https://shadowtrackr.com/blog Updates on ShadowTrackr development en-us https://shadowtrackr.com/blog/parked-assets-and-website-security-score https://shadowtrackr.com/blog/parked-assets-and-website-security-score Last week’s update had two unforeseen effects. The first is that the discovery algorithm update caused ShadowTrackr to discover a lot more assets in some cases. We expected to find a little more, and that happened on most accounts. However, some accounts have public IP ranges where DNS records have been enumerated for every IP address. These were all added as assets. For two multi-tenant accounts, this resulted in tens of thousands of extra assets that only added noise. These extra assets are rarely accessible from the internet (or are not even up). ShadowTrackr now recognizes these types of assets and puts them under “parked URLs” and “parked hosts”. Parked assets do not count towards your total assets, so you are not paying for them. They are checked randomly every 10–20 days, and if they are found to be up, they are moved to your regular monitored assets. The second effect was that the new, faster website security checks also included a change in scoring. This was done to keep the scoring in line with the Mozilla Observatory scores. The scoring has become stricter, so some sites that had a decent score before now have lower scores. As usual, the website pages show a breakdown of the scoring and provide tips on how to improve your grade. This week, we’ll be doing a major refactor of the events index. Our goal is to provide you with more useful events and alerts, but to get there and be able to scale up further, we need to go through this first. You should not notice anything during the migration, as it will run in the background. Mon, 24 Aug 2026 00:00:00 +0000 https://shadowtrackr.com/blog/ncsc-nl-vulnerabilities-report https://shadowtrackr.com/blog/ncsc-nl-vulnerabilities-report This week's update is actually a big update on a lot of scanner node modules. This is a quality improvement, but not one that will stand out particularly if you are using the GUI. You'll just have better quality results. What does stand out to end users is the new $ncsc_vulnerabilities_report. Since we track all advisories from the Dutch NCSC now, we can provide reports on the CVE numbers in those reports that are relevant for the software we have detected on your assets. Will the most pressure to resolve these CVEs is on government and public organizations, it is a good idea for everyone to prioritise these. These vulnerabilities have been picked out of the bulk for a good reason. Mon, 17 Aug 2026 00:00:00 +0000 https://shadowtrackr.com/blog/single-sign_on-(sso)-now-available https://shadowtrackr.com/blog/single-sign_on-(sso)-now-available Short post today, but one with impact. ShadowTrackr now supports Single Sign-On from Microsoft Azure AD/Entra ID, Okta and any generic OIDC (like Keycloak). The option is available for enterprise accounts and up under Settings->Security. Mon, 10 Aug 2026 00:00:00 +0000 https://shadowtrackr.com/blog/central-tracking-of-resolved-vulnerabilities https://shadowtrackr.com/blog/central-tracking-of-resolved-vulnerabilities Vulnerabilities can go away for several reasons. The software can be patched, the CVE can be withdrawn, it might have been flagged as a false positive. So far, this information would be spread throughout ShadowTrackr indexes. This week's update is a major overhaul of the cves_assets index. It now tracks what happened to all your vulnerabilities. There are three new fields available: resolved, resolved_at and resolved_reason. it might take a few days for all states to settle in their new values. You can easily get an overview of recent resolved cves with this query: index=cves_assets resolved=true resolved_at>-7d There is a report available for this in our Report Library Along with this change we cleaned up the false positives registration. It now only contains the things you explicitly marked as false positives. The automaticly flagged false positives are gone from the GUI. For larger organizations this only generated a lot of noise and was not useful. Mon, 03 Aug 2026 00:00:00 +0000 https://shadowtrackr.com/blog/new-vulnerabilities-matching-algorithm https://shadowtrackr.com/blog/new-vulnerabilities-matching-algorithm The ShadowTrackr internal CVE database has been updated and augmented with new information. This allows us to better track and help you prioritise your risks from vulnerabilities. Check out our new Vulnerability management documentation to learn more. A big part of the update is the ShadowTrackr CVSS Score. It is a CVSS v4 score, but unlike like the MITRE and NVD score we keep the threat group value (Exploit maturity) included in the final score. If a PoC exists or active attacks are known, the score will be higher. If not, it will be lower. We track a lot of sources for exploit status to keep the score accurate. If you want, you can query our internal cves index for specific fields in the CVSS v4 vectorstring, or you can check our logs of changes to a CVE (when was an exploit found, when did CISA include it in the KEV, etc.). These options are also avaible for your cves_assets index. The algorithm matching your software against vulnerabilities has also improved. It can find more complex matches and has less false positives. You might notice a different number of CVEs found in this weeks reports. Mon, 27 Jul 2026 00:00:00 +0000 https://shadowtrackr.com/blog/branded-pdf-reports https://shadowtrackr.com/blog/branded-pdf-reports The option to customize all pdf reports that ShadowTrackr sends is now available by default for all multi-tenant accounts. Look under Group settings in the left hand menu, and you'll find Branding You can set your own logo instead of the ShadowTrackr logo, and even change the default ShadowTrackr color in the pdf to match your brand. This is especially useful for MSSPs. Mon, 06 Jul 2026 00:00:00 +0000 https://shadowtrackr.com/blog/revamped-alerts-gui https://shadowtrackr.com/blog/revamped-alerts-gui The alerts GUI has undergone a major UX upgrade. While working on a query for an alert, you can now see the live results. This will make it easier to fine tune it. The actions to take (send emails, call webhooks) have moved to a second tab to clear up the screen. You can still send alerts to any email account, even if they are not ShadowTrackr users. There is also a third tab where you can select the fields you want to include in the results that are sent. The default fields are preselected. It was possible to do this before with advanced query syntax, but seeing which fields are available and ticking the boxes for the ones you want is just much easier. The email format has changed a bit and should allow you to better interpret the alert context. Some of these improvements, like the email format and third tab to select output fields, have been added to the reports GUI as well. Mon, 29 Jun 2026 00:00:00 +0000 https://shadowtrackr.com/blog/alerts-for-multi_tenant-accounts https://shadowtrackr.com/blog/alerts-for-multi_tenant-accounts This week's update is a major one. The pricing structure has changed so that resellers, MSSPs and others that need a multi-tenant account can now register for online credit card subscription. It's still possible to work with purchase orders, but for those that want simplicity and speed there now is a better option. Also, since we're fully European now prices are in Euros instead of in Dollars. The numbers are the same, which means a slight increase in price. This covers our increased costs. All existing accounts, including the current online credit card subscriptions, will stay on the old price levels for now. Since multi-tenant use is increasing we also put more development in multi-tenant features. Alerts and the alert library are now available on the group level in multi-tenant accounts. This means you can set an alert for a specific event happening in any of the organizations in your group account. Please note that there still is a lot in the development pipeline for alerts. Some of you handed in wishlists with useful request for alerts, and we intent to support all of them. Mon, 15 Jun 2026 00:00:00 +0000 https://shadowtrackr.com/blog/new:-supplier-dependency-report https://shadowtrackr.com/blog/new:-supplier-dependency-report ShadowTrackr has been gathering supplier information for your assets for while now, and we've been expanding that. For each supplier, we now track where the corporate seat is and if it is Sovereign European (focused on having EU only dependencies), Fully European (no outside EU control), a European Subsidiary (non-European controlling party), or Non-European. Given the current drive in Europe to achieve more independence from Non-European countries, the new Supplier Dependency Report might be of help. It shows a worldmap with the countries where the suppliers of your assets, and allows you to drill down on details. Here are some example queries to see results for your organization: $supplier_dependency_report country="united states" $supplier_dependency_report control="Non-European" or "European subsidiary" Mon, 18 May 2026 00:00:00 +0000 https://shadowtrackr.com/blog/set-custom-ids-for-assets https://shadowtrackr.com/blog/set-custom-ids-for-assets If you have an internal asset management system or CMDB that has its own IDs, you can now add those as custom IDs to ShadowTrackr through the API. The IDs will come back with API results and can be used to select in queries. If set they are also shown in the GUI (but you cannot set them there at the moment). A custom_id does not have to be unique. You can have a single ID for multiple ip addresses or urls. Mon, 11 May 2026 00:00:00 +0000 https://shadowtrackr.com/blog/automatic-false-positive-detection-update https://shadowtrackr.com/blog/automatic-false-positive-detection-update The TLS and SSL tests come up with quite a lot of results for some older vulnerabilities. These might be a thing for legacy systems, but are almost always fixed in modern systems. That does not always show on the outside and clogs up the vulnerability overviews. You can of course mark them as false positives, but since there can be quick a lot we changed the default. The following vulnerabilities are now by default marked as false positive: CVE-2011-3389, CVE-2013-0169, CVE-2013-3587, CVE-2014-0224. Mon, 11 May 2026 00:00:00 +0000 https://shadowtrackr.com/blog/big-ui-update-for-better-ux https://shadowtrackr.com/blog/big-ui-update-for-better-ux The Shadowtrackr User Interface has organically grown over the years. This is a nice way of saying that it got a bit inconsistent and at some places rather ugly even. This weeks update brings consistency back and adds a better overall user experience. Mon, 04 May 2026 00:00:00 +0000 https://shadowtrackr.com/blog/trouble:-it's-always-dns-:_( https://shadowtrackr.com/blog/trouble:-it's-always-dns-:_( After moving the domain and DNS registry to a European provider, it turns out that new provider doesn't sail as smooth as the old one. Some of you might have problems with anycast and DNSSEC for our domain, and I'm not sure the new provider is handling this well. We might have to move again, apologies for the trouble. Tue, 28 Apr 2026 00:00:00 +0000 https://shadowtrackr.com/blog/domain-and-dns-moved-to-eu https://shadowtrackr.com/blog/domain-and-dns-moved-to-eu Another step in reducing dependencies on providers from outside the EU was completed today. All DNS and Domain records have moved from a US company to Openprovider in The Netherlands. Mon, 20 Apr 2026 00:00:00 +0000 https://shadowtrackr.com/blog/data-model-updated,-new-detections https://shadowtrackr.com/blog/data-model-updated,-new-detections After updating the API documentation and magic queries, it was now time to update the data model. You'll find all indexes, fields, their datatypes and descriptions. For some indexes it's straight forward, but an index like DNS has many undescriptive fields (k, t, etc.) derived from the underlying DNS records that can be quite confusing without proper documentation. Besides this, a bunch of new and revised detections have gone to production, along with some bug fixes in the GUI. Mon, 13 Apr 2026 00:00:00 +0000 https://shadowtrackr.com/blog/shadowserver-integration-updated https://shadowtrackr.com/blog/shadowserver-integration-updated There is a lot of development going on, but not everything is directly visible. So we'll not bore you with details and stick to the useable stuff. We recently added integration with Shadowserver.org. Up until now, their data was only used for discovery. For multi-tenant users, each organization had to enter the API keys separately resulting in extra work for users and more load on our servers. This update allows multi-tenant users like MSSPs, Hosters and Network Operators to add the Shadowserver integration on group level. ShadowTrack will check daily, get all assets and events available in Shadowserver, and map these to the organizations you have in your group. The new integration also uses the Shadowserver data much better. Besides discovery, you can import the device_id data (both IPv4 and IPv6) in to a special index in ShadowTrackr called shadowserver_device_id. The Shadowserver reports are now also parsed and processed as events. So, if one of your servers is connecting to a sinkhole or honeypot the alert for that will show up in your ShadowTrackr events. Tue, 07 Apr 2026 00:00:00 +0000 https://shadowtrackr.com/blog/updated-magic-queries-documentation https://shadowtrackr.com/blog/updated-magic-queries-documentation As part of a continuing effort to update and improve documentation, the first information on magic queries is now available. Sometimes you want data from ShadowTrackr that you know is in there, but cannot get out with the query language. A good example is if you want to combine data from two or more indexes. The query language does not support joins. This is where magic queries are used. All magic queries start with a $. There are a number of existing ones, and they are now listed in the documentation. For quick access, just type $ in the search bar in the gui and auto-complete will show you what's available. If you cannot find the magic query that you need, contact support and we'll try to make a new magic query for your specific needs. Mon, 30 Mar 2026 00:00:00 +0000 https://shadowtrackr.com/blog/updated-scheduling-algorithms https://shadowtrackr.com/blog/updated-scheduling-algorithms Most scheduling algorithms have been reviewed and updated. The trigger for this was that sometimes an item could drop out or get stuck somewhere and was not properly scanned for a while. That is fixed now, and the resulting backlog of unscanned items was processed over the weekend. Sun, 29 Mar 2026 00:00:00 +0000 https://shadowtrackr.com/blog/api-v4-is-here,-with-more-data-and-more-options https://shadowtrackr.com/blog/api-v4-is-here,-with-more-data-and-more-options ShadowTrackr has been gathering more information on your assets since API v3 was released. There are more indexes, reports and magic queries available too. Not all of those were available in the API yet. Also, version 3 had some inconsistenties that we'd love to get rid of. Api v4 is now available. The ShadowTrackr python module on github is also updated. The most significant changes: The data returned is consistent and proper formatted everywhere Error messages and result descriptions have improved API is much better documented, with code examples Code examples are with cURL, Python and PHP All endpoints now have the same names in the python module New endpoints available for suppliers, vulnerabilities and more If you have specific requests for the API or questions on how to use it, please let us know :-) Mon, 16 Mar 2026 00:00:00 +0000 https://shadowtrackr.com/blog/scannernodes-upgraded https://shadowtrackr.com/blog/scannernodes-upgraded There has been a big upgrade on all scannernodes. Fresh installs with a new OS, better monitoring, and better security. All scannernodes have encryption enabled now. Besides software improvements, server capacity had been increased too. Mon, 09 Mar 2026 00:00:00 +0000 https://shadowtrackr.com/blog/multi_tenant-endpoints-in-api https://shadowtrackr.com/blog/multi_tenant-endpoints-in-api There have been some hidden API options for multi-tenant users for a while, and since there is a growing number of multi-tenant users it was about time to properly document it. If you have a multi-tenant subscription, there are groupadmins that can create, view and delete organizations in the GUI. These organizations are isolated and cannot see each others data. The groupadmin does have options to query and report over all organizations in the group. Some of you want to dynamically manage organizations through the API. For that, there are three endpoints available: create organization active_organizations delete_organization You can of course also use this functionality in the ShadowTrackr Python API. There is a multi-tenant example included in the code on Github. The groupcode and group API key needed to use this can be found in the GUI on the group settings page. This page is only accessible to groupadmins. Mon, 02 Mar 2026 00:00:00 +0000 https://shadowtrackr.com/blog/new-api-tag-management-endpoints https://shadowtrackr.com/blog/new-api-tag-management-endpoints With the two new endpoints add_tags and remove_tags you can now manage asset tags through the API. For those of you that have thousands of assets this is much easier than the manual tagging available in the GUI. The ShadowTrackr python module is updated too. More details about the endpoints are available in the API documentation. Mon, 23 Feb 2026 00:00:00 +0000 https://shadowtrackr.com/blog/data-and-core-infra-moved-to-germany https://shadowtrackr.com/blog/data-and-core-infra-moved-to-germany If things feel a little different when you access ShadowTrackr today, that might be cause the core infrastructure and data are in Germany now. This weekend the migration was completed. It was quite the operation, but I'll not go into it because it tends to get a bit boring to read about. The point was to get the data in the EU. And not only have the data and servers moved, we also switched from an American to a German hosting company. We're following the calls to reduce dependencies outside the EU. That still means anyone from outside the EU is welcome to use ShadowTrackr of course. The scanner nodes have not migrated yet. The are spread all over the world as we need them to be and still at the old hosting company. Most of them, perhaps all, will migrate too. Mon, 16 Feb 2026 00:00:00 +0000 https://shadowtrackr.com/blog/new:-censys-and-shadowserver-integrations https://shadowtrackr.com/blog/new:-censys-and-shadowserver-integrations Two new integrations, and an update for the existing one (Shodan). These integrations allow you to enrich and import data into ShadowTrackr. For now they are mostly used for discovery and host data. Shadowserver has useful alerts too, and a next version of the integration might import these too. Censys and Shodan are different than ShadowTrackr. These platforms widely scan the entire internet, and so might pick-up an asset that ShadowTrackr has missed. ShadowTrackr scans your organization in-depth (and not just the hosts and websites), maintains history, and has more reporting options. They are different tools that nicely complement each other. You can configure how often checks are done, so you can stay in control of the credits you have on Censys and Shodan. If you have Shadowserver credentials and want to configure the integration, please check first if you receive their reports for just your assets or for other organizations too. If you run a CERT for an industry, you're likely to receive reports on the entire industry. If you are in law enforcement, you'll receive data on your entire jurisdiction. In those cases you'll want to tick the "no_suggestions" box on the Shadowserver configuration page in ShadowTrackr. If you don't do that, all assets that are not recognized as yours will be added as suggestions. This an run in the thousands. Mon, 09 Feb 2026 00:00:00 +0000 https://shadowtrackr.com/blog/updated-detections,-and-work-on-new-integrations https://shadowtrackr.com/blog/updated-detections,-and-work-on-new-integrations Some updated detections have gone live this week. Also, a bigger update is on the way: the Shodan plugin is being updated, and Censys and Shadowserver integrations are currently in test. They might just go live in the next update round :-) Mon, 02 Feb 2026 00:00:00 +0000