Install & host

ChangeIntel is one web application you run on your own Windows server or container platform. The public pages need no credentials, and your Microsoft 365 tenant and device data stay inside your network.

Downloads are not published yet. This page shows how installation works so you can plan for it. For early access, contact Evotec.

Windows Service

For a Windows server behind your HTTPS reverse proxy, such as IIS or a load balancer.

Not published yet

Install the ASP.NET Core 10 Hosting Bundle, then extract the files to a folder such as C:\Services\ChangeIntel.

From an elevated PowerShell prompt, register and start the service on a local port, with the address people will use:

sc.exe create ChangeIntel binPath= '"C:\Services\ChangeIntel\ChangeIntel.Web.exe" --urls http://127.0.0.1:5083 --HostProfile:PublicBaseUrl https://changeintel.example.com/' start= auto obj= 'NT AUTHORITY\LocalService'
sc.exe start ChangeIntel

Check that it is ready, then publish it through your HTTPS proxy:
```
Invoke-WebRequest http://127.0.0.1:5083/readyz
```

Container

For Docker, Podman, or Kubernetes. The image runs as a non-root user on port 8080.

Image not published yet

Run it with a volume so the public history survives restarts:

docker run -d --name changeintel -p 127.0.0.1:8080:8080 \
  -v changeintel-data:/data \
  -e PublicArchive__DatabasePath=/data/public.db \
  -e HostProfile__PublicBaseUrl=https://changeintel.example.com/ \
  <image>

Point health probes at /healthz and readiness probes at /readyz.
Keep port 8080 private and put HTTPS in front of it. The public address is required: page, feed, and calendar links are built from it, never from the request's Host header.

Before you start

What you need

A Windows server or container host. No database server: public history is an optional SQLite file.
An HTTPS reverse proxy for anyone other than you. ChangeIntel listens on plain HTTP locally.
Outbound HTTPS (port 443) to the hosts listed under Firewall. Nothing needs to reach the server from the internet.
For Level 2 only: an Entra app registration and an administrator to grant read-only Graph permissions.

Firewall

Hosts this configuration contacts

Generated from the sources enabled on this site. Removing a feed or source removes its host. Redirects are not followed.

andrewstaylor.com
api.first.org
api.msrc.microsoft.com
blogs.windows.com
borncity.com
builds.dotnet.microsoft.com
clients.config.office.net
definitionupdates.microsoft.com
devblogs.microsoft.com
developer.microsoft.com
edgeupdates.microsoft.com
evotec.xyz
jeffreyappel.nl
learn.microsoft.com
msendpointmgr.com
office365itpros.com
oofhours.com
patchmypc.com
petri.com
techcommunity.microsoft.com
www.askwoody.com
www.cisa.gov
www.microsoft.com

Turn on what you need

About the data layers

Level 1

Public Microsoft knowledge

Works out of the box with no credentials: Windows releases, security updates and CVEs, the Microsoft 365 roadmap, versions, lifecycle dates, and blogs. Choose sources and add your own RSS feeds under PublicSources in appsettings.json.

{ "Id": "my-blog", "Name": "Our IT blog", "Topic": "Windows", "Kind": "Community",
  "FeedUrl": "https://blog.example.com/feed/",
  "HomepageUrl": "https://blog.example.com/" }

Level 2

Your Microsoft 365 tenant

Message Center notices, service health, and incidents next to the public roadmap, visible only to signed-in team members. Register a single-tenant Entra web app with the ChangeIntel.Reader role, and a separate app with admin-consented ServiceMessage.Read.All and ServiceHealth.Read.All. Supply secrets through environment variables or a secret store, never in appsettings.json.

HostProfile__Mode=Internal
HostProfile__TeamSignInEnabled=true
HostProfile__MicrosoftTenantEnabled=true

See the Level 2 preview

Level 3

Your devices

Windows Update and assessment evidence from ComputerX and TestimoX, matched with public KBs and exploited CVEs. The import contract is defined; the importer is not built yet, so this layer cannot be turned on.

See the Level 3 preview