# Vigilbase Monday 1 (25 May 2026)

> Audit logs, per-asset detection management, the Vigilbase Risk Score beta, enriched IP intelligence and Cloudflare onboarding improvements.

Source: https://docs.vigilbase.com/one/changelog/2026-05-25

This was the first Vigilbase Monday release. It introduced the Vigilbase Risk Score, which scores each event that Vigilbase processes. At release, scores covered Cloudflare HTTP and WAF events.

> [!NOTE]
> This entry describes the product as it shipped on 25 May 2026. Some screens and labels have changed since. See the [Vigilbase One documentation](https://docs.vigilbase.com/one) for the current product.
>
> The security features in this release, including logs, detections, incidents, the risk score and the security audit log, moved out of Vigilbase One in October 2026.

## New features

### New documentation

- All Vigilbase documentation, including API specifications, moved to one documentation site. It now lives at [docs.vigilbase.com](https://docs.vigilbase.com/one).

### Vigilbase Risk Score (beta)

- Risk scores became available for the Cloudflare HTTP and WAF datasets.
- The UI showed three score states:
  - **Calibrated**: the score is fully tuned to your traffic.
  - **Lite**: the base score is active; personalised tuning is not complete yet.
  - **Warming up**: Vigilbase is still learning your environment.
- The logs page gained a risk score filter with a live slider.
- Every event was labelled **Risky**, **Caution** or **Safe**.

![Logs page with the risk score filter and Risky, Caution and Safe labels](images/Helium-screenshot-on-2026-05-25-at-10.31.06@2x.png)

### Delegated agent authentication

- Vigilbase added agent authentication using the auth.md standard, so you can ask an AI agent to sign in to Vigilbase for you.
- You approve third-party agent access to your organisation through a dedicated approval flow.
- Each approval is scoped to one request and includes user-code verification.

![Approval screen for a third-party agent requesting access to an organisation](images/Helium-screenshot-on-2026-05-25-at-10.35.30@2x.png)

### Audit logs

- A full audit trail covering organisation, member, asset, connection, billing, incident and authentication events.
- A new **Settings → Audit log** view for organisation admins and owners, with filters by action type and outcome and a detail drawer for each event.

![Audit log view with action type and outcome filters](images/Helium-screenshot-on-2026-05-25-at-10.32.09@2x.png)

### Managed Cloudflare blocklist

- Blocked IPs, already used to improve detections, are now also synced to Cloudflare.
- Vigilbase creates a managed list for each domain and a WAF rule that blocks every IP in the list.

![Managed Cloudflare blocklist with blocked IP addresses](images/Helium-screenshot-on-2026-05-25-at-10.34.33@2x.png)

### Per-asset detection management

- Manage detection rules for each asset from the new **Detections** page.
- Turn individual rules on or off for one asset without affecting your other assets or the global defaults.

![Detections page with rule toggles for a single asset](images/Helium-screenshot-on-2026-05-25-at-10.32.50@2x.png)

### Enriched IP intelligence

- IP lookups now include signals for residential proxies, VPNs, Tor, hosting providers, mobile networks and more.
- New **Connection Type** and **Anonymity** columns on the alerts IP table.
- New filter groups on alerts: country, connection type, anonymity and network.
- AI triage explanations use these enriched signals.

## Improvements

### Logs page

- Filters moved into a single **Filters** popover with refinements, the risk score filter and a field picker.
- Expanded log rows are more compact and show IP intelligence inline.
- IP data loads automatically when you expand a row.

### Cloudflare onboarding

- The connection wizard was redesigned with searchable asset and dataset tables.
- Warnings appear before you exceed your Cloudflare account's log delivery limits.
- The **Sync** button now recovers and rebuilds missing log delivery jobs automatically.

### Incidents

- A new **Threat Analysis** panel shows AI triage results with clearer status messages.
- Incident share links are more resilient.
- The incident detail view gained MITRE ATT&CK mapping and source IP actions.
- The attack-origin map shows by default when geographic data is available.

![Incident detail with the Threat Analysis panel and attack-origin map](images/Helium-screenshot-on-2026-05-25-at-10.37.20@2x.png)

### Notifications and sidebar

- Notification delivery counts are more reliable and scoped to your active organisation.
- Sidebar statistics update correctly when you switch organisation.

### Vigil assistant

- Vigil keeps context across investigations for more coherent follow-up analysis.
- Responses are faster thanks to better caching of IP and enrichment data.

### Website and pricing

- Refreshed pricing tiers and a new enterprise quote builder.
- New product comparison pages and an integration index.

## Fixes

- Share links generate correctly in all environments.
- The Threat Analysis panel no longer shows internal error details when it fails.
- The User Agents card shows user agent strings correctly.
- The risk score column shows **Warming up** instead of a zero score before the model is trained.
- The Cloudflare connection wizard now shows dataset errors instead of skipping past them.
- Notification and authentication flows cope better with brief connectivity problems.
- Managed Cloudflare blocklist actions are validated more strictly before any change is applied.
- AI analysis on incidents retries more reliably and handles temporary and permanent failures separately.
- Weekly security report delivery is more reliable, with scheduled and on-demand reports kept apart.
- HTTP incidents gained a **request-flow view** that traces the path from source IP through user agent to the requested paths and the affected asset.
- Dashboard usage metrics are more accurate and behave better when metrics data is briefly unavailable.