Documentation Index

Fetch the complete documentation index at: https://docs.darwinium.com/llms.txt

Use this file to discover all available pages before exploring further.

Release Notes 1.5.21

  • Published on Jul 16, 2026
  • 3 minute(s) read
  • MB
 Prev Next

1.5.21 - June 21, 2025

This release delivers powerful new capabilities to support fraud investigation workflows, enhance integration flexibility, and improve profiling and SDK performance.

Incident Management (General Availability)

The new Incident Management module empowers fraud teams to triage, investigate, and resolve suspicious activity with greater efficiency. Available to all customers, this feature introduces:

  • Queue Management: Define incident queues (e.g., "Payment Fraud", "Account Takeovers") and assign them to specific teams. Supports like the ability to rank based on transaction amount or risk.

  • Incident Grouping: Automatically group related events by shared identifiers or rule-based logic to reduce noise and boost context.

  • Custom Close Actions: Define tailored resolution actions such as applying labels, modifying event attributes, or notifying external systems (e.g., Jira).

  • Time Tracking: Built-in time tracking and overflow logic help manage workload and optimize analyst performance.

  • Flexible Configuration: Admins can manage teams, queues, grouping logic, and close actions via an intuitive UI.

  • Integration into the investigations portal

    • The ability to search for events contained in one or more incidents. Also includes the ability to search for incident related events

    • Customized visualizations and column display based on the type of incident

Read more about Incident Management

Darwinium Outpost

Darwinium Outpost allows you to host a Darwinium API endpoint within your own AWS infrastructure. This setup:

  • Encrypts and processes PII within your own Amazon Infrastructure.

  • Avoids exposing PII to Darwinium’s hosted environment.

  • Is deployed as an AWS Lambda fronted by AWS API Gateway.

This functionality is available to all customers but typically suited to organizations with specific compliance or residency requirements

Engine Enhancements

Quantile UI Calculation Improvements - Improvements to feature quantile calculations within the portal make percentile distribution visualization faster and more accurate, particularly with uneven datasets.

Python SDK v2.0 with Event Query Support

Our Python SDK now supports querying event data via the same filters available in the Darwinium portal:

  • Run queries offline in your own notebooks via mTLS-secured APIs.

  • Optional integration with your S3 bucket to directly access raw event data.

  • All PII is returned as hashes (decryption is not supported).

SDK integration requires granting read access to the S3 bucket where Darwinium writes event data.

Profiling Model Improvements

  • Updated VPN and proxy detection using new IP-based attributes.

  • New Signals:

    • Malware detection (is_malware)

    • Trusted client indicator (is_trusted)

    • Click position capture for bot and AI agent detection

  • Android Root Detection Enhancements:

    • Expanded root kit detection (Magisk, Frida, etc.)

    • New forensic signals (frida_port, boot_state, scanned packages)

    • Support for React Native applications

  • Agentic Browser Detection

    • ability to detect and identify common browser tooling used by AI agents (such as browser-use)

These updates are non-breaking and expand the profiling model schema.

Integration Enhancements

  • New attribute auth_token_tie enables reliable journey tracking in contexts where cookies can’t be used (e.g., mobile apps, JWT auth).

  • Cloudflare: Support for Account-level API tokens.

  • Glob matching for URLs: Extended wildcard support for both single (*) and multi-path (**) patterns.

  • Improved Cloudflare log support during deployment.

Note: auth_token_tie requires explicit journey configuration by the customer. Please reach out to Darwinium support if you require help setting this up

Darwinium Portal UI Improvements

Investigations

  • The timeseries widgets are now zoomable - enabling investigators to easily refine date ranges based on graph observations

  • Ability to instantly add timeseries visualizations for attributes from the table column context menu

Dashboards

  • statistics-of dashboard - Allows users to configure and view flexible graph summarization of numerical attributes over time

    • Allow min, max, mean and quantiles (including median, quartile, decile, percentile, etc) to be calculated over a custom time slice.

    • Allows statistics to be collated over one or more attributes. Step, region, platform, browser, affiliate/brand, application version, etc.

  • model boxplot dashboard - enables quick visualization of model distribution and mean/lower quartile/upper quartile performance

Sidebar

  • Remembers width across sessions

  • now Displays when a label was removed for an identifier

  • Proxy actions are now included in signals/scores

  • Allows search on individual signals from sidebar.

  • Inline signal documentation in sidebar.

Event Comparison

  • Device Signature Visualization: When comparing 2 events, it is often useful to understand the probability that they are from the same physical device and the attributes that contributed to that probability. It acts a s a great starting point when looking at a bad device identifier (or one associated with fraud) to understand the attributes (for example the IP prefix) where a fraud investigator might want to start looking for other events.

Tables

  • Group-by support - note: group by does not support server-side grouping (ie it applies to the 1000 events in a given page)

Search

  • Improvements to the editor syntax and more context-aware autocomplete with awareness of attributes, functions, signals, labels etc. Use tab to quickly adjust contexts

Bug Fixes

  • Fixed crash in journey editor when setting call_url timeout

  • Resolved SDK GUID instability

  • Identifiers view now displays events and sidebar context more clearly