New user interface

The old user interface has been around for a while. It worked fine so far, but every new feature was sort of bolted on. Early users grew along, but some new users could not find the things they expected in the places they expected them. So, time for a change.

The biggest layout change is the menu. It has moved to the left and you can hide it on demand to free up more space for content. This is especially handy for big graphs like the attack surface.

The two different pages for each asset that existed have now merged. If you can't see the options you need, check out the drop down menu in the upper right (the three dots).

Although it's mostly a redesign to improve the user experience, some new features have creeped in. You can now request a scan for an asset from the upper right menu. The request will be queued and not executed immediately for now. Maybe I'll change this so requests will jump the queue and are executed faster, which is quite useful when you just fixed your server, certificate or website.

New node: ShiningArmor.shadowtrackr.com

Currently most work is done on fixing bugs and reducing technical debt. There is not much new to talk about, but you should know that there's a new scanner node. I know that some of you maintain whitelists, so you should add this new node. You can see the complete list of nodes here.

Oh, and the website is updated. The homepage has a nice animation now that should explain in 11 seconds what ShadowTrackr is about. Happy to hear any comments :-)

Ignoring assets

Some of the bigger clients have infrastructure of which they only want to monitor a subset. For domains with many subdomains this has been available for a while. It wasn't really the most usable or logical solution, but it worked. And then a new problem surfaced.

ShadowTrackr picked up about 1400 docker containers on a particular subdomain. These were not really important to the client and messages about the docker instances started crowding out the important ones on the timeline. Ignoring this meant clicking 1400 checkboxes to start, and then manually tracking all new hosts as the are generated. The client of course requested a feature to ignore an entire subdomain.

I took the opportunity to redesign the ignore filter. The new version will give you a better overview, is available for all domains (including those with only a few subdomains or hosts) and supports automatically ignoring anything found on a subdomain. If, for instance, you want to ignore all hosts under docker.shadowtrackr.com, you:

• add the subdomain under assets
• click on the + sign after adding
• click on the filter link right next to it
• tick the box to ignore subdomains for it
• save the new settings

You will be able to see all newly found urls for the subdomain under ignored assets, but no messages about these will appear on your timeline. Be careful to only ignore assets that do not create risks for you. If you do ignore something your business partners or clients consider yours, this might blow up in your face when you miss a security warning.

Ignoring not only urls but also ips is still on the todo list. This will be added next.