This was the first Vigilbase Monday release. It introduced the Vigilbase Risk Score, which scores each event that Vigilbase processes. At release, scores covered Cloudflare HTTP and WAF events.
New features
New documentation
- All Vigilbase documentation, including API specifications, moved to one documentation site. It now lives at docs.vigilbase.com.
Vigilbase Risk Score (beta)
- Risk scores became available for the Cloudflare HTTP and WAF datasets.
- The UI showed three score states:
- Calibrated: the score is fully tuned to your traffic.
- Lite: the base score is active; personalised tuning is not complete yet.
- Warming up: Vigilbase is still learning your environment.
- The logs page gained a risk score filter with a live slider.
- Every event was labelled Risky, Caution or Safe.
Delegated agent authentication
- Vigilbase added agent authentication using the auth.md standard, so you can ask an AI agent to sign in to Vigilbase for you.
- You approve third-party agent access to your organisation through a dedicated approval flow.
- Each approval is scoped to one request and includes user-code verification.
Audit logs
- A full audit trail covering organisation, member, asset, connection, billing, incident and authentication events.
- A new Settings → Audit log view for organisation admins and owners, with filters by action type and outcome and a detail drawer for each event.
Managed Cloudflare blocklist
- Blocked IPs, already used to improve detections, are now also synced to Cloudflare.
- Vigilbase creates a managed list for each domain and a WAF rule that blocks every IP in the list.
Per-asset detection management
- Manage detection rules for each asset from the new Detections page.
- Turn individual rules on or off for one asset without affecting your other assets or the global defaults.
Enriched IP intelligence
- IP lookups now include signals for residential proxies, VPNs, Tor, hosting providers, mobile networks and more.
- New Connection Type and Anonymity columns on the alerts IP table.
- New filter groups on alerts: country, connection type, anonymity and network.
- AI triage explanations use these enriched signals.
Improvements
Logs page
- Filters moved into a single Filters popover with refinements, the risk score filter and a field picker.
- Expanded log rows are more compact and show IP intelligence inline.
- IP data loads automatically when you expand a row.
Cloudflare onboarding
- The connection wizard was redesigned with searchable asset and dataset tables.
- Warnings appear before you exceed your Cloudflare account's log delivery limits.
- The Sync button now recovers and rebuilds missing log delivery jobs automatically.
Incidents
- A new Threat Analysis panel shows AI triage results with clearer status messages.
- Incident share links are more resilient.
- The incident detail view gained MITRE ATT&CK mapping and source IP actions.
- The attack-origin map shows by default when geographic data is available.
Notifications and sidebar
- Notification delivery counts are more reliable and scoped to your active organisation.
- Sidebar statistics update correctly when you switch organisation.
Vigil assistant
- Vigil keeps context across investigations for more coherent follow-up analysis.
- Responses are faster thanks to better caching of IP and enrichment data.
Website and pricing
- Refreshed pricing tiers and a new enterprise quote builder.
- New product comparison pages and an integration index.
Fixes
- Share links generate correctly in all environments.
- The Threat Analysis panel no longer shows internal error details when it fails.
- The User Agents card shows user agent strings correctly.
- The risk score column shows Warming up instead of a zero score before the model is trained.
- The Cloudflare connection wizard now shows dataset errors instead of skipping past them.
- Notification and authentication flows cope better with brief connectivity problems.
- Managed Cloudflare blocklist actions are validated more strictly before any change is applied.
- AI analysis on incidents retries more reliably and handles temporary and permanent failures separately.
- Weekly security report delivery is more reliable, with scheduled and on-demand reports kept apart.
- HTTP incidents gained a request-flow view that traces the path from source IP through user agent to the requested paths and the affected asset.
- Dashboard usage metrics are more accurate and behave better when metrics data is briefly unavailable.