"Portal won't even load for me," said the SRE manager, Jim-bob, frantically looking at a series of alerts cascading through his observability tool. In the Slack war room, the pressure was mounting. 

"Is this a synth issue or a network issue?" he asked—the classic question that marks the beginning of every high-stakes triage.

Across the virtual table, Ally, the network architect, was digging into the charts. "Why so many that say Tokyo?" she muttered, staring at a sea of overlapping lines. The team was drowning in raw data, but they were missing the story.

What's New?

To solve these high-pressure moments, we’re thrilled to announce the enhanced Investigative Capabilities of AI Advisor (AIA). AI Advisor now has the power to act as your primary on-call investigator, correlating Synthetics monitoring with real-time BGP telemetry. Instead of you manually hunting for common denominators across different ephemeral queries or consoles, AIA looks at your global agent network, analyzes the routing paths, and builds a definitive root-cause report and complete with path visualizations, directly in the chat.

Why It Matters

This update turns AIA into a collaborative partner that solves the "unknown network change" by following the evidence:

• AI Assisted Triangulation: During the triage, Ally and Jim-bob were overwhelmed by "Tokyo" alerts. AIA cut through the noise by identifying that geographically diverse agents (Cloud-A/Chicago, Cloud-B/Tokyo, Cloud-C/London) all shared one thing in common: their traffic routed through a specific upstream transit path. AIA can now build these path-dependency diagrams on the fly, helping describe transit-layer issues in a context that is easier for NOC and network engineers to understand and act upon.
• Exposing the "Connected Route" Trap: One of the most dangerous false signals is a healthy P2P link. AI Advisor identified that while an upstream p2p interface remained reachable with 0% packet loss, it was a "false friend." Because that subnet was a connected route, the link stayed up even as the provider’s backbone lost the ability to route traffic to Kentik's actual service prefixes (193.177.*.*/24). AIA accurately identified that the physical wire was fine, but the routing was broken.

• Correlating BGP Churn in Real-Time: AI Advisor doesn't just look at pings; it looks across the data you’ve collected with Kentik. In our case, it identified a massive BGP UPDATE storm of 158k messages, roughly 148x the normal churn rate, detected on a specific transit path. By linking this routing instability directly to the Synthetics packet loss, AI Advisor (AIA) gives you the data-driven evidence you need to coordinate with partners and resolve path-specific issues.

*note this image is an anonymized recreation based on the original

• Depth Without the Drama: No more fighting with your dashboard while on the move. The updated UDE Table Renderers ensure that whether you're at a dual-monitor workstation or triaging on the go like Jim-Bob, the critical path data and cloud provider info are front and center.

Get Started! Ready to find your Mean Time to Innocence? Head to the Synthetics section in the Kentik portal to explore the new trace tool, or ask AI Advisor to "analyze the latest packet loss spike" to see the triangulation diagram in action. For a deep dive into the technical specs, visit our Knowledge Base.

In the heat of a network outage, every second spent toggling between performance dashboards and configuration screens is a second stolen from finding the root cause. How much time does your team lose just trying to verify a threshold while investigating a latency spike?

What’s New?

We are excited to share a significant upgrade to the Kentik Synthetics experience designed to keep you in the flow of troubleshooting. You can now view test configurations inline alongside live performance data, isolate path degradation with a new hop-by-hop tabular traceroute view, and filter or export data across your entire environment using our powerful new List Panel for Kentik Dashboard. Additionally, we’re giving you a sneak peek at our redesigned Tests view (formerly Test Control Center), rebuilt for high-density network intelligence and a true bird’s-eye view of your monitoring ecosystem.

What's Changed

These updates eliminate context switching and provide a scalable way to manage your global monitoring footprint without losing sight of the details.

• Zero-Friction Optimization: With inline synthetic test configuration info, you no longer need to leave your results page to see a test's specific parameters. On the results page, simply click the Settings button on the upper right to display the new side-drawer which allows you to verify targets, frequencies, and health thresholds like HTTP Latency or Certificate Expiry, while keeping your eyes fixed on the performance timeline.
  
• Granular Path Isolation: Troubleshooting path latency shouldn't feel like guesswork. Our new hop-by-hop tabular view for traceroute test data translates complex paths into a structured, easily digestible table. By organizing autonomous systems (ASNs), individual hops, loss, and latency side-by-side, you can instantly pinpoint the exact node or provider causing network degradation.

• Large Scale, Granular Control: The new Test List Dashboard panel provides an immediate health summary, showing exactly how many tests are Healthy vs. Critical. You can now filter hundreds of tests by labels (like IAD Portal or canary) and use the new settings menu to toggle specific data columns for Jitter and Packet Loss, making it easier than ever to export high-density data for your entire infrastructure.
  

  
  

• Unified Performance at a Glance: Our redesigned Tests (Formerly Test Control Center) view introduces a more intuitive way to visualize performance across your entire portfolio. By providing a high-level summary of all active tests in a single pane of glass, you can spot regional outages and latency spikes across different test types before they impact your broader user base.

  Old Design: 

  
  

  New Design: 

Get Started! 

Experience the power of inline test configuration and bulk management today! Log in to the Kentik Portal, head to the Synthetics Dashboard, and start exploring the new List View. For a deep dive into these new features, check out our latest documentation in the Kentik Knowledge Base.

On May 8, 2026, during a scheduled maintenance window at 2AM UTC, Kentik will introduce an F5 Distributed Cloud Web Application Firewall (WAF) in front of our US SaaS platform (portal.kentik.com / api.kentik.com).  This is part of our commitment to continual improvement and defense in depth strategy to secure our systems in the face of novel, AI-assisted attack chains. (Note - As part of our initial deployment, this change took effect in EU SaaS on April 22, 2026)

What's changing

All HTTPS traffic to portal.kentik.com,  api.kentik.com (including *.my.kentik.com, beta.kentik.com & next.kentik.com), and the corresponding .eu domains, now routes through the F5 WAF at 159.60.158.89 before reaching Kentik infrastructure. This provides enhanced protection against malicious web application traffic and attacks with no change to the portal or API functionality.

What's not changing

• Our SaaS platform remains hosted with its data stored in our co-location facility in Ashburn, Virginia for our US and Frankfurt, Germany for EU.
• Flow ingest data (NetFlow/IPFIX/sFlow packets) sent to collector IPs is unaffected.
  (Note: However, some kproxy management/health calls, ksynth result uploads and, any customer scripts calling our API  — now routes through the WAF)

Action required

Action only required if you have outbound IP allowlists. If your proxies, firewalls or other routing policies restrict outbound HTTPS (port 443) to Kentik by IP, you must add 159.60.158.89 alongside the existing Kentik VIPs. Without this, portal and API access may be blocked from your network.

Data Processing Notes

F5 Data Processing

• Requests will be processed by F5’s regional endpoints based on where they originate.
• F5 is a member of the US DPF program & shares our overall GDPR commitment, so this change should not introduce novel data locality concerns. 
• WAF performs transient analysis of user requests hitting the SaaS website only and is not used to process network telemetry data (such as NetFlow) sent to our servers. Furthermore, F5 does not store any user request data post-processing. As a result, we determined that this does not meet our criteria for declaring F5 as a full subprocessor working with customer personal data.

Private Network Interconnect (PNI)

• If you have a private network interconnect (PNI) configured to Kentik with the portal/API being accessed via the PNI. Then with the WAF in place, portal and API access will be routed via F5’s regional edges over the internet. (Note: This is only for web traffic and, Flow/ingest data will still continue to go over the PNI)

Additional F5 information

• F5 Data Protection:  https://www.f5.com/company/trust-center/general-data-protection-regulation-and-data-protection-framework
• F5 Regional Edge Locations: https://my.f5.com/manage/s/article/K000146743 
• F5 Regional Edge IP ranges: https://docs.cloud.f5.com/docs-v2/downloads/platform/reference/network-cloud-ref/ips-domains.txt 

If you have any questions regarding this, please reach out to Kentik support or your customer success advisor.

Network problems happen all the time, but the hardest part isn't detection. It's getting to the why. Detection is easy, but diagnosis is not. Observability has gotten incredibly good at detecting issues and narrowing down the problem space. But actually diagnosing the network and finding the root cause? That is still painfully manual.

Engineers often need to look at multiple tools, dashboards and CLIs to get to root cause. Introducing, Kentik's new AI diagnostics for faster root-cause analsys! By bringing diagnostic tools-of-the-trade directly into your telemetry and alerting workflows, you can stop the swivel-chair investigation and confirm root causes faster.

Here are three new capabilities launching today to help you streamline troubleshooting:

On-Demand Connectivity Tests

Need to confirm an issue from a specific vantage point? You can now use AI Advisor to validate reachability and path behavior from Universal Agents. This allows you to test and confirm network issues exactly where they matter most to your end-users.

📝 Config Context (Backups + Diffs)

Configuration changes are a leading cause of network incidents. Kentik NMS now periodically captures running configs over SSH, securely stores them as secret-redacted backups, and surfaces diffs between revisions. Even better: AI Advisor can instantly analyze these backups and diffs to answer questions about configuration states and identify if a recent change is the culprit behind your current issue.

💻 SSH Command Access

When an investigation requires live device data, the usual answer is to pull up a CLI and start digging. Now, you can do it right from AI Advisor. AI Advisor can propose, run, and analyze read-only show commands directly inside your investigation thread.

• No memorizing vendor syntax: AI Advisor handles the complex commands.
• No context switching: Keep your CLI output and your telemetry in the same window.
• Empower your team: Junior or less specialized staff can safely troubleshoot complex issues and correlate live device truth with ease.

Ready to see it in action?

Monitor your devices with NMS, configure SSH access and start solving problems faster today. There's no "upcharge" for this new feature. It's included with an NMS device license. Need more details? Check out our knowledge base article and release blog.

Customize Your Alerts: Plain-Text & Template Editing for Email 📧

We’re giving you more control over how your team receives critical information! We know that every workflow is different. Sometimes you need a rich, detailed notification, and other times you need a lightweight, no-frills message that fits perfectly into your existing scripts or mobile devices.

That’s why we’ve upgraded the Email Notification Channel to be more flexible and customizable than ever.

📝 What’s New?

• Plain-Text Format Support: You can now specify that emails be sent in a clean, plain-text format. This is perfect for ensuring compatibility with legacy systems, pager services, or internal tools that parse incoming mail without the overhead of HTML.
• In-line Template Editor: No more "one size fits all" notifications. Use our new in-line editor to fully customize both the email subject and the body.
• Dynamic Data Injection: Tailor your messages using variables from your alert policies—like Alert ID , Severity , or Dimensions —so the most important info is front and center.

💎 Why You’ll Love It

• Parse with Ease: Plain-text emails are a dream for automation. If you use custom scripts to trigger secondary actions based on Kentik alerts, this update makes your life much simpler.
• Reduced Noise: By customizing the subject line, you can help your team identify the priority and source of an alert at a glance, right from their lock screen.
• Branding & Context: Use the body editor to add internal links, SOP instructions, or specific team context, ensuring that whoever receives the alert knows exactly what to do next.

🛡️ Level Up Your DDoS Defense: 39 New Attack-Specific Templates!

We’re pumped to announce a massive expansion to our Kentik Protect alert policy templates! We’ve added 39 new, highly granular templates engineered to give you laser-focused visibility into specific attack vectors.

While our general reflection templates have always had your back, these new additions allow you to pinpoint the exact flavor of trouble hitting your network—from Memcached and DNS Reflection to more niche threats like Steam (SRCDS) or Mitel TP240 attacks.

⚡ What’s New?

We’ve moved beyond "one size fits all" to give you surgical precision. These templates are built to augment your existing setup by providing better granularity for specific attack types, including:

• Expanded Reflection Coverage: Dedicated templates for SNMP, mDNS, CLDAP, Lantronix Discovery, and CoAP reflection attacks.
• Protocol-Specific Protection: New alerts for GRE Flood, TCP Xmas Tree, TCP Null Flood, and TCP Invalid Flags.
• Specialized App Support: Custom templates for Plex Media SSDP, OpenVPN, and GQUIC reflection.

🎯 Why You’ll Love It

• Faster Identification: Stop guessing which service is being abused. The policy name now tells you exactly what you're looking at right in the Alerts List.
• Smarter Mitigations: By knowing the specific attack type (like a Fraggle Attack or WS-Discovery Reflection), you can tailor your automated system responses and mitigation platforms far more effectively.
• Granular Alerting: Fine-tune your thresholds for specific protocols rather than relying on a broad "General Reflection" policy.

🛠️ How to Enable & Tune Policies for Your Network

By default, these templates are imported in a disabled state so you can safely review and tune them before going live.

Step 1: Enable the Template

1. Head over to Alerting > Manage Alert Policies > Alert Policy Templates in the Kentik portal.
   KB Alerting.pdf
2. Search for the template name (e.g., DDoS: ARD Reflection Attack or DDoS: TCP Null Flood).
3. Click the Create policy from template icon to add the alert policy to your account.

Step 2: Tailor & Tune to Your Environment

Every network has its own unique baseline. Here is how you can make these templates fit seamlessly:

Adjust Static & Baseline Thresholds:

• For high-volume service provider backbones, scale up static packet/bit thresholds to match your transit capacities.
• For tight enterprise environments, lower the required percentage jump above historical baselines.

Refine Traffic Filters & Boundaries:

• Ensure your network boundary tags (e.g., internal vs external, or inside vs outside) are accurately defined so inbound flood policies evaluate traffic correctly.

Attach Notifications & Automated Mitigations:

• Link your team's preferred notification channels (Slack, PagerDuty, Webhooks, or Email) under the policy's Notifications section.
• For DDoS templates, attach Mitigation Associations if you want Kentik Protect to automatically trigger RTBH, BGP Flowspec, or third-party mitigation platforms upon activation!

Observation Deck was initially built as a flexible landing page that adapts to users' interest. It includes a library of widgets that aren't available as Data/Metrics Explorer views, but also allows our users to embed views from these two key Infrastructure Analytics query applications. In its initial design, there was only one Observation Deck per user, and no ability for a group of users to share the same.

Discussions with our user base led to these requirements:

• the ability to build and then share Observation Decks across users;
• the ability to share an Observation Deck with users based on their assigned role, serving as a role-specific landing page for the tasks & checks that their roles demand
• the ability to centrally manage Observation Decks assignments as landing pages for different user groups

So... that's what this update is about! Read on! At the end of the article, we'll also share our vision of how Observation Decks and Dashboards will evolve in the short/mid/long term future, so make sure you review the last section.

Introducing the new observation decks

Observation Decks are now their own Library objects

If you go to the Library ([shift]+[s] from any screen in Kentik Portal, one of those magic shortcuts you want to know about) you will notice that the left-side filter panel now offers an additional choice for Type:

This means that you can now create multiple Observation Decks. Here's a few things about how it works:

• These Observation Decks are bound to the same RBAC rules as Dashboards: Shared vs Private settings supersede any RBAC permissions - a new RBAC section allows you to configure permissions for Observation Decks the same way that exists with Dashboards, including per-label permissions

• Important note: This doesn't replace or delete your existing Observation Deck; it has been simply been migrated to a Library object for you so you won't need to re-create it
  • The migrated Observation Decks are Private meaning you only will see them if you had one
  • You can change their share settings and they will then appear to other users in the Library (barring RBAC permissions) - ideally you should change their names before sharing them so you don't end up with multiple titled Observation Deck, each with a different owner

• If your Kentik Portal Landing page was an Observation Deck, the record has been updated in your settings, pointing to the same, migrated library object, which should result in no change to your experience upon login - see section in this article about Observation Deck assignments

A complete overhaul of Observation Deck editing capabilities

With this update, you'll find the previous ability to add widgets from a selection of existing ones with in the + Add Panel dropdown at the top:

We have now made editing Observation Deck simpler - let's go through a few useful changes that we've added:

Edit in place

All Observation Deck panel titles, as well as the main title are now editable in place: hovering on these titles highlights them, clicking loads an inline edit field.

New top level widget types

New widgets have been released that have long been asked by our users:

• Section widget
• Markdown text panel widget

The Section Widget lets you create sections to group panels in and make long Observation Decks easier for the users to consume - see below:

Conveniently, sections are also collapsible/expandable, as shown below:

Markdown Text panels are another addition making this Observation Deck update exciting, look for yourself in the screenshot below.

A couple tricks that we've found very useful when using markdown panels:

• use emojis to display clear do's and don'ts type of instructions
• use arrow characters in the titles to point at a nearby panel if you want to provide an inline explanation to them
• don't hesitate to abuse URL embedding, even if these don't point to wiki documentation: non-public URLs are OK as long as the consuming user has access to the resource the URL points to (private wikis are fine)
• a full library of markdown examples is available here, don't hesitate to steal ideas from it to make your Observation Decks more lively

Central management of Observation Decks as Landing Page experiences

To further Observation Deck's usefulness and make them more manageable at scale in the case of user groups with different demands in Kentik Portal, we've extended management capabilities throughout the Settings experience.

Per user assignment of Observation Deck as a Landing Page

If your user permissions allows it, you can now assign Landing Pages to users yourself (it used to be a user private setting).

In the Company Settings > Users > Edit User workflow, you'll now be able to set a specific Observation Deck as a landing page for any user:

Beyond that, you'll also be able to leverage Bulk Edit capabilities from the same Users management page to assign the same Observation Deck to multiple users at the same time in one fell swoop!

SSO Role-Sets and the associated Landing Page

Some of our users use SSO RBAC Automated Attribute Mapping via Role Sets (see the announcement here): this feature allows Kentik Administrator to set RBAC permissions and enforce them at login based on users' SAML2 attributes, including User Groups.

In that context, a Role-Set is a collection of roles assigned by SSO at login, and it now contains a setting to assign a specific landing page: each who has been assigned a Role-Set containing a Landing Page setting will now default to the selected Landing Page, where a named Observation Deck can be configured, as shown below.

User API extensions for Observation Decks as a Landing Page

Some users prefer relying on programmatic capabilities to set up users using our API - for those we've also extended the User API endpoints to include setting an Observation Deck as a landing page programmatically

What is the future of Dashboards and Observation Decks ?

As a lot of you have already pointed out, Observation Decks and Dashboards are very similar. For example, a lot of our users have asked for an ability to add Observation Deck widgets to Dashboards.

Additionally, we have determined that Dashboards have a high barrier to entry for our newer users, and are too involved to Create or Edit.

For both these reasons, we will merge Observation Decks and Dashboards together in the near future. Here's a (non-exhaustive) list of what you can expect:

• All existing Observation Decks will be migrated to dashboards
• The new Dashboards experience will inherit the newer, simplified Edit/Create User Experience of Observation Deck (ex: Edit Mode is permanent, no need to toggle View/Edit mode to make layout changes etc...)
• Existing Observation Deck widgets will by default be available in the new Dashboards experience
• The new Dashboards experience will include all the data-sets that you can add to Kentik: Traffic(Flow), NMS(Metrics), Synthetics, Events...
• The new Dashboards experience will see its Guided Mode powers significantly overhauled and improved to make interactive dashboards a point of focus for creators

Last but not least, we have a long term project to sprinkle AI magic over these new dashboards getting dashboard creation a step closer to true Generative AI!

Tell us what you'd like to see in these future dashboards, it's never to late to get involved in the future of Kentik Portal and we love sourcing our future improvements from our users themselves!

🚀 Tackling Alert Fatigue: Auto-Clear is Here for NMS Event Policies!

Managing network health just got a whole lot smoother. We know how much you love staying on top of your infrastructure, but we also know that manual cleanup can be a drag. That’s why we’re excited to introduce Rolling Window Auto-Clear for Event Alert Policies. This means that NMS syslog and trap alerts have the option for automatic closure after a configurable period of time.

What’s New? ✨

Previously, cleared alerts required specific policy conditions to be met or manual intervention to tidy up your dashboard. Now, within your Event Alert Policies, you can set a custom rolling window that tells Kentik: "If this issue hasn't popped back up in X minutes, go ahead and clear it for me."

• Set it and forget it: Define a specific period of inactivity (e.g., 20 minutes) after which an alert will automatically move from Active to Cleared. 
• Intelligent Tracking: The system monitors the "counter" for your policy conditions; if they aren't met within your specified window, the alert clears itself. 
• Visual Confirmation: You’ll see these transitions reflected in your Up/Down Visualizations with a handy green checkmark showing exactly when the system took care of the cleanup. 

Why You’ll Love It 💎

• Declutter Your Dashboard: Keep your Alerting Page focused only on the issues that actually need your attention right now. 
• Reduced Alert Fatigue: No more "ghost" alerts hanging around after a brief blip has already resolved itself.
• Operational Efficiency: Save those precious clicks for deep-diving into performance data instead of manually acknowledging or clearing minor events. 

Ready to Streamline? 🛠️

Head over to your Manage Alert Policies page to start adding auto-clear windows to your event alert thresholds! 

Managing cloud security shouldn't be a guessing game, especially when you need to know exactly why traffic is being blocked or allowed across your AWS environment. We understand how frustrating and time-consuming it can be to troubleshoot these visibility gaps. And that's why we are thrilled to announce that Kentik Cloud now supports the ingestion of AWS Network Firewall (ANF) logs. 

By integrating this service-based firewall data, Kentik provides you with deep observability into traffic moving into, out of, and across your AWS environment, including critical metadata not found in standard VPC flow logs. This integration empowers your team for proactive network security management by bringing enriched ANF flow logs, alert logs, and firewall metrics all into a single view with the most relevant network context from your AWS environment.

• Pinpoint Blocked Traffic: Quickly identify exactly what traffic is being blocked and why, allowing you to make informed decisions to either whitelist legitimate traffic or address unauthorized attempts immediately.
• Add Context to your Security Policies: Gain comprehensive visibility into specific firewalls, policies, and rules. You can now easily see and audit which traffic is traversing specific firewall rulesets to ensure your security posture aligns with your intended policy.
• Streamline Connectivity Analysis: Visualize the network paths across your AWS environment, ensuring that you have clarity on firewalls, security groups, and network ACLs that are all contributing to a potential connectivity blockage.

What's new?

Network firewalls are a critical part of your cloud network architecture, so it was important that we first provide the relevant context about those ANF connections in the Kentik Map. This also provides important metadata about the Firewall Attachments, Firewall Rule Groups, and all of the connections from VPCs, subnets, Transit Gateways, and more. 

For troubleshooting, it was also important that this firewall metadata was also used for path analysis across your AWS network. We added AWS Network Firewall details to Kentik Cloud Pathfinder, including direct links into the AWS Console for firewall rule configuration.

Finally, we wanted to surface the enriched ANF flow and alert log data to ensure that traffic analysis had a first-class experience in Kentik Data Explorer. Now you can use ANF-provided log dimensions along with Kentik's enrichment engine to make it easy to look at specific dropped flows and which VPC, region, and application they come from. 

How do I get started?

Ready to get more out of your AWS Network Firewall visibility? Log in to the Kentik Portal today to enable AWS Network Firewall log ingestion as part of your Kentik Cloud Export. For step-by-step configuration details, check out our Knowledge Base article on integrating AWS Network Firewall logs.

KProxy has long been a trusted ally in maintaining network visibility across complex and restricted environments. As we look toward the future of network intelligence, we are excited to help you scale even further by integrating these proven capabilities into a more unified and automated platform experience.

See What’s New

With last week’s release of Flow Proxy as a native capability within the Kentik Universal Agent, we are now officially setting a sunset date for the standalone KProxy binary: May 1, 2027.

We’re sharing this roadmap a full year in advance to ensure your team has a clear and supported path to the next generation of flow collection. This transition moves the robust traffic forwarding you've relied on into a "set-it-and-forget-it" capability model. By consolidating into the Universal Agent, you’re moving toward a more streamlined, single-agent architecture that simplifies your entire telemetry stack.

Why It Matters

Transitioning to Flow Proxy allows you to leverage a modern, high-performance architecture while building on the reliable foundation KProxy established.

• Unified Agent Management: Instead of managing KProxy as a separate standalone service, you can now handle everything through the Universal Agent. This means one binary to maintain, one service to monitor, and a much cleaner operational footprint.
• UI-Driven Control & Visibility: We’ve moved configuration out of local text files and into the cloud. You can now deploy, tune, and scale your Flow Proxy settings directly from the Kentik Portal, giving you faster response times and better oversight.
• Enhanced Security Standards: The integrated Flow Proxy brings FIPS support to your traffic forwarding. This ensures your telemetry meets the highest security and compliance standards required for modern regulated environments without any additional configuration complexity.

Get Started!

The future of network intelligence is unified, and the path forward is simple. We recommend all users begin migrating their KProxy instances to the Universal Agent Flow Proxy capability to start taking advantage of these integrated features today.

Dive into the KProxy Migration Guide to map out your move, or jump into the Kentik Portal to enable Flow Proxy on your existing Universal Agents. Let’s get your network ready for 2027.