1.5.20 - March 03, 2025
Profiling
Device signature enhancements
Our device signature now considers temporal attribute changes to improve matching accuracy, reducing false positives from unlikely short-term changes and strengthening long-term associations.
Joint attributes enhance correlation-based matching, further minimizing false positives.
Additionally, VPN and proxy detection improves identification when devices switch networks to obscure their identity.
Port scanning / RAT Detection improvements
Profiling now provides the ability to check for open ports on commonly used remote access tooling such as teamviewer, anydesk, VNC, and RDP.
This intelligence is coupled with our existing RAT profiling to provide deep insights into whether a users device has been potentially compromised or in-use by a malicious remote actor
Automation detection
Our profiling now provides the ability to detect various headless browsers and browser automations such as puppeteer or selenium, which are frequently used in malicious attacks.
App cloning detection
New global signals trigger on app cloning and use of multiple profiles
Engine
Quantile Features
All features now have the optional ability to generate quantiles.
Quantiles values can be used to identify anomalies in comparison with an identifier or the overal population
These can be used to set adaptive thresholds. The feature values adjust according to population and user norms, providing model drift protection.
Probability of Time Feature
The probability of time feature assigns a probability (0–1) to indicate confidence in activity patterns, with higher values signaling unusual behavior.
The event count provides context for quantile values, with new sidebar widgets visualize usage patterns, including average velocity and confidence bands.
The user activity timing helps detect anomalies like account takeovers and automation.
Journeys
New rules for handling cookies , JWTs & base64 encoded content
We've enhanced data extraction from Cookies and JWT claims with new rules:
Extract from JWT – Retrieves JSON paths from the header or payload (extraction only, no signature validation).
Extract from Base64 – Decodes and extracts content from Base64-encoded strings.
String Key-Value Pair Extraction – Designed for Cookie value extraction but adaptable to other formats.
See here
Journey Debugger
The workflows editor now includes a built-in journey debugger, allowing you to test journey changes, validate data mappings, and ensure features and rules function correctly.
It uses a forward proxy server for testing and introduces a visual debugger to replace the previous command-line-only option.
Portal Improvements
Aggregate stats dashboard for investigations
Fully configurable widget that enables summarization of events shown in the investigations view- such as “the count of events”, “most common ip address”, etc.
Key identifier dashboard widget
The Key Identifier widget is designed for forensics queries, and enables selecting an event where a specific identifier (such as an IP address) is the mode (i.e. most-common value) for the search results.
This widget can be customized to show any attributes or details from the sample event
Syntax highlighting
Provides coloring for search terms that enables attributes and constants to be visually distinguished and more-easily read in the system.
Multi-event compare/list capability
Multiple events can be selected from the grid in investigations.
New functionality provides a quick comparison of differences in event identifier values, as well as a map showing captured geolocations.
Furthermore the portal now supports labeling of multiple events at once.
Improvements to cookies UI in journey editor
When implementing web-based journey tracking, cookies are a critical piece needed to join multiple events under the same Journey ID.
Our journey editor UI now includes imrpovements to how this functionality is displayed and communicated with journey authors
TOTP enforcement for non-sso users
Although it is mandatory for all production instances to bring their own SSO Identity provider, this functionality ensures non-production users authenticate with a second-factor step up (Google Authenticator or others)
Condition support in topx dashboard
Add query expressions that are applied as additional conditions to filter results
Journey sankeys in investigations
The journey sankeys view enables an operator to see, in aggregate, the flow of traffic between mapped steps for a given set of search results.
Through visual inspection, a user is potentially able to identify anomalies and potentially business logic abuse
Features UI Visibility
The features display in the sidebar has also been extensively updated to sort feature values - with unusual items (whose quantiles sit at the upper-and-lower extremes) shown first, and with color coding to suggest that they may be unusual.
Users may also now hide features in the system whose values remain at their defaults