XDRagon Monitor ships continuously.
Here's what's new.

A dedicated AI SOC landing page with traffic-light AI status, a clear "AI-handled vs. waiting for your decision" split, top-risk focus cards, and one-click Confirm / Dismiss / Escalate. Everything the AI does for you, visible in one place.

New threat indicators are automatically matched against up to 180 days of your historical events — IPs, domains, URLs, and file hashes. A "Historical Hits" view, on-demand backfill with progress, and alerts on critical finds mean yesterday's blind spot is caught today.

Default credentials are gone. The admin account is now bootstrapped with a strong, one-time-displayed password, and bootstrap admins must set a new password on first login — no fresh install ever runs with a known credential.

Notification tokens, threat-feed keys, and firewall credentials are stored encrypted in the database instead of plaintext config, masked in every API response, and revealed in the UI only briefly on explicit request.

The guided wizard for switching between Integrated, Segmented, and Physical Diode modes works end-to-end again — preview the change, see the feature impact, then commit, all from the UI.

External enrichment now round-trips through the relay, so results reach the platform while the backend never touches the internet directly — including securely relayed API keys for keyed providers.

Every asset now has its own detail page with a risk-score breakdown, its vulnerabilities, and its alerts — deep-linked from the patch table, dashboard widgets, and the vulnerabilities page.

Community Sigma rules matched against network events are now fully inspectable, with match history per rule — so you can see exactly why a rule fired and how often it fires over time.

Per-host process baselines and per-user login baselines detect anomalies like impossible travel, credential stuffing, unusual admin logins, and off-hours activity — with login heatmaps and per-entity behavior profiles.

A dedicated vulnerabilities view ranks every CVE finding across your assets by known exploitation, severity, and asset criticality — with a ransomware filter — so limited patching time goes where it matters most.

Syslog parsers for FortiGate, Sophos XG/XGS, UniFi/EdgeOS, and OPNsense join pfSense — with automatic detection and step-by-step setup guides per vendor, built for the firewalls SMBs actually run.

An AI-drafted GDPR Article 33 notification with a 72-hour deadline countdown and saved drafts, plus a ZIP export of your evidence mapped to ISO 27001 Annex A — honest about any gaps it finds.

A three-step wizard turns an AI incident into an Article 23 notification draft and PDF, with the 24-hour, 72-hour, and 30-day deadlines tracked automatically and urgency banners so nothing slips.

Every release ships with keyless Sigstore attestation of its SBOM and source archive. One command verifies that what you downloaded is exactly what was built — provable supply-chain integrity.

Your domains are monitored against Have I Been Pwned. A known breach combined with a login from a new IP is escalated as a compound anomaly, and breach exposure shows up directly in behavioral profiles.

Network-graph analysis spots pivot hosts and new subnet crossings against your baseline, automatically opening MITRE-mapped incidents — and later showing attack duration to distinguish automated from hands-on movement.