Release Notes
- Integrated the advanced collector into the web and made numerous improvements:
- Added the ability for benchmarks to detect if they should run
- Added configuration wizard to run the collector with no prior configuration (to import into Xylok, you’ll currently still need to change the result file to match an existing machine)
- Make machine, location, and client “download scripts” buttons into a dropdown
- Added a way to generate the configuration for a machine from the web interface
- Added modern (JSONL) result file parsing to XSS import
- Added signature verification of each data line in modern result file. Failing data will still import, but will show a warning in the task.
- Added benchmark loader interface to allow the collector to be use either embedded or a local benchmark file
- Added ability to make the collector automatically upload results to a server
- Added a select to the task page to show tasks from every session
- Added OS filtering to scans: new filters for machine name, location name, and OS
- Correctly load question answers into scripts
- Add client context handling for file uploads, which should fix an issue with some import types
- Fixes to a security policy to avoid some Javascript console errors
- Fixed an occasional issue with the task page after sleeping the server running Xylok
- Added fallback filters and local storage save for handling 422/500 errors across multiple APIs
- Fixed a CCI rater issue related to CCIs not matching a filter
- Allow middle click for opening scans
- Post-processing update to:
- bind_9-x_stig
- rhel_8_stig
- rhel_9_stig
- Changed HKCU handling for the following benchmarks:
- microsoft_access_2016
- microsoft_excel_2016
- microsoft_office_system_2016
- microsoft_outlook_2016
- microsoft_powerpoint_2016
- microsoft_project_2016
- microsoft_visio_2016
- microsoft_word_2016
- ms_dot_net_framework
- Updated xylok_security_suite_20-x_stig benchmark to reflect move to toml config. Submission to DISA to change the benchmark text is still pending, but the data collection within Xylok is updated.
- Modified Powershell script generation to change registry locations are referenced (the HKCU hive specifically):
- adobe_acrobat_pro_dc_continuous_stig
- adobe_acrobat_reader_dc_continuous_track_stig
- microsoft_windows_11_stig
- ms_office_365_proplus_stig
- ms_windows_10_stig
- ms_windows_server_2022_stig
- ms_windows_server_2025_stig
- windows_server_2016_stig
- windows_server_2019_stig
- Changes to solaris_10_sparc_stig to better handle network connected filesystems
- Modified collection in solaris_10_sparc_stig to speed up location of files/directories without valid UID/GID
- Modified collection in solaris_10_sparc_stig to ignore network connected filesystems
- Minor updates to rhel_8_stig and rhel_9_stig
- Modified POSIX environment hooks to create a temporary directory inside script execution directory
- Rework vSphere 8 benchmarks to make powercli functions work more reliably.
-
General enterprise authentication support! LDAP, ADFS, bring-your-own OpenID provider via our generic OpenID Connect Provider integration. At long last you can now tie Xylok into your internal LDAP, Active Directory, or other authentication system.
- Documentation is available at https://app.xylok.io/docs/01-server-admin/active-directory/ (and locally, as always)
- For customers with existing ADFS integrations, your configuration should migrate over with no interruption.
- We’re moved the configuration to a TOML-based format. This update will migrate your configuration to
/etc/xylok/xylok.toml. The previous configuration file will be backed up to/etc/xylok.conf.bak, assuming you’re using default locations.
-
Customer-supplied Post-Processing! You can now override our post processing using the same mechanisms as we have available internally
- Documentation is available at https://app.xylok.io/docs/04-analysis/technical/user-check-level-pp/
- Scan items will show a note when customer-supplied PP is in place and we show the exact path you’d need to create to override the PP on the scan item page
- Make script production respect command tombstones
- More warnings around edge cases in import
- CCI Rater additions and bug fixes
- Updates to the file portal to allow searching
- Filter tombstoned benchmarks when assigning to machines and locations
- Added test checking that tombstone commands are not generated in scripts or expected in results
- Create a simple executable version of the auto collect scripts, contact support if you’d like to try it out (rather than the current Python/BASH/Powershell API usage example scripts).
- Removed several bad links for running auto analysis on scans
- Updated shell collector PS module import with retry to be less noisy.
- Updated esxi runner to make powercli less noisy.
- Corrected building scripts for ESXi environment
- Changed vmw_vsphere_7-0_virtual_machine/esxi/vcenter so connections to server happen at check level.
- Minor bug fixes for rhel_9_benchmark
- Commands and post-processing completed for ms_windows_server_2025_stig benchmark.
- Commands and post-processing completed for rhel_10_stig benchmark.
- Added per-check PP script support
- The next release will include support and documentation for you to be able to supply your own post-processing!
- Addressed some issues with checklist file exporting, including fixes which address when we do not have a command for the target device’s OS in place for a check.
- In these cases, we add a placeholder interview command creation for checks with no applicable OS commands
- If a scan displays one of those placeholder commands (they simply ask “is this item compliant?”), let us know which benchmark and your device’s OS. We’ll get it updated ASAP.
- Fix importing null command tags in archive format
- Fixed generation for “cmd with helpers” target OSes (very old Windows devices)
- Command tags are now displayed on the benchmark check page next to the command info
- Fixed client export in Python, with support for the new command tags and check-level PP scripts
- Re-incorporated the post-processing documentation
- Upgrade to Go 1.26.3 (some security fixes addressed in that release)
- Made the psql wrapper pass through args to psql itself (so you can do like
psql -f path.sql) - Moved to local-only Scalar API docs (your local API docs should work now even if you don’t have Internet access)
- Fixes to AD Domain benchmark to use string-based a_level
- Made the Xylok OS Baseline benchmark always use a check-level PP that sets the status to NA, regardless of issues with running commands
- Post-processing completed for vmw_vsphere_7-0_vca_ui_stig.
- Post-processing completed for vmw_vsphere_7-0_vca_perfcharts_stig benchmark.
- Post-processing completed for vmw_vsphere_7-0_vca_lookup_svc_stig benchmark.
- Completed April 2026 quarterly scrape. Updates to following benchmarks:
- amazon_linux_2023_stig
- apache_server_2-4_unix_server_stig
- apache_server_2-4_windows_server_stig
- apache_server_2-4_windows_site_stig
- apple_macos_15_stig
- apple_macos_26_stig
- apple_visionos_26_stig
- application_layer_gateway_srg
- application_server_srg
- bind_9-x_stig
- can_ubuntu_22-04_lts_stig
- can_ubuntu_24-04_stig
- cd_postgres_16_stig
- central_log_server_srg
- cisco_ios-xe_router_ndm_stig
- cisco_ios-xr_router_ndm_stig
- cisco_ios_router_ndm_stig
- cisco_ios_switch_ndm_stig
- cisco_ios_switch_rtr_stig
- cisco_ios_xe_switch_ndm_stig
- cisco_ios_xe_switch_rtr_stig
- cisco_nx-os_switch_rtr_stig
- cloud_computing_mission_owner_srg
- cloudlinux_almalinux_os_9_stig
- container_platform_srg
- database_generic
- dell_os10_switch_router_stig
- dns_srg
- dragos_platform_2-x_stig
- firewall_srg
- fn_fortigate_firewall_ndm_stig
- fs_nac_stig
- general_purpose_operating_system
- google_android_14_cobo_stig
- google_android_14_cope_stig
- google_android_15_cobo_stig
- google_android_15_cope_stig
- google_android_16_cobo_stig
- google_android_16_cope_stig
- hpe_alletra_storage_arcusos_ndm_stig
- hpe_alletra_storage_arcusos_ws_stig
- hpe_aruba_aos_wireless_stig
- hycu_protege_stig
- ibm_aix_7-x_stig
- ibm_websphere_liberty_server_stig
- ibm_websphere_traditional_v9-x_stig
- ibm_zos_acf2_stig
- ibm_zos_racf_stig
- ibm_zos_tss_stig
- idps_srg
- iis_10-0_server_stig
- iis_10-0_site_stig
- kubernetes_stig
- mainframe_product_srg
- mariadb_enterprise_10-x_stig
- microsoft_outlook_2010
- microsoft_windows_11_stig
- mongodb_enterpise_advanced_8-x_stig
- ms_defender_antivirus
- ms_dot_net_framework
- ms_edge_stig
- ms_office_365_proplus_stig
- ms_sql_server_2016_database_stig
- ms_sql_server_2022_database_stig
- ms_sql_server_2022_instance_stig
- ms_windows_server_2022_dns_stig
- ms_windows_server_2022_stig
- network_device_management_srg
- ntnx_acropolis_as_stig
- ntnx_acropolis_gpos_stig
- oracle_database_19c_stig
- oracle_http_server_12-1-3_stig
- oracle_linux_7_stig
- oracle_linux_8_stig
- oracle_linux_9_stig
- pan_prisma_cloud_compute_stig
- rgs_rke2_stig
- rhel_8_stig
- rhel_9_stig
- router_srg
- samsung_sds_emm_stig
- slem_5_stig
- sles_15_stig
- solaris_11_sparc_stig
- solaris_11_x86_stig
- sss_tcmax_9-x
- symantec_edge_swg_ndm_stig
- tomcat_application_server_9_stig
- toss_4_stig
- traditional_security_checklist
- u_ss_android_16_cobo_stig
- u_ss_android_16_cope_stig
- uem_agent_srg
- uem_server_srg
- vmm
- vmw_vsphere_6-7_postgresql_stig
- vpn
- web_server_srg
- windows_firewall_with_advanced_security
- windows_paw_stig
- windows_server_2016_stig
- windows_server_2019_stig
- zebra_android_14_cobo_stig
- zebra_android_14_cope_stig
- zos_bmc_control-d_for_acf2_stig
- zos_bmc_control-d_for_racf_stig
- zos_bmc_control-d_for_tss_stig
- zos_bmc_control-m_for_acf2_stig
- zos_bmc_control-m_for_racf_stig
- zos_bmc_control-m_for_tss_stig
- zos_bmc_control-m_restart_for_acf2_stig
- zos_bmc_control-m_restart_for_racf_stig
- zos_bmc_control-m_restart_for_tss_stig
- zos_bmc_control-o_for_acf2_stig
- zos_bmc_control-o_for_racf_stig
- zos_bmc_control-o_for_tss_stig
- zos_bmc_ioa_for_acf2_stig
- zos_bmc_ioa_for_racf_stig
- zos_bmc_ioa_for_tss_stig
- zos_bmc_mainview_for_zos_for_racf_stig
- zos_bmc_mainview_for_zos_for_tss_stig
- zos_ca_1_tape_management_for_acf2_stig
- zos_ca_1_tape_management_for_racf_stig
- zos_ca_1_tape_management_for_tss_stig
- zos_ca_common_services_for_racf_stig
- zos_ca_mics_for_acf2_stig
- zos_ca_mics_for_racf_stig
- zos_ca_mics_for_tss_stig
- zos_ca_mim_for_acf2_stig
- zos_ca_mim_for_racf_stig
- zos_ca_mim_for_tss_stig
- zos_catalog_solutions_for_acf2_stig
- zos_catalog_solutions_for_racf_stig
- zos_catalog_solutions_for_tss_stig
- zos_compuware_abend-aid_for_racf
- zos_compuware_abend-aid_for_tss
- zos_cssmtp_for_acf2_stig
- zos_cssmtp_for_racf_stig
- zos_cssmtp_for_tss_stig
- zos_ibm_health_checker_for_racf
- zos_ibm_system_display_and_search_facility_for_racf_stig
- zos_ibm_system_display_and_search_facility_for_tss_stig
- zos_netview_for_acf2_stig
- zos_netview_for_racf_stig
- zos_netview_for_tss_stig
- zos_quest_nc-pass_for_racf_stig
- zos_roscoe_for_racf_stig
- zos_roscoe_for_tss_stig
- zos_srraudit_for_acf2_stig
- zos_srraudit_for_racf_stig
- zos_srraudit_for_tss_stig
- zos_tadz_for_acf2_stig
- zos_tadz_for_racf_stig
- zos_tadz_for_tss_stig
- Added an v3 API endpoint for uploading results in a raw format and updates the Python, BASH, and Powershell examples to use it. See https://app.xylok.io/api/docs#/operations/uploadGenericRaw for the docs
- Added an v3 API endpoint for software and benchmarks! This allows you to now export all the softare data that Xylok collects on your system for use elsewhere, without the limitations of an Excel document. We’ll fully publish the docs for that soon.
- Corrected Post-processing appearing to always recommend “not applicable”
- Moved AA to Go. Should be faster, dialog for controling it on a single scan is more nicer.
- Added associated v3 API and background
- Moved scan and scan list buttons for running AA to use new API
- Proxied v1 AA endpoint to the new job
- Script production and importing now respects the ‘ready’ status of a benchmark version. This should help address potential issues with CKL mismatches with the scan data.
- Scripts now correctly always incorporate the Xylok OS baseline
- Fixed the softare listing for machines
- Corrected the “update the machine info” displays when a scan detects information that doesn’t match the current machine info
- Added page size selector for scan page
- When you bulk change scan items in scan analysis, we no longer drop your filter don’t change the filter
- Fixed some keyboard shortcuts firing while typing in an input box.
- Fixed Python example script form upload boundary to work with the stricter Go form parser
- Updated Oracle DB runner to better capture the ORACLE_HOME variable needed by the collection script.
- Added documentation describing requirements and process to run collection for Oracle DB 19c. See https://app.xylok.io/docs/03-data-collection/devices-types/databases/
v2026.04.2 was internal. This fix is focused on a few issues we had reported–thanks to everyone for working with us on these.
-
Result importing:
- Loosen requirements for detecting a classic results file
- Network parser is a more robust in the face of whitespace and control sequences in a command
- Fixed an issue importing checks that do not have post-processing
- Added another date format to the result file date parsing
- Filter out nulls in result data from hitting the database
- Corrected warning about not matching data to an expected item when the command value is blank
-
API
- V1 machine script API was pural accidentally, so calling it using existing scripts was failing with an error about DEAD CODE
-
Scan display:
- Fixed default filter on scans so that unchanged items are still visible, as you’d expect
- Fixed bulk-deleting scans
- Correct filter CSS on scans and fixed filtering multiple item statuses at the same time (ie, unreviewed and non-compliant)
-
Clarified that an “unknown” file during upload is just one that we’re doing automatic detection on, rather then using a type-specific upload
This release is a large UI architectural change, starting our move to a full client-side rendered app with an API driving everything. This will allow you as the user to drive everything within Xylok from the API, greatly expanding our automation capabilities.
For this release, we are not linking to the new API docs yet, but you’re reading the release notes so we’ll give you a preview: https://app.xylok.io/api/docs (your local version won’t work unless it can reach the Internet, for now). There will be changes over the next month or two as we make changes ensure consistency and expand it, but if you want to give it a try feel free to give us feedback!
- A new background job infrastructure is in place:
- The job monitor will now pop up a notification when a job completes and include a link/download button if appropriate
- We’ll no longer annoyingly try to download files on other logged-in browsers that you left open
- Jobs can now give more information when they complete, including warnings about potential (but not fatal) issues.
- Script generation, scan importing and PP have been moved to a new system. This brings a few improvements:
- Faster!
- The system is now in place to allow for check-level PP. Our goal is to allow customers to swap in their own post-processing scripts soon
- A scan now includes all checks for the device’s assigned benchmarks, even if they weren’t actually present in the result file. This helps with situations where benchmark updated or a scan was only partial completed.
- We now alert in the job notes about items that we failed to find associated results for
- The new post-processor runs in a separate container on-demand. If you run into issues with PP, we’ll need to know your Podman/Docker version to help replicate it, thanks!
- Added the ability to push individual CCI ratings to other clients
- We’ve removed ability to download ISOs of scripts. It was generally less useful than the Zip and actively confusing to some users.
- Script ZIPs are now named based on their client/location/machine
- Installer now supports a –skip-benchmarks flag to skip updating benchmarks during installation
- Added some notes about using the Xylok collect service and timer to the docs
- Cleaned up some of the API example scripts
- Updated to the latest CCI list and S6 rev 5 MAD
- Show “(sunset)” next to sunset benchmarks in the benchmark details
- Handle bad question answers in the Python without erroring out
- Lots of CSS fixes
- Changes the way we track the “correct” version of the container image
- Removed some logging from the postgres monitoring process
- Added auto-reload for the ‘we’re starting’ pages while Xylok is initializing
- Oracle Database 19c STIG Commands, Interview questions, and PP
- Updates to vmwvsphere7vcenter post processing
- Updates to ms_windows_server_2022_stig
- Updates to rhel_8_stig
- Updates to rhel_9_stig
- Post-processing updates to ms_edge_stig to address reported bugs.
- Completed automation of ms_defender_antivirus benchmark.
- Google Chrome Windows and Linux post processing 3/6/26
- Finished PP for cisco_ios_router_ndm and cisco_ios_router_rtr.
Things happen, but our next big goals are:
- Update our authentication options
- Allow for customer-supplied post-processing
- Cleanup the new API and make it official
This release is focused on benchmark changes–we have a larger internal change pending and are giving it more time for testing.
- Added example Systemd services and timers for using the example API scripts to automate data collection
- Cleaned up some API documentation
- Modified some commands and PP for:
- bind_9-x_stig
- rhel_8_stig
- rhel_9_stig
- Enhanced functionality of numerous commands/post-processing for the following benchmarks:
- rhel_8_stig
- rhel_9_stig
- microsoft_windows_11_stig
- google_chrome_current_windows
- ms_office_365_proplus_stig
- suse_zlinux
- cisco_asa_ndm
- Processed DISA January 2026 quarterly benchmark release to include the following benchmarks:
- active_directory_domain
- adobe_coldfusion_stig
- afs_ax-os_stig
- amazon_linux_2023_stig
- api_srg
- apple_ios-ipados_18_stig
- apple_ios-ipados_26_stig
- apple_macos_15_stig
- apple_macos_26_stig
- apple_visionos_2_stig
- can_ubuntu_22-04_lts_stig
- can_ubuntu_24-04_stig
- cisco_aci_l2s_stig
- cisco_aci_ndm_stig
- cisco_aci_rtr_stig
- cisco_asa_ndm_stig
- cisco_ios-xe_router_ndm_stig
- cisco_ios-xr_router_ndm_stig
- cisco_ios_router_ndm_stig
- cisco_ios_switch_ndm_stig
- cisco_ios_xe_switch_ndm_stig
- cisco_ise_nac_stig
- cisco_ise_ndm_stig
- cisco_nx-os_switch_l2s_stig
- cisco_nx-os_switch_ndm_stig
- cloudlinux_almalinux_os_9_stig
- dragos_platform_2-x_stig
- evvm_policy_srg
- evvm_session_management_srg
- f5_nginx_stig
- fn_fortigate_firewall_ndm_stig
- fn_fortigate_firewall_stig
- ibm_websphere_liberty_server_stig
- ibm_zos_acf2_stig
- ibm_zos_racf_stig
- ibm_zos_tss_stig
- iis_10-0_server_stig
- iis_10-0_site_stig
- juniper_ex_l2s_stig
- juniper_ex_ndm_stig
- kubernetes_stig
- microsoft_windows_11_stig
- moz_firefox_stig
- ms_azure_sql_managed_instance_stig
- ms_defender_antivirus
- ms_defender_endpoint_stig
- ms_edge_stig
- ms_sql_server_2016_database_stig
- ms_sql_server_2016_instance_stig
- ms_sql_server_2022_database_stig
- ms_sql_server_2022_instance_stig
- ms_windows_server_2022_stig
- netapp_ontap_dsc_9-x_stig
- okta_idaas_stig
- oracle_linux_8_stig
- oracle_linux_9_stig
- rancher_mcm_stig
- rb_netim_os_stig
- rb_netim_stig
- rgs_rke2_stig
- rh_ansible_automation_controller_app_server_stig
- rh_ansible_automation_controller_web_server_stig
- rh_openshift_container_platform_4-x_stig
- rhel_8_stig
- rhel_9_stig
- slem_5_stig
- sles_12_stig
- sles_15_stig
- solaris_11_sparc_stig
- solaris_11_x86_stig
- symantec_edge_swg_alg_stig
- symantec_edge_swg_ndm_stig
- toss_4_stig
- traditional_security_checklist
- windows_server_2019_stig
- xylok_security_suite_20-x_stig
- Made the spreadsheet import skip blank rows
- Added terminaltables back to core XSS image
- Removed link to server logs, all logs have moved to journald
- Increase /var/tmp size recommendations
- Added psql helper wrapper
- Updated to 800-53 rev 5.2
- Updated machine spreadsheet importing to allow more columns and a bit more flexiblity, along with updating associated docs
- Corrected an issue related to fixed TLS certificates and ownership.
- When using fixed TLS certificates, no longer use internal certificate cache.
- Corrected next/prev buttons not working on scan item analysis
- Fixed starting some internal Python helpers (anything using python-run)
- Greatly increased the speed of updating scan item automatic analysis in the background. For automated scans, this should make it far less likely your server gets stuck waiting for work to complete in the background
- Added a CLI flag to enable CPU profiling of Xylok, to assist with investigating performance issues in the future.
- Increased shared memory allocated for Postgres
- Instalation documentation updates
- Fixed an issue with consolidating PP data that was causing some recommendations to not be properly propogated in the API (and consequently the UI)
- Fixed issue with the All Machines page causing machines to appear on multiple pages under certain sorting conditions
- Updated overlay loading to not include invalid controls, even if the overlay sources lists them. This will fix the DAF baseline not loading on the web frontend
- Removed the technical rater, it was no longer being maintained and does not fit the typical RMF analysis flow
- Upgraded to Go 1.25.6
- Imported DISA’s Jan 2026 compilation
- Added post-processing to the following benchmarks:
- vmw_vsphere_7-0_vami_stig
- vmw_vsphere_7-0_vca_sts_stig
- Solaris 11 SPARC post-processing
- Benchmarks with generated interview questions now marked as ready.
- If a document is no longer available on-disk, remove the path from the database
- Added pgcli back to image
- Corrected post-processing inclusion in base image
- Created interview questions for all benchmarks that did not contain existing check content.
- Added full post-processing for the following benchmarks:
- vmw_vsphere_7-0_vca_postgresql_stig
- vmw_vsphere_7-0_vca_rhttpproxy_stig
- Added post processing for some CISCO firewall stigs
- Updated interview questions for the following SRGs:
- application_server_srg
- central_log_server_srg
- dns_srg
- idps_srg
- network_device_management_srg
- router_srg
- traditional_security_checklist
- web_server_srg
- Made minor changes to RHEL 8 benchmark to better handle comments in configuration files
- Completed updates to post-processing to reflect changes in collection due to DISA quarterly scrape.
- Solaris 11 x86 postprocessing fix