19 October 2026
In ShadowTrackr, anything you can write as a query can become an alert. That's powerful, but it has an obvious problem: a blank query box doesn't tell you what's worth alerting on. So there are now two things to help.
The alerts documentation has a set of example alerts. Under each query is a Run in ShadowTrackr link that shows what the query finds in your own data today. If the result looks right, paste the query in a new alert and set the trigger to is greater than 0.
A few examples:
index=events change=tcp_port_opened:3389 earliest=-1dindex=cves_assets cvss_score>=7 first_seen>-1dindex=events change=security_header_removed earliest=-1dAlways add earliest=-1d to event queries. Without it the query also counts old events, so it keeps matching, and an alert that fires once a day will fire again every day.
I also wrote up the change= syntax. A single scan can change several things at once, and you still get one event on your timeline ("3 ports opened on host X"). With change=<field>:<value> you can alert on one specific value inside such an event, like port 3389 or protocol_added:TLS 1.0. This works for ports, certificates, DNS records and websites. Only events from after this feature was introduced can be matched, so older events won't show up.
Examples are nice, but copy-pasting is still work. So in the app, under Alerts → Alert library, you'll now find ready-made templates for the things most people want to know about. Pick one, adapt it if you like, and create it as your own alert. Every template fires when its query returns more than 0 results, and is throttled to at most once a day.
What's in there, by category:
Vulnerabilities
Hosts and ports
Certificates
Domains and DNS
Websites
Assets and discovery
Data leaks
I picked these because they catch the stuff that goes wrong quietly. Nobody tells you that a deployment dropped your Content-Security-Policy header, or that the nameservers of a domain changed at the registry (which is how domains get hijacked). A certificate renewal that silently failed shows up as a browser warning for your visitors, unless you had an alert that told you two weeks earlier.
shadowtrackr.com in the query. Don't forget to change that to your own domain.If you have an alert you'd like to see in the library, let me know. The full documentation is in the alert library section of the docs.
Two things this time: a new compliance report for post-quantum cryptography, and a redesigned weekly PDF report.
Attackers can record encrypted traffic today and decrypt it once quantum computers are powerful enough. This is called "harvest now, decrypt later", and it is the reason quantum-safe encryption matters now, not in ten years. The new Post-Quantum Cryptography Readiness report shows for each of your servers whether its encryption is quantum-safe.
We check web encryption (TLS) and remote login (SSH) on every server. Each server gets one of five statuses: Quantum-safe, Partly quantum-safe, Outdated version, Not quantum-safe, or Not checked yet. It also gets a score from A+ to F. Those scores are averaged into one score for your organisation.
Addresses behind a service like Cloudflare show that service's settings, not your own server's. The report marks these, and gives a separate score for your own servers, so a CDN doesn't hide (or inflate) your real position.
You can get the report with the query $post_quantum_cryptography_report, or activate it from the report library. More details are in the documentation.
The weekly PDF report that lands in your inbox on Monday morning has a new format. It now includes a summary of:
The goal is a more actionable report with better insight into how to reduce your risk. The previous format had too many long rows of results, which for some of you made it hard to see where to start. The new format gives you the overview first. The full detail is still one click away in ShadowTrackr, and you can still use the individual reports to get every row.
The weekly PDF is still the only report that is emailed by default, and you can add as many recipients as you like. They don't need a ShadowTrackr account.
Please let us know what you think. If something is missing, unclear or just not useful, send us feedback. We use it to decide what to improve next.