply_common_pagination,
     apply_plugin_filters,
     apply_events_filters,
+    extract_paging
 )
+from models.device_history_instance import DevicesHistoryInstance  # noqa: E402
 
 folder = apiPath
 
@@ -41,7 +44,120 @@
 _langstrings_cache_mtime = {}  # tracks last modified times
 
 
+def _to_graphql_history(groups):
+    """Convert DevicesHistoryInstance grouped dicts to GraphQL ObjectType instances."""
+    result = []
+    for g in groups:
+        changes = [
+            DeviceHistoryChange(
+                changedColumn=c["changedColumn"],
+                oldValue=c["oldValue"],
+                newValue=c["newValue"],
+            )
+            for c in g["changes"]
+        ]
+        result.append(GroupedDeviceHistory(
+            devGUID=g["devGUID"],
+            timestamp=g["timestamp"],
+            changedBy=g["changedBy"],
+            changes=changes,
+        ))
+    return result
+
+
 class Query(ObjectType):
+    # --- DEVICE HISTORY ---
+    deviceHistoryGrouped = Field(
+        DeviceHistoryResult,
+        devGUID=String(required=False, description="Device GUID to fetch history for"),
+        changedColumn=String(description="Filter to groups containing this field change"),
+        changedBy=String(description="Filter to a specific attribution source"),
+        options=PageQueryOptionsInput(description="Paging, sorting, filtering options"),
+    )
+
+    def resolve_deviceHistoryGrouped(
+            self,
+            info,
+            devGUID=None,
+            changedColumn=None,
+            changedBy=None,
+            options=None):
+        """
+        Return grouped device history.
+
+        If `devGUID` is provided, results are restricted to a single device.
+        If omitted, history across all devices is returned.
+
+        This resolver supports:
+            - Optional filtering by device GUID, change column, and attribution source
+            - Pagination via `options` (page/limit/offset)
+            - Sorting at the grouped event level
+            - Full-text search across history fields (if enabled in backend)
+
+        Internally:
+            - Raw history rows are fetched from the database
+            - Rows are grouped in Python by (timestamp, changedBy, devGUID)
+            - Sorting is applied to grouped events
+            - Pagination is applied after grouping
+
+        Args:
+            info: GraphQL execution context
+            devGUID (str | None): Optional device GUID filter
+            changedColumn (str | None): Filter to only events containing this column
+            changedBy (str | None): Filter by attribution source
+            options (PageQueryOptionsInput | None): Paging, sorting, and search options
+
+        Returns:
+            DeviceHistoryResult: Grouped history events and total count
+        """
+        try:
+            mylog("none", f"[HISTORY] unified resolver devGUID={devGUID} changedColumn={changedColumn} changedBy={changedBy}")
+
+            h = DevicesHistoryInstance()
+            paging = extract_paging(options)
+
+            if devGUID:
+                groups = h.get_grouped_history(
+                    devGUID=devGUID,
+                    changedColumn=changedColumn,
+                    changedBy=changedBy,
+                    limit=paging["limit"],
+                    offset=paging["offset"],
+                    sort=paging["sort"],
+                    search=paging["search"],
+                )
+
+                total = h.get_total_group_count(
+                    devGUID=devGUID,
+                    changedColumn=changedColumn,
+                    changedBy=changedBy,
+                    search=paging["search"]
+                )
+            else:
+                groups = h.get_all_grouped_history(
+                    changedColumn=changedColumn,
+                    changedBy=changedBy,
+                    limit=paging["limit"],
+                    offset=paging["offset"],
+                    sort=paging["sort"],
+                    search=paging["search"],
+                )
+
+                total = h.get_total_group_count(
+                    changedColumn=changedColumn,
+                    changedBy=changedBy,
+                    search=paging["search"]
+                )
+
+            return DeviceHistoryResult(
+                history=_to_graphql_history(groups),
+                count=total,
+            )
+
+        except Exception as e:
+            mylog("none", f"[graphql] unified resolver error: {e}")
+            return DeviceHistoryResult(history=[], count=0)
+
     # --- DEVICES ---
     devices = Field(DeviceResult, options=PageQueryOptionsInput())
 
diff --git a/server/api_server/graphql_helpers.py b/server/api_server/graphql_helpers.py
index 807c7cc9d..a3e8d7ddd 100644
--- a/server/api_server/graphql_helpers.py
+++ b/server/api_server/graphql_helpers.py
@@ -139,3 +139,29 @@ def apply_events_filters(data, options):
         ]
 
     return data
+
+
+def extract_paging(options):
+    if not options:
+        return {
+            "page": 1,
+            "limit": 50,
+            "offset": 0,
+            "sort": [],
+            "search": None
+        }
+
+    page = getattr(options, "page", 1) or 1
+    limit = getattr(options, "limit", 50) or 50
+    search = getattr(options, "search", None)
+    sort = getattr(options, "sort", []) or []
+
+    offset = (page - 1) * limit
+
+    return {
+        "page": page,
+        "limit": limit,
+        "offset": offset,
+        "sort": sort,
+        "search": search
+    }
diff --git a/server/api_server/graphql_types.py b/server/api_server/graphql_types.py
index 3465e2cd8..66141bf31 100644
--- a/server/api_server/graphql_types.py
+++ b/server/api_server/graphql_types.py
@@ -10,7 +10,7 @@
 
 class SortOptionsInput(InputObjectType):
     field = String()
-    order = String()
+    order = String()  # direction asc, desc
 
 
 class FilterOptionsInput(InputObjectType):
@@ -20,8 +20,8 @@ class FilterOptionsInput(InputObjectType):
 
 class PageQueryOptionsInput(InputObjectType):
     page = Int()
-    limit = Int()
-    sort = List(SortOptionsInput)
+    limit = Int()                        # pageSize
+    sort = List(SortOptionsInput)        # sorting 
     search = String()
     status = String()
     filters = List(FilterOptionsInput)
@@ -259,3 +259,25 @@ class EventsResult(ObjectType):
     entries  = List(EventEntry, description="Events table rows")
     count    = Int(description="Filtered count (before pagination)")
     db_count = Int(description="Total rows in table before any filter")
+
+
+# ---------------------------------------------------------------------------
+# Device History
+# ---------------------------------------------------------------------------
+
+class DeviceHistoryChange(ObjectType):
+    changedColumn = String(description="Name of the Devices column that changed")
+    oldValue = String(description="Value before the change (null for new devices)")
+    newValue = String(description="Value after the change")
+
+
+class GroupedDeviceHistory(ObjectType):
+    devGUID = String(description="GUID of the device that changed")
+    timestamp = String(description="UTC timestamp of the change event")
+    changedBy = String(description="Attribution: USER, plugin prefix (e.g. ARPSCAN), or system")
+    changes = List(DeviceHistoryChange, description="Field-level changes in this event")
+
+
+class DeviceHistoryResult(ObjectType):
+    history = List(GroupedDeviceHistory, description="Grouped change events")
+    count = Int(description="Total number of grouped events matching the filters")
diff --git a/server/database.py b/server/database.py
index c0c16d1dc..63f14233b 100755
--- a/server/database.py
+++ b/server/database.py
@@ -19,6 +19,7 @@
     migrate_to_camelcase,
     migrate_timestamps_to_utc,
 )
+from db.db_history import ensure_deviceshistory_table, ensure_deviceshistory_triggers
 
 
 class DB:
@@ -224,6 +225,10 @@ def initDB(self):
             # Normalization triggers
             ensure_mac_lowercase_triggers(self.sql)
 
+            # Device history table + audit triggers
+            ensure_deviceshistory_table(self.sql)
+            ensure_deviceshistory_triggers(self.sql)
+
             # commit changes
             self.commitDB()
         except Exception as e:
@@ -234,6 +239,12 @@ def initDB(self):
         # Init the AppEvent database table
         AppEvent_obj(self)
 
+        # AppEvent_obj.drop_all_triggers() wipes every trigger in the DB
+        # (including trg_devhist_*) as part of its clean-start routine.
+        # Re-create the device history audit triggers here so they survive.
+        ensure_deviceshistory_triggers(self.sql)
+        self.commitDB()
+
     def get_table_as_json(self, sqlQuery, parameters=None):
         """
         Wrapper to use the central get_table_as_json helper.
diff --git a/server/db/db_history.py b/server/db/db_history.py
new file mode 100644
index 000000000..82089cf66
--- /dev/null
+++ b/server/db/db_history.py
@@ -0,0 +1,229 @@
+"""
+db_history.py — DevicesHistory table/trigger management.
+
+Creates and maintains:
+  - DevicesHistory table + indexes
+  - AFTER UPDATE trigger  (trg_devhist_update)
+  - AFTER INSERT trigger  (trg_devhist_insert)
+
+Both triggers are driven entirely by two Settings values:
+  DEV_HIST_DAYS     — 0 disables the engine entirely (WHEN guard)
+  DEV_HIST_TRACKED  — comma-separated list of field names to audit
+
+Attribution uses existing *Source columns where available, falling back
+to hard-coded constants for user-only and auto-computed fields.
+"""
+
+from logger import mylog
+
+# ---------------------------------------------------------------------------
+# Field → changedBy attribution mapping
+#
+# Each entry: (field_name, changedBy_sql_expression)
+#   - Source-tracked fields: read NEW.<field>Source at trigger time
+#   - User-only fields:      hard-coded 'user:api'
+#   - Auto-computed fields:  hard-coded 'system'
+#   - *Source fields:        hard-coded 'system'
+# ---------------------------------------------------------------------------
+_HIST_FIELDS = [
+    # Source-tracked fields (FIELD_SOURCE_MAP)
+    ("devMac", "COALESCE(NULLIF(TRIM(NEW.devMacSource), ''), 'system')"),
+    ("devName", "COALESCE(NULLIF(TRIM(NEW.devNameSource), ''), 'system')"),
+    ("devFQDN", "COALESCE(NULLIF(TRIM(NEW.devFQDNSource), ''), 'system')"),
+    ("devLastIP", "COALESCE(NULLIF(TRIM(NEW.devLastIPSource), ''), 'system')"),
+    ("devVendor", "COALESCE(NULLIF(TRIM(NEW.devVendorSource), ''), 'system')"),
+    ("devSSID", "COALESCE(NULLIF(TRIM(NEW.devSSIDSource), ''), 'system')"),
+    ("devParentMAC", "COALESCE(NULLIF(TRIM(NEW.devParentMACSource), ''), 'system')"),
+    ("devParentPort", "COALESCE(NULLIF(TRIM(NEW.devParentPortSource), ''), 'system')"),
+    ("devParentRelType", "COALESCE(NULLIF(TRIM(NEW.devParentRelTypeSource), ''), 'system')"),
+    ("devVlan", "COALESCE(NULLIF(TRIM(NEW.devVlanSource), ''), 'system')"),
+    # User-only fields (only setDeviceData() / updateField() touch these)
+    ("devOwner", "'user:api'"),
+    ("devType", "'user:api'"),
+    ("devFavorite", "'user:api'"),
+    ("devGroup", "'user:api'"),
+    ("devComments", "'user:api'"),
+    ("devForceStatus", "'user:api'"),
+    ("devStaticIP", "'user:api'"),
+    ("devScan", "'user:api'"),
+    ("devAlertDown", "'user:api'"),
+    ("devCanSleep", "'user:api'"),
+    ("devSkipRepeated", "'user:api'"),
+    ("devLocation", "'user:api'"),
+    ("devIsArchived", "'user:api'"),
+    ("devReqNicsOnline", "'user:api'"),
+    ("devCustomProps", "'user:api'"),
+    # Auto-computed / scan-only fields (no *Source column)
+    ("devPrimaryIPv4", "'system'"),
+    ("devPrimaryIPv6", "'system'"),
+    ("devIcon", "'system'"),
+    ("devSite", "'system'"),
+    ("devSyncHubNode", "'system'"),
+    ("devSourcePlugin", "'system'"),
+    # *Source fields themselves
+    ("devMacSource", "'system'"),
+    ("devNameSource", "'system'"),
+    ("devFQDNSource", "'system'"),
+    ("devLastIPSource", "'system'"),
+    ("devVendorSource", "'system'"),
+    ("devSSIDSource", "'system'"),
+    ("devParentMACSource", "'system'"),
+    ("devParentPortSource", "'system'"),
+    ("devParentRelTypeSource", "'system'"),
+    ("devVlanSource", "'system'"),
+]
+
+# ---------------------------------------------------------------------------
+# SQL builders
+# ---------------------------------------------------------------------------
+
+_HIST_DAYS_GUARD = (
+    "(SELECT CAST(COALESCE(setValue, '0') AS INTEGER) "
+    "FROM Settings WHERE setKey = 'DEV_HIST_DAYS') > 0"
+)
+
+_TRACKED_CHECK = (
+    "instr((SELECT COALESCE(setValue, '') FROM Settings "
+    "WHERE setKey = 'DEV_HIST_TRACKED'), '''{field}''') > 0"
+)
+
+
+def _build_update_trigger_sql() -> str:
+    """Generate CREATE TRIGGER SQL for AFTER UPDATE on Devices."""
+    blocks = []
+    for field, attribution in _HIST_FIELDS:
+        tracked_check = _TRACKED_CHECK.format(field=field)
+        blocks.append(
+            f"  INSERT INTO DevicesHistory "
+            f"(devGUID, changedColumn, oldValue, newValue, changedBy, timestamp)\n"
+            f"  SELECT NEW.devGUID, '{field}', "
+            f"CAST(OLD.{field} AS TEXT), CAST(NEW.{field} AS TEXT),\n"
+            f"         {attribution},\n"
+            f"         datetime('now')\n"
+            f"  WHERE (OLD.{field} IS NOT NEW.{field})\n"
+            f"    AND COALESCE(NEW.devGUID, '') != ''\n"
+            f"    AND {tracked_check};"
+        )
+    body = "\n".join(blocks)
+    return (
+        "CREATE TRIGGER trg_devhist_update\n"
+        "AFTER UPDATE ON Devices\n"
+        "FOR EACH ROW\n"
+        f"WHEN {_HIST_DAYS_GUARD}\n"
+        "BEGIN\n"
+        f"{body}\n"
+        "END;"
+    )
+
+
+def _build_insert_trigger_sql() -> str:
+    """Generate CREATE TRIGGER SQL for AFTER INSERT on Devices."""
+    blocks = []
+    for field, attribution in _HIST_FIELDS:
+        tracked_check = _TRACKED_CHECK.format(field=field)
+        blocks.append(
+            f"  INSERT INTO DevicesHistory "
+            f"(devGUID, changedColumn, oldValue, newValue, changedBy, timestamp)\n"
+            f"  SELECT NEW.devGUID, '{field}', NULL, CAST(NEW.{field} AS TEXT),\n"
+            f"         {attribution},\n"
+            f"         datetime('now')\n"
+            f"  WHERE NEW.{field} IS NOT NULL\n"
+            f"    AND COALESCE(NEW.devGUID, '') != ''\n"
+            f"    AND {tracked_check};"
+        )
+    body = "\n".join(blocks)
+    return (
+        "CREATE TRIGGER trg_devhist_insert\n"
+        "AFTER INSERT ON Devices\n"
+        "FOR EACH ROW\n"
+        f"WHEN {_HIST_DAYS_GUARD}\n"
+        "BEGIN\n"
+        f"{body}\n"
+        "END;"
+    )
+
+
+# ---------------------------------------------------------------------------
+# Public ensure_* functions (called from database.py initDB)
+# ---------------------------------------------------------------------------
+
+def ensure_deviceshistory_table(sql) -> bool:
+    """
+    Ensures DevicesHistory table and its indexes exist.
+
+    Also backfills any Devices rows that have NULL/empty devGUID so that
+    the history triggers can write records for them.
+
+    Idempotent — uses IF NOT EXISTS throughout.
+
+    Parameters:
+        sql: database cursor (must support execute()).
+    """
+    try:
+        sql.execute("""
+            CREATE TABLE IF NOT EXISTS DevicesHistory (
+                id            INTEGER PRIMARY KEY AUTOINCREMENT,
+                devGUID       TEXT NOT NULL,
+                timestamp     DATETIME DEFAULT CURRENT_TIMESTAMP,
+                changedBy     TEXT NOT NULL,
+                changedColumn TEXT NOT NULL,
+                oldValue      TEXT,
+                newValue      TEXT,
+                FOREIGN KEY (devGUID) REFERENCES Devices(devGUID) ON DELETE CASCADE
+            )
+        """)
+
+        sql.execute(
+            "CREATE INDEX IF NOT EXISTS idx_devhist_guid_column "
+            "ON DevicesHistory(devGUID, changedColumn)"
+        )
+        sql.execute(
+            "CREATE INDEX IF NOT EXISTS idx_devhist_timestamp "
+            "ON DevicesHistory(timestamp)"
+        )
+
+        # Backfill any Devices rows that are missing a GUID so the history
+        # triggers can record changes for them.
+        sql.execute("""
+            UPDATE Devices
+            SET devGUID = lower(
+                hex(randomblob(4)) || '-' || hex(randomblob(2)) || '-' || '4' ||
+                substr(hex(randomblob(2)), 2) || '-' ||
+                substr('AB89', 1 + (abs(random()) % 4), 1) ||
+                substr(hex(randomblob(2)), 2) || '-' ||
+                hex(randomblob(6))
+            )
+            WHERE devGUID IS NULL OR TRIM(devGUID) = ''
+        """)
+
+        mylog("verbose", ["[db_history] DevicesHistory table and indexes ensured"])
+        return True
+    except Exception as e:
+        mylog("none", [f"[db_history] ERROR ensuring DevicesHistory table: {e}"])
+        return False
+
+
+def ensure_deviceshistory_triggers(sql) -> bool:
+    """
+    Drops and recreates the AFTER UPDATE and AFTER INSERT triggers on Devices.
+
+    Always drops first so that trigger logic is refreshed on every upgrade.
+
+    Parameters:
+        sql: database cursor (must support execute()).
+    """
+    try:
+        sql.execute("DROP TRIGGER IF EXISTS trg_devhist_update")
+        sql.execute("DROP TRIGGER IF EXISTS trg_devhist_insert")
+
+        update_sql = _build_update_trigger_sql()
+        insert_sql = _build_insert_trigger_sql()
+
+        sql.execute(update_sql)
+        sql.execute(insert_sql)
+
+        mylog("verbose", ["[db_history] DevicesHistory triggers created"])
+        return True
+    except Exception as e:
+        mylog("none", [f"[db_history] ERROR creating DevicesHistory triggers: {e}"])
+        return False
diff --git a/server/initialise.py b/server/initialise.py
index bf53c4942..3a31615a5 100755
--- a/server/initialise.py
+++ b/server/initialise.py
@@ -21,6 +21,7 @@
 from plugin import plugin_manager, print_plugin_info
 from utils.plugin_utils import get_plugins_configs, get_set_value_for_init
 from messaging.in_app import write_notification
+from utils.plugin_utils import list_to_csv
 
 # ===============================================================================
 # Language helpers
@@ -50,12 +51,6 @@ def _load_language_display_names():
 # ===============================================================================
 # Initialise user defined values
 # ===============================================================================
-
-# -------------------------------------------------------------------------------
-# Import user values
-# Check config dictionary
-
-
 # -------------------------------------------------------------------------------
 # managing application settings, ensuring SQL safety for user input, and updating internal configuration lists
 def ccd(
@@ -74,6 +69,43 @@ def ccd(
     overriddenByEnv=0,
     all_plugins=[],
 ):
+    """
+    Create or update a configuration setting entry and synchronise it across
+    in-memory config, plugin settings, and SQL-safe storage structures.
+
+    This function is responsible for:
+    - Resolving a setting value from defaults or existing config
+    - Sanitising text inputs for SQL safety
+    - Propagating updates into plugin configuration structures when
+      overridden by environment variables
+    - Maintaining both raw and SQL-safe representations of settings
+    - Storing optional JSON metadata alongside settings entries
+
+    Parameters:
+        key (str): Unique identifier for the setting.
+        default (any): Default value used if no existing config value exists.
+        config_dir (dict): Dictionary holding current runtime configuration.
+        name (str): Human-readable name of the setting.
+        inputtype (str): Type of input (e.g. "text", "number", etc.).
+        options (list|str): Allowed options or configuration constraints.
+        group (str): Logical grouping/category of the setting.
+        events (list, optional): Events triggered by changes to this setting.
+        desc (str, optional): Human-readable description of the setting.
+        setJsonMetadata (dict, optional): Additional metadata stored as JSON.
+        overrideTemplate (dict, optional): Template overrides (currently unused).
+        forceDefault (bool, optional): If True, ignores existing config value.
+        overriddenByEnv (int, optional): Flag indicating environment override.
+        all_plugins (list, optional): Plugin list for propagating updates.
+
+    Returns:
+        any: The resolved configuration value after processing.
+
+    Side Effects:
+        - Updates config_dir in-place
+        - Updates conf.mySettings and conf.mySettingsSQLsafe
+        - Updates plugin setting values if overridden by environment
+        - Adds/updates metadata entries for non-metadata keys
+    """
     if events is None:
         events = []
     if setJsonMetadata is None:
@@ -327,6 +359,26 @@ def importConfigs(pm, db, all_plugins):
         "[]",
         "General",
     )
+    conf.DEV_HIST_DAYS = ccd(
+        "DEV_HIST_DAYS",
+        1,
+        c_d,
+        "Device history retention (days)",
+        '{"dataType":"integer", "elements": [{"elementType" : "input", "elementOptions" : [{"type": "number"}] ,"transformers": []}]}',
+        "[]",
+        "General",
+        desc="Number of days to retain device change history. Set to 0 to completely disable the auditing engine.",
+    )
+    conf.DEV_HIST_TRACKED = ccd(
+        "DEV_HIST_TRACKED",
+        ['devMac', 'devName', 'devOwner', 'devType', 'devVendor', 'devFavorite', 'devGroup', 'devComments', 'devLastIP', 'devFQDN', 'devPrimaryIPv4', 'devPrimaryIPv6', 'devVlan', 'devForceStatus', 'devStaticIP', 'devScan', 'devAlertDown', 'devCanSleep', 'devSkipRepeated', 'devLocation', 'devIsArchived', 'devParentMAC', 'devParentPort', 'devParentRelType', 'devReqNicsOnline', 'devIcon', 'devSite', 'devSSID', 'devSyncHubNode'],  # noqa: E501
+        c_d,
+        "Device history tracked fields",
+        '{"dataType":"array","elements":[{"elementType":"select","elementHasInputValue":1,"elementOptions":[{"multiple":"true","orderable":"true"}],"transformers":[]},{"elementType":"button","elementOptions":[{"sourceSuffixes":[]},{"separator":""},{"cssClasses":"col-xs-12"},{"onClick":"selectChange(this)"},{"getStringKey":"Gen_Change"}],"transformers":[]}]}',  # noqa: E501
+        list_to_csv(['devMac', 'devName', 'devOwner', 'devType', 'devVendor', 'devFavorite', 'devGroup', 'devComments', 'devLastIP', 'devFQDN', 'devPrimaryIPv4', 'devPrimaryIPv6', 'devVlan', 'devForceStatus', 'devStaticIP', 'devScan', 'devAlertDown', 'devCanSleep', 'devSkipRepeated', 'devLocation', 'devIsArchived', 'devParentMAC', 'devParentPort', 'devParentRelType', 'devReqNicsOnline', 'devIcon', 'devSite', 'devSSID', 'devSyncHubNode', 'devSourcePlugin', 'devMacSource', 'devNameSource', 'devFQDNSource', 'devLastIPSource', 'devVendorSource', 'devSSIDSource', 'devParentMACSource', 'devParentPortSource', 'devParentRelTypeSource', 'devVlanSource', 'devCustomProps']),  # noqa: E501
+        "General",
+        desc="List of Devices column names to monitor for changes. Add or remove field names to control what gets audited.",
+    )
     conf.HRS_TO_KEEP_NEWDEV = ccd(
         "HRS_TO_KEEP_NEWDEV",
         0,
diff --git a/server/models/device_history_instance.py b/server/models/device_history_instance.py
new file mode 100644
index 000000000..9547ffff8
--- /dev/null
+++ b/server/models/device_history_instance.py
@@ -0,0 +1,285 @@
+"""
+device_history_instance.py — Query, group, and prune DevicesHistory records.
+
+Writes are handled entirely by SQLite triggers (trg_devhist_update /
+trg_devhist_insert) created in db/db_history.py. This class is read/prune only.
+"""
+
+from database import get_temp_db_connection
+from logger import mylog
+
+
+class DevicesHistoryInstance:
+
+    # -------------------------------------------------------------------------
+    # DB helpers (mirrors DeviceInstance pattern)
+    # -------------------------------------------------------------------------
+
+    def _fetchall(self, query, params=()):
+        conn = get_temp_db_connection()
+        rows = conn.execute(query, params).fetchall()
+        conn.close()
+        return [dict(r) for r in rows]
+
+    def _execute(self, query, params=()):
+        conn = get_temp_db_connection()
+        cur = conn.cursor()
+        cur.execute(query, params)
+        affected = cur.rowcount
+        conn.commit()
+        conn.close()
+        return affected
+
+    # -------------------------------------------------------------------------
+    # Public query API
+    # -------------------------------------------------------------------------
+
+    def get_grouped_history(self, devGUID, changedColumn=None, changedBy=None,
+                            limit=50, offset=0, sort=None, search=None):
+        """
+        Return grouped change history for a single device.
+
+        Rows are grouped by (timestamp, changedBy, devGUID). Pagination is
+        applied at the group level so that `limit` controls how many distinct
+        change events are returned, not how many individual field rows.
+
+        Args:
+            devGUID:       Device GUID to filter on (required).
+            changedColumn: Optional field-name filter — only groups that contain
+                           a change to this column are included.
+            changedBy:     Optional source filter (e.g. 'USER', 'ARPSCAN').
+            limit:         Max number of grouped events to return.
+            offset:        Number of grouped events to skip (for pagination).
+
+        Returns:
+            list[dict] each with keys: devGUID, timestamp, changedBy, changes
+        """
+        return self._query_grouped(
+            devGUID=devGUID,
+            changedColumn=changedColumn,
+            changedBy=changedBy,
+            limit=limit,
+            offset=offset,
+            sort=sort,
+            search=search
+        )
+
+    def get_all_grouped_history(self,
+                                changedColumn=None,
+                                changedBy=None,
+                                limit=50,
+                                offset=0,
+                                sort=None,
+                                search=None
+                                ):
+        """
+        Return grouped change history across all devices (global view).
+
+        Same behaviour as get_grouped_history but without a devGUID filter.
+        """
+        return self._query_grouped(
+            devGUID=None,
+            changedColumn=changedColumn,
+            changedBy=changedBy,
+            limit=limit,
+            offset=offset,
+            sort=sort,
+            search=search
+        )
+
+    def get_available_filter_values(self, devGUID=None):
+        """
+        Return distinct changedBy and changedColumn values present in the table.
+
+        Used by the frontend to dynamically populate filter dropdowns.
+
+        Args:
+            devGUID: If provided, scope to a single device.
+
+        Returns:
+            dict with keys 'changedBy' and 'changedColumn', each a sorted list.
+        """
+        where = "WHERE devGUID = ?" if devGUID else ""
+        params = (devGUID,) if devGUID else ()
+
+        by_rows = self._fetchall(
+            f"SELECT DISTINCT changedBy FROM DevicesHistory {where} ORDER BY changedBy",
+            params,
+        )
+        col_rows = self._fetchall(
+            f"SELECT DISTINCT changedColumn FROM DevicesHistory {where} ORDER BY changedColumn",
+            params,
+        )
+        return {
+            "changedBy": [r["changedBy"] for r in by_rows],
+            "changedColumn": [r["changedColumn"] for r in col_rows],
+        }
+
+    def get_total_group_count(self, devGUID=None, changedColumn=None, changedBy=None, search=None):
+        """
+        Return the total number of distinct change-event groups matching the
+        given filters. Used by the frontend to calculate total pages.
+        """
+        clauses, params = self._build_clauses(devGUID, changedColumn, changedBy, search)
+        where = f"WHERE {' AND '.join(clauses)}" if clauses else ""
+
+        rows = self._fetchall(
+            f"""
+            SELECT COUNT(*) AS cnt FROM (
+                SELECT DISTINCT timestamp, changedBy, devGUID
+                FROM DevicesHistory {where}
+            )
+            """,
+            tuple(params),
+        )
+        return rows[0]["cnt"] if rows else 0
+
+    # -------------------------------------------------------------------------
+    # Retention management
+    # -------------------------------------------------------------------------
+
+    def prune_history(self, days):
+        """
+        Delete DevicesHistory rows older than `days` days.
+
+        Called by the DBCLNP plugin during scheduled cleanup.
+
+        Args:
+            days: Retention window. Rows with timestamp older than this are
+                  deleted.
+
+        Returns:
+            int: Number of rows deleted.
+        """
+        if days <= 0:
+            mylog("verbose", ["[DevicesHistory] prune skipped — DEV_HIST_DAYS is 0"])
+            return 0
+
+        affected = self._execute(
+            "DELETE FROM DevicesHistory WHERE timestamp < datetime('now', ?)",
+            (f"-{days} days",),
+        )
+        mylog("verbose", [f"[DevicesHistory] pruned {affected} rows older than {days} days"])
+        return affected
+
+    # -------------------------------------------------------------------------
+    # Internal helpers
+    # -------------------------------------------------------------------------
+
+    @staticmethod
+    def _build_clauses(devGUID, changedColumn, changedBy, search=None):
+        clauses = []
+        params = []
+        if devGUID:
+            clauses.append("devGUID = ?")
+            params.append(devGUID)
+        if changedColumn:
+            clauses.append("changedColumn = ?")
+            params.append(changedColumn)
+        if changedBy:
+            clauses.append("changedBy = ?")
+            params.append(changedBy)
+        if search:
+            clauses.append("""
+                (
+                    devGUID LIKE ?
+                    OR changedBy LIKE ?
+                    OR changedColumn LIKE ?
+                    OR oldValue LIKE ?
+                    OR newValue LIKE ?
+                )
+            """)
+            like = f"%{search}%"
+            params.extend([like] * 5)
+        return clauses, params
+
+    def _query_grouped(self, devGUID, changedColumn, changedBy, limit, offset, sort, search):
+        """
+        Core fetch-and-group logic shared by all public query methods.
+
+        1. Fetch matching rows ordered by timestamp DESC.
+        2. Group by (timestamp, changedBy, devGUID) in Python.
+        3. Apply sorting at group level.
+        4. Apply pagination at the end.
+        """
+
+        clauses, params = self._build_clauses(devGUID, changedColumn, changedBy, search)
+        where = f"WHERE {' AND '.join(clauses)}" if clauses else ""
+
+        mylog("none", f"[HISTORY] SQL {where} params={params}")
+        mylog("none", f"[HISTORY] sort={sort}")
+        mylog("none", f"[HISTORY] sort type={type(sort)}")
+        mylog("none", f"[HISTORY] search {search} ")
+        mylog("none", f"[HISTORY] FINAL CALL limit={limit} offset={offset} sort={sort}")
+
+        rows = self._fetchall(
+            f"""
+            SELECT devGUID, timestamp, changedBy, changedColumn, oldValue, newValue
+            FROM DevicesHistory
+            {where}
+            ORDER BY timestamp DESC, changedBy, changedColumn
+            """,
+            tuple(params),
+        )
+
+        # ---------------------------
+        # 1. GROUP
+        # ---------------------------
+        groups = {}
+        order = []
+
+        for row in rows:
+            key = (row["timestamp"], row["changedBy"], row["devGUID"])
+
+            if key not in groups:
+                groups[key] = {
+                    "devGUID": row["devGUID"],
+                    "timestamp": row["timestamp"],
+                    "changedBy": row["changedBy"],
+                    "changes": [],
+                }
+                order.append(key)
+
+            groups[key]["changes"].append({
+                "changedColumn": row["changedColumn"],
+                "oldValue": row["oldValue"],
+                "newValue": row["newValue"],
+            })
+
+        grouped_list = [groups[k] for k in order]
+
+        # ---------------------------
+        # 2. SORT (group-level, stable)
+        # ---------------------------
+        if sort and len(sort) > 0:
+            s = sort[0]
+            field = s.get("field")
+            direction = s.get("order", "desc")
+
+            reverse = direction.lower() == "desc"
+
+            allowed_fields = {"timestamp", "changedBy", "devGUID"}
+
+            if field in allowed_fields:
+
+                def sort_key(x):
+                    val = x.get(field)
+
+                    # make timestamp safe for sorting
+                    if field == "timestamp":
+                        return val or ""
+                    return val
+
+                grouped_list = sorted(
+                    grouped_list,
+                    key=sort_key,
+                    reverse=reverse
+                )
+
+        # ---------------------------
+        # 3. PAGINATION (FINAL STEP ONLY)
+        # ---------------------------
+        start = max(offset or 0, 0)
+        end = start + (limit or 50)
+
+        return grouped_list[start:end]
diff --git a/server/models/device_instance.py b/server/models/device_instance.py
index 021c89d48..7455f87e2 100755
--- a/server/models/device_instance.py
+++ b/server/models/device_instance.py
@@ -3,6 +3,7 @@
 import re
 import sqlite3
 import csv
+import uuid
 from io import StringIO
 from front.plugins.plugin_helper import is_mac, normalize_mac
 from logger import mylog
@@ -724,7 +725,7 @@ def setDeviceData(self, mac, data):
                     data.get("devLastConnection") or timeNowUTC(),
                     data.get("devFirstConnection") or timeNowUTC(),
                     data.get("devLastIP") or "",
-                    data.get("devGUID") or "",
+                    data.get("devGUID") or str(uuid.uuid4()),
                     data.get("devCustomProps") or "",
                     data.get("devSourcePlugin") or "DUMMY",
                     data.get("devForceStatus") or "dont_force",
diff --git a/test/backend/test_device_history.py b/test/backend/test_device_history.py
new file mode 100644
index 000000000..fdcb580b0
--- /dev/null
+++ b/test/backend/test_device_history.py
@@ -0,0 +1,293 @@
+"""
+Unit tests for the DevicesHistory feature.
+
+Tests cover:
+  - AFTER INSERT trigger: new device logs tracked fields with oldValue=None
+  - AFTER UPDATE trigger: field change is logged with correct attribution
+  - AFTER UPDATE trigger: no-op when DEV_HIST_DAYS=0
+  - AFTER UPDATE trigger: field not in DEV_HIST_TRACKED is not logged
+  - DevicesHistoryInstance.get_grouped_history: groups and paginates correctly
+  - DevicesHistoryInstance.get_all_grouped_history: returns multi-device results
+  - DevicesHistoryInstance.get_available_filter_values: distinct values returned
+  - DevicesHistoryInstance.get_total_group_count: correct count
+  - DevicesHistoryInstance.prune_history: deletes old rows, skips at days=0
+"""
+
+import sys
+import os
+import unittest
+import unittest.mock
+from datetime import datetime, timezone, timedelta
+
+sys.path.insert(0, os.path.join(os.path.dirname(__file__), "..", "..", "server"))
+sys.path.insert(0, os.path.join(os.path.dirname(__file__), ".."))
+
+from db_test_helpers import make_history_db
+
+
+# ---------------------------------------------------------------------------
+# Shared fixture helpers
+# ---------------------------------------------------------------------------
+
+_TRACKED = "['devName', 'devVendor', 'devLastIP', 'devNameSource']"
+
+_INSERT_SQL = """
+    INSERT INTO Devices
+        (devMac, devGUID, devName, devVendor, devLastIP, devNameSource,
+         devAlertDown, devPresentLastScan, devIsNew, devIsArchived,
+         devFirstConnection, devLastConnection)
+    VALUES (?, ?, ?, ?, ?, ?, 0, 1, 0, 0,
+            datetime('now'), datetime('now'))
+"""
+
+
+def _insert_device(conn, mac, guid, name="Router", vendor="Cisco",
+                   last_ip="192.168.1.1", name_source="ARPSCAN"):
+    conn.execute(_INSERT_SQL, (mac, guid, name, vendor, last_ip, name_source))
+    conn.commit()
+
+
+def _history_rows(conn, guid=None, column=None):
+    """Fetch DevicesHistory rows, optionally filtered."""
+    clauses = []
+    params = []
+    if guid:
+        clauses.append("devGUID = ?")
+        params.append(guid)
+    if column:
+        clauses.append("changedColumn = ?")
+        params.append(column)
+    where = "WHERE " + " AND ".join(clauses) if clauses else ""
+    return conn.execute(
+        f"SELECT * FROM DevicesHistory {where} ORDER BY id", params
+    ).fetchall()
+
+
+# ---------------------------------------------------------------------------
+# Test cases
+# ---------------------------------------------------------------------------
+
+class TestInsertTrigger(unittest.TestCase):
+    """AFTER INSERT trigger fires for tracked fields on new device creation."""
+
+    def setUp(self):
+        self.conn = make_history_db(tracked=_TRACKED)
+
+    def tearDown(self):
+        self.conn.close()
+
+    def test_tracked_fields_logged_on_insert(self):
+        _insert_device(self.conn, "aa:bb:cc:00:00:01", "guid-insert-1",
+                       name="Router", vendor="Cisco")
+        rows = _history_rows(self.conn, guid="guid-insert-1")
+        columns_logged = {r["changedColumn"] for r in rows}
+        # devName and devVendor should always be logged (non-NULL in INSERT)
+        self.assertIn("devName", columns_logged)
+        self.assertIn("devVendor", columns_logged)
+
+    def test_old_value_is_null_on_insert(self):
+        _insert_device(self.conn, "aa:bb:cc:00:00:02", "guid-insert-2")
+        rows = _history_rows(self.conn, guid="guid-insert-2", column="devName")
+        self.assertEqual(len(rows), 1)
+        self.assertIsNone(rows[0]["oldValue"])
+        self.assertEqual(rows[0]["newValue"], "Router")
+
+    def test_source_attribution_from_source_field(self):
+        _insert_device(self.conn, "aa:bb:cc:00:00:03", "guid-insert-3",
+                       name_source="ARPSCAN")
+        rows = _history_rows(self.conn, guid="guid-insert-3", column="devName")
+        self.assertEqual(rows[0]["changedBy"], "ARPSCAN")
+
+    def test_untracked_field_not_logged(self):
+        # devOwner is not in _TRACKED so its change must not appear
+        _insert_device(self.conn, "aa:bb:cc:00:00:04", "guid-insert-4")
+        rows = _history_rows(self.conn, guid="guid-insert-4")
+        logged_cols = {r["changedColumn"] for r in rows}
+        self.assertNotIn("devOwner", logged_cols)
+
+
+class TestUpdateTrigger(unittest.TestCase):
+    """AFTER UPDATE trigger fires with correct values and attribution."""
+
+    def setUp(self):
+        self.conn = make_history_db(tracked=_TRACKED)
+        _insert_device(self.conn, "aa:bb:cc:01:00:01", "guid-upd-1")
+
+    def tearDown(self):
+        self.conn.close()
+
+    def test_name_change_logged(self):
+        self.conn.execute(
+            "UPDATE Devices SET devName='My Router', devNameSource='USER' WHERE devGUID=?",
+            ("guid-upd-1",)
+        )
+        self.conn.commit()
+        rows = _history_rows(self.conn, guid="guid-upd-1", column="devName")
+        # Two rows: INSERT (old=None) and UPDATE (old=Router)
+        update_rows = [r for r in rows if r["oldValue"] is not None]
+        self.assertEqual(len(update_rows), 1)
+        self.assertEqual(update_rows[0]["oldValue"], "Router")
+        self.assertEqual(update_rows[0]["newValue"], "My Router")
+        self.assertEqual(update_rows[0]["changedBy"], "USER")
+
+    def test_plugin_attribution(self):
+        self.conn.execute(
+            "UPDATE Devices SET devVendor='Netgear', devVendorSource='VNDRPDT' WHERE devGUID=?",
+            ("guid-upd-1",)
+        )
+        self.conn.commit()
+        rows = _history_rows(self.conn, guid="guid-upd-1", column="devVendor")
+        update_rows = [r for r in rows if r["oldValue"] is not None]
+        self.assertEqual(update_rows[0]["changedBy"], "VNDRPDT")
+
+    def test_no_change_no_row(self):
+        before = len(_history_rows(self.conn, guid="guid-upd-1"))
+        # Update with same value
+        self.conn.execute(
+            "UPDATE Devices SET devName='Router' WHERE devGUID=?",
+            ("guid-upd-1",)
+        )
+        self.conn.commit()
+        after = len(_history_rows(self.conn, guid="guid-upd-1"))
+        self.assertEqual(before, after)
+
+
+class TestDisabledGuard(unittest.TestCase):
+    """AFTER UPDATE trigger is silent when DEV_HIST_DAYS=0."""
+
+    def test_no_rows_when_disabled(self):
+        conn = make_history_db(dev_hist_days=0, tracked=_TRACKED)
+        _insert_device(conn, "aa:bb:cc:02:00:01", "guid-dis-1")
+        conn.execute(
+            "UPDATE Devices SET devName='Changed', devNameSource='USER' WHERE devGUID=?",
+            ("guid-dis-1",)
+        )
+        conn.commit()
+        rows = _history_rows(conn)
+        conn.close()
+        self.assertEqual(len(rows), 0)
+
+
+class TestDevicesHistoryInstance(unittest.TestCase):
+    """Tests for DevicesHistoryInstance query/prune methods."""
+
+    def setUp(self):
+        self.conn = make_history_db(tracked=_TRACKED)
+
+        # `device_history_instance` uses `from database import get_temp_db_connection`
+        # which creates a local reference.  We must patch THAT namespace, not the
+        # database module attribute.
+        import models.device_history_instance as _mod
+
+        _real = self.conn
+
+        class _NoClose:
+            def execute(self, *a, **kw): return _real.execute(*a, **kw)
+            def cursor(self): return _real.cursor()
+            def commit(self): _real.commit()
+            def rollback(self): _real.rollback()
+            def close(self): pass  # intentional no-op
+
+        self._patcher = unittest.mock.patch.object(
+            _mod, "get_temp_db_connection", return_value=_NoClose()
+        )
+        self._patcher.start()
+
+        _insert_device(self.conn, "bb:cc:dd:00:00:01", "guid-q-1",
+                       name="Alpha", vendor="Cisco")
+        _insert_device(self.conn, "bb:cc:dd:00:00:02", "guid-q-2",
+                       name="Beta", vendor="HP")
+        # One user update on guid-q-1
+        self.conn.execute(
+            "UPDATE Devices SET devName='Alpha v2', devNameSource='USER' WHERE devGUID='guid-q-1'"
+        )
+        self.conn.commit()
+
+        from models.device_history_instance import DevicesHistoryInstance
+        self.h = DevicesHistoryInstance()
+
+    def tearDown(self):
+        self._patcher.stop()
+        self.conn.close()
+
+    def test_get_grouped_history_returns_groups(self):
+        groups = self.h.get_grouped_history("guid-q-1")
+        self.assertGreater(len(groups), 0)
+        for g in groups:
+            self.assertEqual(g["devGUID"], "guid-q-1")
+            self.assertIn("timestamp", g)
+            self.assertIn("changedBy", g)
+            self.assertIsInstance(g["changes"], list)
+
+    def test_changedcolumn_filter(self):
+        groups = self.h.get_grouped_history("guid-q-1", changedColumn="devName")
+        for g in groups:
+            cols = [c["changedColumn"] for c in g["changes"]]
+            self.assertIn("devName", cols)
+
+    def test_changedby_filter(self):
+        groups = self.h.get_grouped_history("guid-q-1", changedBy="USER")
+        self.assertGreater(len(groups), 0)
+        for g in groups:
+            self.assertEqual(g["changedBy"], "USER")
+
+    def test_pagination(self):
+        all_groups = self.h.get_grouped_history("guid-q-1")
+        if len(all_groups) < 2:
+            self.skipTest("Not enough groups to test pagination")
+        page1 = self.h.get_grouped_history("guid-q-1", limit=1, offset=0)
+        page2 = self.h.get_grouped_history("guid-q-1", limit=1, offset=1)
+        self.assertEqual(len(page1), 1)
+        self.assertEqual(len(page2), 1)
+        # Pages must represent distinct groups (same key = (timestamp, changedBy, devGUID))
+        key1 = (page1[0]["timestamp"], page1[0]["changedBy"])
+        key2 = (page2[0]["timestamp"], page2[0]["changedBy"])
+        self.assertNotEqual(key1, key2)
+
+    def test_get_all_grouped_history(self):
+        groups = self.h.get_all_grouped_history()
+        guids = {g["devGUID"] for g in groups}
+        self.assertIn("guid-q-1", guids)
+        self.assertIn("guid-q-2", guids)
+
+    def test_get_available_filter_values(self):
+        filters = self.h.get_available_filter_values("guid-q-1")
+        self.assertIn("changedBy", filters)
+        self.assertIn("changedColumn", filters)
+        self.assertIsInstance(filters["changedBy"], list)
+        self.assertIsInstance(filters["changedColumn"], list)
+        self.assertGreater(len(filters["changedColumn"]), 0)
+
+    def test_get_total_group_count(self):
+        total = self.h.get_total_group_count("guid-q-1")
+        groups = self.h.get_grouped_history("guid-q-1", limit=1000)
+        self.assertEqual(total, len(groups))
+
+    def test_prune_history_zero_skips(self):
+        deleted = self.h.prune_history(0)
+        self.assertEqual(deleted, 0)
+
+    def test_prune_history_removes_old_rows(self):
+        # Manually insert an old row
+        self.conn.execute(
+            """INSERT INTO DevicesHistory (devGUID, changedColumn, oldValue, newValue, changedBy, timestamp)
+               VALUES ('guid-q-1', 'devName', 'old', 'new', 'system', datetime('now', '-30 days'))"""
+        )
+        self.conn.commit()
+        old_count = self.conn.execute("SELECT COUNT(*) FROM DevicesHistory").fetchone()[0]
+        deleted = self.h.prune_history(14)
+        new_count = self.conn.execute("SELECT COUNT(*) FROM DevicesHistory").fetchone()[0]
+        self.assertGreater(deleted, 0)
+        self.assertLess(new_count, old_count)
+
+    def test_prune_history_keeps_recent_rows(self):
+        before = self.conn.execute("SELECT COUNT(*) FROM DevicesHistory").fetchone()[0]
+        # prune with 365 days — nothing should be deleted from a fresh test DB
+        deleted = self.h.prune_history(365)
+        after = self.conn.execute("SELECT COUNT(*) FROM DevicesHistory").fetchone()[0]
+        self.assertEqual(deleted, 0)
+        self.assertEqual(before, after)
+
+
+if __name__ == "__main__":
+    unittest.main()
diff --git a/test/db_test_helpers.py b/test/db_test_helpers.py
index afb941dbe..e9ca7c44e 100644
--- a/test/db_test_helpers.py
+++ b/test/db_test_helpers.py
@@ -7,6 +7,7 @@
     sys.path.insert(0, os.path.join(os.path.dirname(__file__), ".."))
     from db_test_helpers import make_db, insert_device, minutes_ago, DummyDB, down_event_macs, make_device_dict, sync_insert_devices
     from db_test_helpers import make_plugin_db, make_plugin_dict, make_plugin_event_row, seed_plugin_object, plugin_history_rows, plugin_objects_rows, PluginFakeDB
+    from db_test_helpers import make_history_db
 """
 
 import sqlite3
@@ -17,6 +18,7 @@
 # Make the 'server' package importable when this module is loaded directly.
 sys.path.insert(0, os.path.join(os.path.dirname(__file__), "..", "server"))
 from db.db_upgrade import ensure_views  # noqa: E402
+from db.db_history import ensure_deviceshistory_table, ensure_deviceshistory_triggers  # noqa: E402
 
 
 # ---------------------------------------------------------------------------
@@ -144,6 +146,41 @@ def make_db(sleep_minutes: int = 30) -> sqlite3.Connection:
     return conn
 
 
+def make_history_db(dev_hist_days: int = 14,
+                    tracked: str = "['devName', 'devVendor', 'devLastIP', 'devNameSource']") -> sqlite3.Connection:
+    """
+    Return an in-memory SQLite connection with DevicesHistory fully set up.
+
+    Extends make_db() by adding the DevicesHistory table, indexes, and the
+    AFTER UPDATE / AFTER INSERT triggers. Settings rows for DEV_HIST_DAYS
+    and DEV_HIST_TRACKED are pre-inserted.
+
+    DEV_HIST_TRACKED is stored as a Python list literal string (e.g.
+    \"['devName','devVendor']\") matching the settings engine and the SQLite
+    trigger's instr(..., '''field''') membership check.
+
+    Args:
+        dev_hist_days: Value for DEV_HIST_DAYS setting (0 disables tracking).
+        tracked:       Python list literal string for DEV_HIST_TRACKED.
+    """
+    conn = make_db()
+    cur = conn.cursor()
+    cur.execute(
+        "INSERT OR REPLACE INTO Settings (setKey, setValue) VALUES (?, ?)",
+        ("DEV_HIST_DAYS", str(dev_hist_days)),
+    )
+    cur.execute(
+        "INSERT OR REPLACE INTO Settings (setKey, setValue) VALUES (?, ?)",
+        ("DEV_HIST_TRACKED", tracked),
+    )
+    conn.commit()
+    ensure_deviceshistory_table(cur)
+    conn.commit()
+    ensure_deviceshistory_triggers(cur)
+    conn.commit()
+    return conn
+
+
 # ---------------------------------------------------------------------------
 # Time helpers
 # ---------------------------------------------------------------------------